JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 20.119.87.99

20.119.87.99 was found in our database!

This IP was reported 31 times. Confidence of Abuse is 47%: ?

47%

ISP	Microsoft Corporation
Usage Type	Data Center/Web Hosting/Transit
ASN	AS8075
Domain Name	microsoft.com
Country	🇺🇸 United States of America
City	Washington, Virginia

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 20.119.87.99

Whois 20.119.87.99

IP Abuse Reports for 20.119.87.99:

This IP address has been reported a total of 31 times from 23 distinct sources. 20.119.87.99 was first reported on June 3rd 2026, and the most recent report was 22 hours ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇩🇪 www.fransveldman.world	2026-07-23 12:02:32 (22 hours ago)	Fetched browser challenge page 10 times in <2h without solving. Likely bad bot.	Bad Web Bot
🇯🇵 demonsword	2026-07-18 09:16:00 (6 days ago)	Detected by SentinelX honeypot: sent HTTP CONNECT request probing for an open proxy. Connection was ... show more Detected by SentinelX honeypot: sent HTTP CONNECT request probing for an open proxy. Connection was hijacked and held in a tarpit to slow down the scan. Probed target: mega.nz:443 show less	Open Proxy Port Scan
🇧🇬 HighWay	2026-06-27 17:44:14 (3 weeks ago)	20.119.87.99 - - [27/Jun/2026:17:44:12 +0000] "CONNECT www.eastmoney.com:443 HTTP/1.1" 403 444 "-" " ... show more 20.119.87.99 - - [27/Jun/2026:17:44:12 +0000] "CONNECT www.eastmoney.com:443 HTTP/1.1" 403 444 "-" "Go-http-client/1.1" 20.119.87.99 - - [27/Jun/2026:17:44:12 +0000] "CONNECT www.sse.com.cn:443 HTTP/1.1" 403 441 "-" "Go-http-client/1.1" 20.119.87.99 - - [27/Jun/2026:17:44:12 +0000] "CONNECT finance.sina.com.cn:443 HTTP/1.1" 403 446 "-" "Go-http-client/1.1" ... show less	Hacking Port Scan
🇺🇸 MPL	2026-06-16 06:12:50 (1 month ago)	tcp/2078 (2 or more attempts)	Port Scan
🇺🇸 Axel	2026-06-16 05:47:42 (1 month ago)	Blocked by UFW on MVI [2078/tcp] \| SPT: 12292 \| TTL: 48 \| LEN: 60 \| TOS: 0x00 • Reported by: github. ... show more Blocked by UFW on MVI [2078/tcp] \| SPT: 12292 \| TTL: 48 \| LEN: 60 \| TOS: 0x00 • Reported by: github.com/sefinek/UFW-AbuseIPDB-Reporter show less	Port Scan
Anonymous	2026-06-14 00:43:28 (1 month ago)	Portscan: TCP/8880, TCP/4000, TCP/2078, TCP/8443, TCP/2082, TCP/8888, TCP/2077, TCP/2087, TCP/2095, ... show more Portscan: TCP/8880, TCP/4000, TCP/2078, TCP/8443, TCP/2082, TCP/8888, TCP/2077, TCP/2087, TCP/2095, TCP/8090, TCP/2096, TCP/3000, TCP/2083, TCP/9000 show less	Port Scan
🇬🇧 pearbright	2026-06-13 15:59:04 (1 month ago)	2026-06-13T15:59:04.398852+00:00 srv1093252 kernel: [2112332.522811] [UFW BLOCK] IN=eth0 OUT= MAC=28 ... show more 2026-06-13T15:59:04.398852+00:00 srv1093252 kernel: [2112332.522811] [UFW BLOCK] IN=eth0 OUT= MAC=28:e8:d4:b5:be:84:44:38:39:ff:ff:41:08:00 SRC=20.119.87.99 DST=72.61.19.109 LEN=60 TOS=0x00 PREC=0x00 TTL=42 ID=64724 DF PROTO=TCP SPT=36888 DPT=2082 WINDOW=64240 RES=0x00 SYN URGP=0 2026-06-13T15:59:04.399089+00:00 srv1093252 kernel: [2112332.522848] [UFW BLOCK] IN=eth0 OUT= MAC=28:e8:d4:b5:be:84:44:38:39:ff:ff:41:08:00 SRC=20.119.87.99 DST=72.61.19.109 LEN=60 TOS=0x00 PREC=0x00 TTL=43 ID=916 DF PROTO=TCP SPT=36888 DPT=2086 WINDOW=64240 RES=0x00 SYN URGP=0 2026-06-13T15:59:04.399121+00:00 srv1093252 kernel: [2112332.522953] [UFW BLOCK] IN=eth0 OUT= MAC=28:e8:d4:b5:be:84:44:38:39:ff:ff:41:08:00 SRC=20.119.87.99 DST=72.61.19.109 LEN=60 TOS=0x00 PREC=0x00 TTL=42 ID=59378 DF PROTO=TCP SPT=36888 DPT=8443 WINDOW=64240 RES=0x00 SYN URGP=0 2026-06-13T15:59:04.399148+00:00 srv1093252 kernel: [2112332.523417] [UFW BLOCK] IN=eth0 OUT= MAC=28:e8:d4:b5:be:84:44:38:39:ff:ff:41:08:00 SRC=20.119.87.99 ... show less	Port Scan
Anonymous	2026-06-13 15:55:33 (1 month ago)	Port Scan	Port Scan
