JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

20.118.27.138

Recent Activity

Abuse confidence score ?

100% Critical

265 reports

114 reporters · latest 58 minutes ago

ISP	Microsoft Corporation
Usage Type	Data Center/Web Hosting/Transit
ASN	AS8075
Domain Name	microsoft.com
Country	🇺🇸 United States of America
City	Des Moines, Iowa

ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report Whois

Reports Activity

Example preview

Report Categories (Last 60 Days)

Example preview

Top Reporter Countries (Last 60 Days)

Example preview

Account required for the enhanced features Log in Sign up

IP Abuse Reports for 20.118.27.138

Export CSV

This IP address has been reported a total of 265 times from 114 distinct sources. 20.118.27.138 was first reported on October 12th 2026, and the most recent report was 58 minutes ago. In the last 60 days, the top reporter locations were: United States of America with 86 reports; Germany with 41 reports; France with 29 reports. The most common categories in these recent reports were: Port Scan 210 times; Hacking 54 times; Brute-Force 45 times; Web App Attack 33 times; Bad Web Bot 12 times; Other 34 times.

Reporter	IoA Timestamp (UTC)	Comment	Categories
Anonymous	2026-10-26 08:47:35 (58 minutes ago)	Blocked by UFW (TCP on 9000) Source port: 34265 TTL: 36 Packet length: 52 TOS: 0x14 This report (fo ... show more Blocked by UFW (TCP on 9000) Source port: 34265 TTL: 36 Packet length: 52 TOS: 0x14 This report (for 20.118.27.138) was generated by: https://github.com/sefinek/UFW-AbuseIPDB-Reporter show less	Port Scan
🇲🇳 Public CSIRT/CC of Mongolia	2026-10-26 07:56:57 (1 hour ago)	Honeypot hit: Unauthorized traffic (243 bytes of payload); 5223 [1] TCP	Port Scan
🇺🇸 chronos	2026-10-26 06:54:11 (2 hours ago)	[AUTORAVALT][[26/10/2026 - 03:54:11 -03:00 UTC] Attack from [Microsoft Corporation] [20.118.27.138] ... show more [AUTORAVALT][[26/10/2026 - 03:54:11 -03:00 UTC] Attack from [Microsoft Corporation] [20.118.27.138] Action: BLocKed Phishing -> Phishing websites and/or email. Email Spam -> Spam email content, infected attachments, and phishing emails. Hacking... Unauthorized attempts to access the server. Spoofing -> Email sender spoofing. Brute-Force -> Credential brute-for] ... show less	Brute-Force Email Spam Spoofing Phishing Hacking
🇺🇸 donarev419	2026-10-26 06:47:48 (2 hours ago)	Connection to port 443 with data transfer. Data preview: �	Port Scan Hacking
🇺🇸 xmission.com	2026-10-26 06:30:52 (3 hours ago)	Blocked by UFW (TCP on 2525) Source port: 59274 TTL: 52 Packet length: 52 TOS: 0x00 This report (fo ... show more Blocked by UFW (TCP on 2525) Source port: 59274 TTL: 52 Packet length: 52 TOS: 0x00 This report (for 20.118.27.138) was generated by: https://github.com/sefinek/UFW-AbuseIPDB-Reporter show less	Port Scan
🇺🇸 chronos	2026-10-26 06:26:32 (3 hours ago)	[AUTORAVALT][[26/10/2026 - 03:26:32 -03:00 UTC] Attack from [Microsoft Corporation] [20.118.27.138] ... show more [AUTORAVALT][[26/10/2026 - 03:26:32 -03:00 UTC] Attack from [Microsoft Corporation] [20.118.27.138] Action: BLocKed Phishing -> Phishing websites and/or email. Email Spam -> Spam email content, infected attachments, and phishing emails. Hacking... Unauthorized attempts to access the server. Spoofing -> Email sender spoofing. Brute-Force -> Credential brute-for] ... show less	Brute-Force Email Spam Spoofing Phishing Hacking
