JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 20.168.115.112

20.168.115.112

Neutral Activity

100 reports found in our database

0% Low Risk

Abuse confidence score ?

ISP

Microsoft Corporation

Usage Type

Data Center/Web Hosting/Transit

ASN

AS8075

Domain Name

microsoft.com

Country

🇺🇸 United States of America

City

Phoenix, Arizona

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report Whois

No reports in the last 60 days

20.168.115.112 has been reported 100 times. The most recent report is from 1 month ago.

The full history is preserved below and remains searchable. A 0% score reflects the absence of recent activity, but this is not a guarantee that earlier reports were invalid. Abuse confidence score decays, naturally, over time, when the abusive activity stops.

IP Abuse Reports for 20.168.115.112:

This IP address has been reported a total of 100 times from 90 distinct sources. 20.168.115.112 was first reported on January 18th 2026, and the most recent report was 1 month ago.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇩🇪 www.fransveldman.world	2026-07-14 04:05:26 (1 month ago)	Fetched browser challenge page 10 times in <2h without solving. Likely bad bot.	Bad Web Bot
🇺🇸 xmission.com	2026-06-16 07:14:16 (2 months ago)	Blocked by UFW (TCP on 2087) Source port: 25800 TTL: 53 Packet length: 60 TOS: 0x00 This report (fo ... show more Blocked by UFW (TCP on 2087) Source port: 25800 TTL: 53 Packet length: 60 TOS: 0x00 This report (for 20.168.115.112) was generated by: https://github.com/sefinek/UFW-AbuseIPDB-Reporter show less	Port Scan
🇧🇾 lns.bz	2026-06-14 21:41:31 (2 months ago)	.env scanning [BY]	Web App Attack
🇺🇸 GreekCity	2026-06-14 21:11:18 (2 months ago)	[Sun Jun 14 16:11:17.791510 2026] [proxy_fcgi:error] [pid 1780136:tid 1780136] [client 20.168.115.11 ... show more [Sun Jun 14 16:11:17.791510 2026] [proxy_fcgi:error] [pid 1780136:tid 1780136] [client 20.168.115.112:29125] AH01071: Got error 'Primary script unknown' ... show less	Hacking
🇺🇸 TPI-Abuse	2026-06-14 20:54:47 (2 months ago)	(mod_security) mod_security (id:210492) triggered by 20.168.115.112 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210492) triggered by 20.168.115.112 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Jun 14 16:54:42.368822 2026] [security2:error] [pid 21613:tid 21613] [client 20.168.115.112:29133] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "192.64.150.186"] [uri "/.git/HEAD"] [unique_id "ai8VEh63VASQSUapAx0m2wAAAAk"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 sumnone	2026-06-14 19:07:54 (2 months ago)	Port probing on unauthorized port 2078	Port Scan Hacking Exploited Host
🇺🇸 TPI-Abuse	2026-06-14 16:50:44 (2 months ago)	(mod_security) mod_security (id:210492) triggered by 20.168.115.112 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210492) triggered by 20.168.115.112 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Jun 14 12:50:39.166760 2026] [security2:error] [pid 8801:tid 8801] [client 20.168.115.112:27744] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "192.64.150.204"] [uri "/.env"] [unique_id "ai7b36raKLHAlP0r5d7CjwAAAA4"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 GreekCity	2026-06-14 16:11:17 (2 months ago)	bad-bot hacking for vulnerable links.	Hacking Exploited Host
Anonymous	2026-06-09 14:06:43 (3 months ago)	Hit honeypot r.	Port Scan Hacking Exploited Host
🇩🇪 KPS	2026-06-09 12:23:30 (3 months ago)	PortscanM	Port Scan
🇫🇷 dynamix	2026-06-09 12:09:12 (3 months ago)	Multiple WAF Violations	Web App Attack