🇺🇸 Axel	2026-06-13 11:24:47 (1 month ago)	Blocked by UFW on MVI [8880/tcp] \| SPT: 36888 \| TTL: 47 \| LEN: 60 \| TOS: 0x00 • Reported by: github. ... show more Blocked by UFW on MVI [8880/tcp] \| SPT: 36888 \| TTL: 47 \| LEN: 60 \| TOS: 0x00 • Reported by: github.com/sefinek/UFW-AbuseIPDB-Reporter show less	Port Scan
🇦🇹 urnilxfgbez	2026-06-10 22:45:00 (1 month ago)	Last 24 Hours suspicious: (DPT=445\|DPT=3389\|DPT=22\|DPT=3306\|DPT=8080\|DPT=23\|DPT=5900\|DPT=1433)	Port Scan
🇮🇩 sockominfo	2026-06-10 13:00:53 (1 month ago)	Access to sensitive files detected w/ specific boundary.. Threat Score: 5/10 (MEDIUM). Confidence: 4 ... show more Access to sensitive files detected w/ specific boundary.. Threat Score: 5/10 (MEDIUM). Confidence: 40%. CVSS v3.1: 2.9/10 (Low). CVSS Vector: CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N. Bayesian Probability: 40%. MITRE ATT&CK: T1016 (System Network Configuration Discovery). Tactic: TA0001. Freshness: Fresh. Source Reputation: UNKNOWN. Methodology: CVSS 3.1 + Bayesian + Temporal + Environmental + MITRE ATT&CK + OWASP. Standards: ISO/IEC 27065:2022, NIST SP 800-30, IEEE S&P 2020. Reported by TangerangKota-CSIRT. Status: MALICIOUS show less	Hacking Web App Attack
🇩🇪 maxpower	2026-06-10 12:24:30 (1 month ago)	(exploit_critical) REGOLA 2 - Critical File Exploit Attempt 20.119.87.99 (US/United States/-): 2 in ... show more (exploit_critical) REGOLA 2 - Critical File Exploit Attempt 20.119.87.99 (US/United States/-): 2 in the last 3600 secs; Ports: ; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: 2026/06/10 14:24:21 [error] 637896#637896: 3053697 access forbidden by rule, client: 20.119.87.99, server: spacehosting.ovh, request: "GET /wp-config.php.bak HTTP/1.1", host: "51.89.20.64" 20.119.87.99 - - [10/Jun/2026:14:24:25 +0200] "GET /.aws/credentials HTTP/1.1" 404 0 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)" "-" host=51.89.20.64 show less	Port Scan
🇺🇸 TPI-Abuse	2026-06-10 12:02:04 (1 month ago)	(mod_security) mod_security (id:210492) triggered by 20.119.87.99 (-): 1 in the last 300 secs; Ports ... show more (mod_security) mod_security (id:210492) triggered by 20.119.87.99 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jun 10 08:01:57.132003 2026] [security2:error] [pid 3336:tid 3336] [client 20.119.87.99:35658] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "192.64.150.74"] [uri "/.git/HEAD"] [unique_id "ailSNbYVMfP7SbZWkPBTGgAAAAM"] show less	Brute-Force Bad Web Bot Web App Attack
🇮🇩 sockominfo	2026-06-10 12:00:53 (1 month ago)	Access to sensitive files detected w/ specific boundary.. Threat Score: 5.2/10 (MEDIUM). Confidence: ... show more Access to sensitive files detected w/ specific boundary.. Threat Score: 5.2/10 (MEDIUM). Confidence: 40%. CVSS v3.1: 2.9/10 (Low). CVSS Vector: CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N. Bayesian Probability: 40%. MITRE ATT&CK: T1016 (System Network Configuration Discovery). Tactic: TA0001. Freshness: Fresh. Source Reputation: UNKNOWN. Methodology: CVSS 3.1 + Bayesian + Temporal + Environmental + MITRE ATT&CK + OWASP. Standards: ISO/IEC 27065:2022, NIST SP 800-30, IEEE S&P 2020. Reported by TangerangKota-CSIRT. Status: MALICIOUS show less	Hacking Web App Attack
🇮🇩 sockominfo	2026-06-10 11:00:15 (1 month ago)	Access to sensitive files detected w/ specific boundary.. Threat Score: 6.8/10 (MEDIUM). Reported by ... show more Access to sensitive files detected w/ specific boundary.. Threat Score: 6.8/10 (MEDIUM). Reported by TangerangKota-CSIRT show less	Hacking Web App Attack

Showing 1 to 15 of 31 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇧🇷 200.165.70.141

🇻🇳 101.99.14.34

🇬🇧 35.203.210.198

🇹🇷 188.119.54.55

🇺🇸 162.216.150.165

🇰🇷 119.192.249.195

🇫🇷 91.134.23.125

🇱🇹 81.30.98.144

🇫🇮 77.105.161.120

🇺🇸 47.251.247.149

🇸🇬 45.78.194.186

🇮🇶 37.237.136.54

🇫🇷 37.59.204.156

🇷🇴 2.57.122.238

🇧🇩 203.95.220.192

🇩🇪 193.46.232.226

🇩🇪 188.68.60.230

🇺🇸 172.98.32.199

🇺🇸 172.98.32.193

🇺🇸 147.185.132.150