🇺🇸 RAP	2026-10-26 05:59:08 (3 hours ago)	2026-10-26 05:59:08 UTC Unauthorized activity to TCP port 1433. SQL	Port Scan
🇺🇸 xmission.com	2026-10-26 04:24:49 (5 hours ago)	Blocked by UFW (TCP on 5984) Source port: 52877 TTL: 52 Packet length: 52 TOS: 0x00 This report (fo ... show more Blocked by UFW (TCP on 5984) Source port: 52877 TTL: 52 Packet length: 52 TOS: 0x00 This report (for 20.118.27.138) was generated by: https://github.com/sefinek/UFW-AbuseIPDB-Reporter show less	Port Scan
🇺🇸 xmission.com	2026-10-26 01:44:21 (8 hours ago)	Blocked by UFW (TCP on 4444) Source port: 43500 TTL: 51 Packet length: 52 TOS: 0x00 This report (fo ... show more Blocked by UFW (TCP on 4444) Source port: 43500 TTL: 51 Packet length: 52 TOS: 0x00 This report (for 20.118.27.138) was generated by: https://github.com/sefinek/UFW-AbuseIPDB-Reporter show less	Port Scan
🇺🇸 chronos	2026-10-25 21:28:33 (12 hours ago)	[AUTORAVALT][[25/10/2026 - 18:28:32 -03:00 UTC] Attack from [Microsoft Corporation] [20.118.27.138] ... show more [AUTORAVALT][[25/10/2026 - 18:28:32 -03:00 UTC] Attack from [Microsoft Corporation] [20.118.27.138] Action: BLocKed Phishing -> Phishing websites and/or email. Email Spam -> Spam email content, infected attachments, and phishing emails. Hacking... Unauthorized attempts to access the server. Spoofing -> Email sender spoofing. Brute-Force -> Credential brute-for] ... show less	Brute-Force Email Spam Spoofing Phishing Hacking
🇺🇸 RAP	2026-10-25 19:45:35 (14 hours ago)	2026-10-25 19:45:35 UTC Unauthorized activity to TCP port 9200.	Port Scan
Anonymous	2026-10-25 18:36:48 (15 hours ago)	Drop from IP address 20.118.27.138 to tcp-port 4000	Port Scan
🇺🇸 xmission.com	2026-10-25 16:37:10 (17 hours ago)	Blocked by UFW (TCP on 2222) Source port: 50941 TTL: 51 Packet length: 52 TOS: 0x00 This report (fo ... show more Blocked by UFW (TCP on 2222) Source port: 50941 TTL: 51 Packet length: 52 TOS: 0x00 This report (for 20.118.27.138) was generated by: https://github.com/sefinek/UFW-AbuseIPDB-Reporter show less	Port Scan
🇩🇪 Jochen Pretli	2026-10-25 16:29:46 (17 hours ago)	connection to honeypot	Email Spam Port Scan
🇺🇸 xmission.com	2026-10-25 13:36:30 (20 hours ago)	Blocked by UFW (TCP on 5007) Source port: 50458 TTL: 52 Packet length: 52 TOS: 0x00 This report (fo ... show more Blocked by UFW (TCP on 5007) Source port: 50458 TTL: 52 Packet length: 52 TOS: 0x00 This report (for 20.118.27.138) was generated by: https://github.com/sefinek/UFW-AbuseIPDB-Reporter show less	Port Scan

Showing 1 to 15 of 265 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇵🇱 2a03:2880:f330:95:face:b00c:0:2

🇧🇩 202.136.89.76

🇳🇱 160.119.76.139

🇺🇸 147.185.132.172

🇭🇰 118.26.39.140

🇺🇸 100.15.147.54

🇺🇸 95.135.9.137

🇫🇷 91.231.89.110

🇷🇴 80.94.92.179

🇩🇪 69.5.169.101

🇻🇪 38.74.241.147

🇨🇳 220.167.233.67

🇨🇳 218.59.188.38

🇷🇺 217.150.47.21

🇪🇸 185.197.242.14

🇩🇿 154.242.73.233

🇭🇰 144.48.243.18

🇮🇩 140.213.166.119

🇭🇰 123.58.219.129

🇺🇸 68.170.234.3