Anonymous	2026-06-09 11:37:38 (3 months ago)	Unauthorized connection attempt	Port Scan Hacking Exploited Host
🇺🇸 i553041	2026-06-09 11:34:41 (3 months ago)	20.168.115.112 - - [09/Jun/2026:11:34:25 +0000] "GET /.git/HEAD HTTP/1.1" 404 118 "-" "Mozilla/5.0 ( ... show more 20.168.115.112 - - [09/Jun/2026:11:34:25 +0000] "GET /.git/HEAD HTTP/1.1" 404 118 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14.4; rv:125.0) Gecko/20100101 Firefox/125.0" 20.168.115.112 - - [09/Jun/2026:11:34:25 +0000] "GET /.git/config HTTP/1.1" 404 181 "-" "Mozilla/5.0 (Linux; Android 14; Pixel 8) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Mobile Safari/537.36" 20.168.115.112 - - [09/Jun/2026:11:34:26 +0000] "GET /.env HTTP/1.1" 404 118 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14.4; rv:125.0) Gecko/20100101 Firefox/125.0" 20.168.115.112 - - [09/Jun/2026:11:34:27 +0000] "GET /.env.local HTTP/1.1" 404 118 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)" 20.168.115.112 - - [09/Jun/2026:11:34:27 +0000] "GET /.env.production HTTP/1.1" 404 118 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_4_1) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.4 Safari/605.1.15" 20.168.115.112 - - [09/Jun/2026:11:34:28 +0000] "GET /.env.backup HTTP/1.1" 404 ... show less	Brute-Force SSH
🇩🇪 maxpower	2026-06-09 11:23:09 (3 months ago)	(exploit_critical) REGOLA 2 - Critical File Exploit Attempt 20.168.115.112 (US/United States/-): 2 i ... show more (exploit_critical) REGOLA 2 - Critical File Exploit Attempt 20.168.115.112 (US/United States/-): 2 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: 20.168.115.112 - - [09/Jun/2026:13:23:05 +0200] "GET /wp-config.php.bak HTTP/1.1" 403 146 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0" "-" host=51.89.2.99 20.168.115.112 - - [09/Jun/2026:13:23:06 +0200] "GET /.aws/credentials HTTP/1.1" 404 10386 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36" "-" host=51.89.2.99 show less	Port Scan
🇩🇪 kivitendo.de	2026-06-09 10:44:33 (3 months ago)	{"reqId":"nkm5cQdGnl9dfh4Sw1Qp","level":1,"time":"2026-06-09T10:44:28+00:00","remoteAddr":"20.168.11 ... show more {"reqId":"nkm5cQdGnl9dfh4Sw1Qp","level":1,"time":"2026-06-09T10:44:28+00:00","remoteAddr":"20.168.115.112","user":"--","app":"core","method":"GET","url":"/.git/HEAD","scriptName":"/index.php","message":"Trusted domain error. \"20.168.115.112\" tried to access using \"37.24.44.97\" as host.","userAgent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36","version":"32.0.6.1","data":{"app":"core"}} {"reqId":"3yQ4VfSwKzn4nLBDtmGw","level":1,"time":"2026-06-09T10:44:29+00:00","remoteAddr":"20.168.115.112","user":"--","app":"core","method":"GET","url":"/.git/config","scriptName":"/index.php","message":"Trusted domain error. \"20.168.115.112\" tried to access using \"37.24.44.97\" as host.","userAgent":"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36","version":"32.0.6.1","data":{"app":"core"}} {"reqId":"L3uaiBXYrYu48nyqifmp","level":1,"time":"2026-06-09T10:44:30+00:00"," ... show less	Brute-Force Web App Attack

Showing 1 to 15 of 100 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇿🇦 2c0f:fb50:4001:1::127

🇹🇳 197.1.11.154

🇬🇧 193.163.125.76

🇩🇪 165.154.164.79

🇺🇸 162.216.150.9

🇺🇸 162.216.149.176

🇨🇳 117.50.213.16

🇮🇩 114.5.144.130

🇲🇾 113.211.107.93

🇬🇧 101.36.97.131

🇫🇷 91.231.89.158

🇬🇧 213.166.84.35

🇳🇱 204.76.203.8

🇩🇪 172.217.33.158

🇨🇳 118.212.120.83

🇳🇱 91.92.42.129

🇳🇱 45.148.10.157

🇮🇩 38.253.224.42

🇬🇧 35.203.210.141

🇺🇸 34.204.50.181