JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 20.161.60.99

20.161.60.99 was found in our database!

This IP was reported 620 times. Confidence of Abuse is 78%: ?

78%

ISP	Microsoft Corporation
Usage Type	Data Center/Web Hosting/Transit
ASN	AS8075
Domain Name	microsoft.com
Country	🇺🇸 United States of America
City	Boydton, Virginia

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 20.161.60.99

Whois 20.161.60.99

IP Abuse Reports for 20.161.60.99:

This IP address has been reported a total of 620 times from 59 distinct sources. 20.161.60.99 was first reported on October 20th 2025, and the most recent report was 4 days ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇯🇵 SentinalX by uzumaru	2026-06-10 03:55:03 (4 days ago)	Detected by SentinelX honeypot: sent HTTP CONNECT request probing for an open proxy. Connection was ... show more Detected by SentinelX honeypot: sent HTTP CONNECT request probing for an open proxy. Connection was hijacked and held in a tarpit to slow down the scan. Probed target: ptlogin.4399.com:443 show less	Open Proxy Port Scan
🇫🇷 Hiigara	2026-06-09 01:00:53 (5 days ago)	connection attempt : 20.161.60.99 on port : tcp/8080 (HTTP-alt)	Port Scan
🇫🇷 ✨	2026-06-09 00:09:10 (5 days ago)	Domain : www54.verysecuresites.net Rule : env 2026-06-09 00:06:57 W3SVC175 PLESK76 217.194.212.113 G ... show more Domain : www54.verysecuresites.net Rule : env 2026-06-09 00:06:57 W3SVC175 PLESK76 217.194.212.113 GET /.env - 80 - 20.161.60.99 HTTP/1.1 Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0 - - 217.194.212.113 404 0 2 9037 181 135 - - show less	Hacking SQL Injection
🇺🇸 TPI-Abuse	2026-06-09 00:07:25 (5 days ago)	(mod_security) mod_security (id:210492) triggered by 20.161.60.99 (-): 1 in the last 300 secs; Ports ... show more (mod_security) mod_security (id:210492) triggered by 20.161.60.99 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jun 08 20:07:17.129471 2026] [security2:error] [pid 19413:tid 19413] [client 20.161.60.99:42123] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "192.64.150.215"] [uri "/.git/HEAD"] [unique_id "aidZNdzdxa8yKehHJQx-SwAAAAY"] show less	Brute-Force Bad Web Bot Web App Attack
🇷🇸 Scan	2026-06-09 00:04:37 (5 days ago)	MultiHost/MultiPort Probe, Scan, Hack -	Port Scan Hacking
🇺🇸 RAP	2026-06-08 23:03:18 (5 days ago)	2026-06-08 23:03:18 UTC Unauthorized activity to TCP port 8080. Web App	Port Scan Web App Attack
🇩🇪 maxpower	2026-06-08 22:54:14 (5 days ago)	(exploit_critical) REGOLA 2 - Critical File Exploit Attempt 20.161.60.99 (US/United States/-): 2 in ... show more (exploit_critical) REGOLA 2 - Critical File Exploit Attempt 20.161.60.99 (US/United States/-): 2 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: 20.161.60.99 - - [09/Jun/2026:00:54:08 +0200] "GET /wp-config.php.bak HTTP/1.1" 403 548 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36" "-" host=51.89.20.64 20.161.60.99 - - [09/Jun/2026:00:54:10 +0200] "GET /.aws/credentials HTTP/1.1" 404 10387 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_4_1) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.4 Safari/605.1.15" "-" host=51.89.20.64 show less	Port Scan
🇯🇵 S.O.B.A. Dev.	2026-06-08 22:00:35 (5 days ago)	Persistent port scanning or vulnerability scanning	Port Scan
🇵🇱 webadmin	2026-06-08 20:42:36 (5 days ago)		Web App Attack
🇮🇩 Burayot	2026-06-08 19:55:10 (5 days ago)	LF_MODSEC: (mod_security) mod_security (id:1000001) triggered by 20.161.60.99 (US/United States/-): ... show more LF_MODSEC: (mod_security) mod_security (id:1000001) triggered by 20.161.60.99 (US/United States/-): 1 in the last 3600 secs show less	Web App Attack
🇨🇿 Countryman	2026-06-08 19:38:16 (5 days ago)	IPS detection: Spring.Boot.Actuator.Unauthorized.Access	Hacking
🇺🇸 pduggusa	2026-05-25 01:43:27 (2 weeks ago)	Detected attacking dugganusa.com at 2026-05-25T01:43:27.881Z \| Attack: Web Service \| Source: DugganU ... show more Detected attacking dugganusa.com at 2026-05-25T01:43:27.881Z \| Attack: Web Service \| Source: DugganUSA PreCog auto-block show less	Hacking
🇺🇸 pduggusa	2026-05-25 00:42:34 (2 weeks ago)	Detected attacking dugganusa.com at 2026-05-25T00:42:34.421Z \| Attack: Web Service \| Source: DugganU ... show more Detected attacking dugganusa.com at 2026-05-25T00:42:34.421Z \| Attack: Web Service \| Source: DugganUSA PreCog auto-block show less	Hacking
🇺🇸 pduggusa	2026-05-24 03:35:13 (3 weeks ago)	Detected attacking dugganusa.com at 2026-05-24T03:35:13.590Z \| Attack: Web Service \| Source: DugganU ... show more Detected attacking dugganusa.com at 2026-05-24T03:35:13.590Z \| Attack: Web Service \| Source: DugganUSA PreCog auto-block show less	Hacking
🇺🇸 pduggusa	2026-05-24 02:37:39 (3 weeks ago)	Detected attacking dugganusa.com at 2026-05-24T02:37:39.826Z \| Attack: Web Service \| Source: DugganU ... show more Detected attacking dugganusa.com at 2026-05-24T02:37:39.826Z \| Attack: Web Service \| Source: DugganUSA PreCog auto-block show less	Hacking

Showing 1 to 15 of 620 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇮🇳 167.71.227.158

🇷🇺 155.212.17.174

🇺🇸 137.184.105.192

🇮🇳 2400:d321:2277:3897::1

🇩🇪 217.160.212.27

🇨🇭 209.99.189.177

🇧🇷 186.235.125.109

🇧🇷 179.246.216.186

🇺🇸 173.239.240.103

🇮🇩 163.7.8.79

🇳🇱 160.119.69.14

🇫🇷 92.154.95.236

🇺🇸 91.230.168.101

🇮🇩 69.5.23.222

🇧🇷 45.205.1.241

🇧🇷 43.164.194.198

🇨🇦 20.151.179.130

🇬🇧 8.228.54.226

🇩🇪 193.124.20.238

🇩🇪 167.99.129.241