JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 20.120.84.85

20.120.84.85 was found in our database!

This IP was reported 18 times. Confidence of Abuse is 37%: ?

37%

ISP	Microsoft Corporation
Usage Type	Data Center/Web Hosting/Transit
ASN	AS8075
Domain Name	microsoft.com
Country	🇺🇸 United States of America
City	Dulles Town Center, Virginia

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 20.120.84.85

Whois 20.120.84.85

IP Abuse Reports for 20.120.84.85:

This IP address has been reported a total of 18 times from 12 distinct sources. 20.120.84.85 was first reported on April 28th 2026, and the most recent report was 4 days ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇩🇪 33three	2026-09-14 03:52:14 (4 days ago)	Fail2Ban jail WebAttack triggered	Brute-Force
🇺🇸 micropedro	2026-09-06 12:17:42 (1 week ago)	4 incidents: malicious activity. Ports: 2082/TCP(1), 2083/TCP(1), 2086/TCP(1), 2087/TCP(1), 2095/TCP ... show more 4 incidents: malicious activity. Ports: 2082/TCP(1), 2083/TCP(1), 2086/TCP(1), 2087/TCP(1), 2095/TCP(1). First: 2026-09-06 08:17, Last: 2026-09-06 08:17 UTC. Triggers: unknown. show less	Port Scan
🇺🇸 micropedro	2026-09-06 12:17:42 (1 week ago)	4 incidents: malicious activity. First: 2026-09-06 08:17, Last: 2026-09-06 08:17 UTC. Triggers: unkn ... show more 4 incidents: malicious activity. First: 2026-09-06 08:17, Last: 2026-09-06 08:17 UTC. Triggers: unknown. show less	Port Scan
🇺🇸 micropedro	2026-09-04 10:51:14 (1 week ago)	4 incidents: malicious activity. Ports: 2082/TCP(1), 2083/TCP(1), 2086/TCP(1), 2087/TCP(1), 2095/TCP ... show more 4 incidents: malicious activity. Ports: 2082/TCP(1), 2083/TCP(1), 2086/TCP(1), 2087/TCP(1), 2095/TCP(1). First: 2026-09-04 06:51, Last: 2026-09-04 06:51 UTC. Triggers: unknown. show less	Port Scan
🇺🇸 micropedro	2026-09-04 10:51:14 (1 week ago)	4 incidents: malicious activity. First: 2026-09-04 06:51, Last: 2026-09-04 06:51 UTC. Triggers: unkn ... show more 4 incidents: malicious activity. First: 2026-09-04 06:51, Last: 2026-09-04 06:51 UTC. Triggers: unknown. show less	Port Scan
Anonymous	2026-08-31 16:38:30 (2 weeks ago)	SIEM ALERT AUTO REPORT	Email Spam
🇳🇱 Tsumugi Kotobuki	2026-08-31 15:50:38 (2 weeks ago)	Port Scan on Honeypot \| Ports: 8080/HTTP-proxy \| Proto: TCP(1) \| Flags: all SYN \| TTL: 41 \| Len: 60B ... show more Port Scan on Honeypot \| Ports: 8080/HTTP-proxy \| Proto: TCP(1) \| Flags: all SYN \| TTL: 41 \| Len: 60B \| Win: 64240(1) \| F2B/ufw-honeypot@2026-08-31T15:50:38Z show less	Port Scan Hacking
🇩🇪 gadix	2026-08-31 15:27:22 (2 weeks ago)	[31/Aug/2026:17:27:17.952081 +0200] apWdVSbICfVPigA7p4Yy-wAAAAw 20.120.84.85 49022 127.0.0.1 7080 [3 ... show more [31/Aug/2026:17:27:17.952081 +0200] apWdVSbICfVPigA7p4Yy-wAAAAw 20.120.84.85 49022 127.0.0.1 7080 [31/Aug/2026:17:27:19.411426 +0200] apWdVybICfVPigA7p4Yy_AAAAAE 20.120.84.85 49030 127.0.0.1 7080 [31/Aug/2026:17:27:20.619777 +0200] apWdWBLicAYM45C60xvcrAAAAFQ 20.120.84.85 49044 127.0.0.1 7080 ... show less	Web App Attack
🇺🇸 micropedro	2026-08-31 14:44:45 (2 weeks ago)	6 incidents: web scanning/attack, port scanning. Ports: 2082/TCP(1), 2083/TCP(1), 2086/TCP(1), 2087/ ... show more 6 incidents: web scanning/attack, port scanning. Ports: 2082/TCP(1), 2083/TCP(1), 2086/TCP(1), 2087/TCP(1), 2095/TCP(1). First: 2026-08-31 10:44, Last: 2026-08-31 10:44 UTC. Triggers: non-public-port,ufw-repeater,port-trap,recidive,firewall-tcp,firewall-http. show less	Port Scan Brute-Force Web App Attack
🇷🇸 Scan	2026-08-10 06:45:04 (1 month ago)	MultiHost/MultiPort Probe, Scan, Hack -	Port Scan Hacking
🇺🇸 TPI-Abuse	2026-08-10 06:27:03 (1 month ago)	(mod_security) mod_security (id:210492) triggered by 20.120.84.85 (-): 1 in the last 300 secs; Ports ... show more (mod_security) mod_security (id:210492) triggered by 20.120.84.85 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Aug 10 02:26:58.702852 2026] [security2:error] [pid 1502561:tid 1502561] [client 20.120.84.85:29729] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "192.64.151.7"] [uri "/.git/refs/heads/main"] [unique_id "anlvMoLy1PRCIGuFsmptEgAAAGk"] show less	Brute-Force Bad Web Bot Web App Attack
🇮🇹 VHosting	2026-08-07 23:55:03 (1 month ago)	Detected mail brute force attack from 4 different servers	Brute-Force
🇩🇪 femboy.cat	2026-07-23 13:24:25 (1 month ago)	Port scan to tcp/443 from 20.120.84.85	Brute-Force
🇺🇸 www.winos.me	2026-07-23 13:19:12 (1 month ago)	Shield: Layer4 Port 9 Trap	Port Scan Hacking
🇧🇾 lns.bz	2026-06-18 04:06:40 (3 months ago)	Too many 404 requests [BY]	Web App Attack

Showing 1 to 15 of 18 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇺🇸 216.87.32.78

🇧🇷 189.127.19.28

🇻🇳 123.25.115.189

🇺🇸 52.173.67.116

🇭🇰 223.18.201.43

🇩🇪 213.209.159.108

🇺🇸 209.37.38.210

🇭🇰 202.155.236.242

🇺🇸 170.187.154.22

🇩🇪 167.99.241.118

🇺🇸 162.216.150.228

🇭🇰 156.225.1.108

🇫🇷 138.199.16.131

🇨🇳 106.4.161.154

🇧🇦 89.117.46.54

🇰🇿 87.121.125.18

🇫🇷 85.217.140.45

🇧🇬 79.124.58.18

🇺🇦 77.109.21.190

🇲🇾 47.254.192.136