JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 20.161.70.163

20.161.70.163 was found in our database!

This IP was reported 38 times. Confidence of Abuse is 100%: ?

100%

ISP	Microsoft Corporation
Usage Type	Data Center/Web Hosting/Transit
ASN	AS8075
Domain Name	microsoft.com
Country	🇺🇸 United States of America
City	Boydton, Virginia

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 20.161.70.163

Whois 20.161.70.163

IP Abuse Reports for 20.161.70.163:

This IP address has been reported a total of 38 times from 30 distinct sources. 20.161.70.163 was first reported on September 21st 2025, and the most recent report was 1 day ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇩🇪 wiredalter	2026-06-07 07:58:47 (1 day ago)	Blocked by UFW on dVPS [2082/tcp] Source Port: 36150 TTL: 47 Packet Length: 60 TOS: 0x00 Analyzed b ... show more Blocked by UFW on dVPS [2082/tcp] Source Port: 36150 TTL: 47 Packet Length: 60 TOS: 0x00 Analyzed by https://ip.wiredalter.com show less	Port Scan Brute-Force
🇫🇮 6kilowatti	2026-06-07 07:01:54 (1 day ago)	2026-06-07T10:01:53.551903+03:00 koti kernel: [UFW BLOCK] IN=enp0s25 OUT= MAC=6c:62:6d:bd:29:2d:18:f ... show more 2026-06-07T10:01:53.551903+03:00 koti kernel: [UFW BLOCK] IN=enp0s25 OUT= MAC=6c:62:6d:bd:29:2d:18:fd:74:70:71:9e:08:00 SRC=20.161.70.163 DST=10.0.0.30 LEN=60 TOS=0x00 PREC=0x00 TTL=47 ID=46404 DF PROTO=TCP SPT=36127 DPT=2087 WINDOW=64240 RES=0x00 SYN URGP=0 ... show less	Port Scan
Anonymous	2026-06-07 06:55:51 (1 day ago)	Shorewall log file match.	Port Scan
🇹🇼 kk_it_man	2026-06-07 06:13:02 (1 day ago)	ET INFO Request to Hidden Environment File - Inbound ET WEB_SERVER WEB-PHP phpinfo access GPL WE ... show more ET INFO Request to Hidden Environment File - Inbound ET WEB_SERVER WEB-PHP phpinfo access GPL WEB_SERVER .htpasswd access show less	Port Scan
🇺🇸 TPI-Abuse	2026-06-07 05:54:29 (1 day ago)	(mod_security) mod_security (id:210492) triggered by 20.161.70.163 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:210492) triggered by 20.161.70.163 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Jun 07 01:54:26.017873 2026] [security2:error] [pid 8806:tid 8806] [client 20.161.70.163:34856] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "192.64.150.65"] [uri "/.git/HEAD"] [unique_id "aiUHkv5gb7OAs2lrKMx4RAAAAAQ"] show less	Brute-Force Bad Web Bot Web App Attack
🇹🇭 Sawasdee	2026-06-07 05:24:04 (1 day ago)	Unwanted checking 80 or 443 port ...	Bad Web Bot
🇺🇸 xmission.com	2026-06-07 04:43:51 (1 day ago)	Blocked by UFW (TCP on 2087) Source port: 35119 TTL: 48 Packet length: 60 TOS: 0x00 This report (fo ... show more Blocked by UFW (TCP on 2087) Source port: 35119 TTL: 48 Packet length: 60 TOS: 0x00 This report (for 20.161.70.163) was generated by: https://github.com/sefinek/UFW-AbuseIPDB-Reporter show less	Port Scan
🇦🇹 nomzamo	2026-06-07 04:35:00 (1 day ago)	Fail2Ban reported: nginx-credential-scan	Brute-Force Bad Web Bot
🇺🇸 TPI-Abuse	2026-06-07 04:34:42 (1 day ago)	(mod_security) mod_security (id:210492) triggered by 20.161.70.163 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:210492) triggered by 20.161.70.163 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Jun 07 00:34:39.216914 2026] [security2:error] [pid 28195:tid 28195] [client 20.161.70.163:35074] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "192.64.150.230"] [uri "/.git/HEAD"] [unique_id "aiT035DL5IGVJHHbzPh9vAAAAAk"] show less	Brute-Force Bad Web Bot Web App Attack
🇨🇦 eGuest	2026-06-07 04:24:36 (1 day ago)	20.161.70.163 - - [06/Jun/2026:22:24:33 -0600] "GET /.env.backup HTTP/1.1" 400 666 "-" "Mozilla/5.0 ... show more 20.161.70.163 - - [06/Jun/2026:22:24:33 -0600] "GET /.env.backup HTTP/1.1" 400 666 "-" "Mozilla/5.0 (Linux; Android 14; Pixel 8) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Mobile Safari/537.36" 20.161.70.163 - - [06/Jun/2026:22:24:36 -0600] "GET /wp-config.php HTTP/1.1" 404 844 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36" ... show less	Hacking Web App Attack
🇩🇪 kkeyser	2026-06-07 03:52:48 (1 day ago)	GET /.env HTTP/1.1	Web App Attack
Anonymous	2026-06-07 03:41:44 (1 day ago)	Bot detected scanning for vulnerable pages	Port Scan
🇩🇪 EGP Abuse Dept	2026-06-07 03:28:07 (1 day ago)	Scanning for web/db/file exploits on tpc-055.mach3builders.nl	SQL Injection Bad Web Bot Web App Attack
🇷🇸 Scan	2026-06-07 02:59:03 (1 day ago)	MultiHost/MultiPort Probe, Scan, Hack -	Port Scan Hacking
🇧🇪 sid3windr	2026-06-03 16:09:39 (4 days ago)	GET /.git/config (Tarpitted for 1d15h8m28s, wasted 8.06MB)	Web App Attack

Showing 1 to 15 of 38 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇺🇸 2620:18c:0:192::e0:217

🇺🇸 195.184.76.247

🇺🇸 146.148.97.186

🇺🇸 2604:a880:400:d1:0:4:6c81:b001

🇧🇷 187.180.164.242

🇲🇽 186.96.145.241

🇨🇳 171.37.47.145

🇨🇳 101.35.210.162

🇺🇸 64.62.197.188

🇫🇮 35.228.219.64

🇨🇳 14.103.115.85

🇺🇿 213.230.93.52

🇩🇪 213.209.159.56

🇰🇷 211.223.107.86

🇨🇳 180.153.236.219

🇺🇸 157.230.236.254

🇪🇸 79.116.231.1

🇳🇱 45.148.10.157

🇳🇱 45.142.193.53

🇳🇱 45.94.31.183