JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 20.168.152.60

20.168.152.60 was found in our database!

This IP was reported 80 times. Confidence of Abuse is 100%: ?

100%

ISP	Microsoft Corporation
Usage Type	Data Center/Web Hosting/Transit
ASN	AS8075
Domain Name	microsoft.com
Country	🇺🇸 United States of America
City	San Jose, California

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 20.168.152.60

Whois 20.168.152.60

IP Abuse Reports for 20.168.152.60:

This IP address has been reported a total of 80 times from 61 distinct sources. 20.168.152.60 was first reported on May 29th 2026, and the most recent report was 1 week ago.

Old Reports: The most recent abuse report for this IP address is from 1 week ago . It is possible that this IP is no longer involved in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇬🇧 consul.to	2026-06-15 01:16:15 (1 week ago)	Web attack/malicious scanning detected	Web App Attack
🇺🇸 Mundo Bueno	2026-06-15 00:23:03 (1 week ago)	[ISILIA Protection v2.1] Tentative d'accès: /.env \| Pays: US \| UA: Mozilla/5.0 (Windows NT 10.0; Win ... show more [ISILIA Protection v2.1] Tentative d'accès: /.env \| Pays: US \| UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Sa show less	Hacking Web App Attack
🇨🇭 4server	2026-06-14 23:46:49 (1 week ago)	[MonJun1501:46:45.4270242026][security2:error][pid340592:tid340798][client20.168.152.60:0]ModSecurit ... show more [MonJun1501:46:45.4270242026][security2:error][pid340592:tid340798][client20.168.152.60:0]ModSecurity:Accessdeniedwithcode403\(phase1\).Matchedphrase\".env\"atREQUEST_URI.[file\"/etc/apache2/conf.d/modsec_custom_rules.conf\"][line\"365\"][id\"960720\"][msg\"Forbiddenfileaccess\"][hostname\"aurumgioielleria.ch\"][uri\"/.env\"][unique_id\"ai89ZeXRjXl36xN_N9-ptQAAAQ8\"] show less	Hacking Web App Attack
Anonymous	2026-06-14 20:41:05 (1 week ago)	20.168.152.60 - - [15/Jun/2026:04:41:05 +0800] "GET /.env HTTP/1.1" 301 233 "-" "Mozilla/5.0 (Window ... show more 20.168.152.60 - - [15/Jun/2026:04:41:05 +0800] "GET /.env HTTP/1.1" 301 233 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" ... show less	Bad Web Bot Web App Attack
Anonymous	2026-06-14 18:15:52 (1 week ago)	http scanning for .env files ...	Hacking Web App Attack
🇦🇺 2000cn.com.au	2026-06-14 18:01:12 (1 week ago)	This IP was detected by CrowdSec triggering crowdsecurity/http-sensitive-files	Web App Attack Hacking
🇩🇪 ut-addicted.com	2026-06-14 01:11:26 (1 week ago)	\[Sun Jun 14 03:11:25.311671 2026\] \[:error\] \[pid 30215:tid 139785811232512\] \[client 20.168.152 ... show more \[Sun Jun 14 03:11:25.311671 2026\] \[:error\] \[pid 30215:tid 139785811232512\] \[client 20.168.152.60:61581\] \[client 20.168.152.60\] ModSecurity: Access denied with code 403 \(phase 2\). Operator GE matched 5 at TX:anomaly_score. \[file "/usr/local/apache/modsecurity-owasp-latest/rules/REQUEST-949-BLOCKING-EVALUATION.conf"\] \[line "57"\] \[id "949110"\] \[msg "Inbound Anomaly Score Exceeded \(Total Score: 5\)"\] \[severity "CRITICAL"\] \[tag "application-multi"\] \[tag "language-multi"\] \[tag "platform-multi"\] \[tag "attack-generic"\] \[hostname "crx.it"\] \[uri "/.env"\] \[unique_id "ai3-vcNNGwKnk-X1BXjkyAAAAIk"\] show less	Brute-Force Web App Attack
Anonymous	2026-06-13 16:05:06 (1 week ago)	WAF repeated trigger detected by Fail2Ban	Web App Attack
🇳🇱 enpepet	2026-06-13 00:06:43 (1 week ago)	GENERAL: parametres: [url:env=] UA:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHT ... show more GENERAL: parametres: [url:env=] UA:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 URL:/.env show less	Port Scan Hacking Brute-Force Bad Web Bot
🇦🇺 paulshipley.com.au	2026-06-12 21:20:28 (1 week ago)	[Sat Jun 13 07:20:26.824837 2026] [security2:error] [pid 707274] [client 20.168.152.60:55640] [clien ... show more [Sat Jun 13 07:20:26.824837 2026] [security2:error] [pid 707274] [client 20.168.152.60:55640] [client 20.168.152.60] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/modsecurity/crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.4"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "paulshipley.info"] [uri "/.env"] [unique_id "aix4Gq55FDb7MN0R8oqfKQAAAAQ"] ... show less	Web App Attack
Anonymous	2026-06-12 11:42:15 (1 week ago)		Bad Web Bot
🇩🇪 Teufel100	2026-06-12 08:19:53 (1 week ago)	ModSecurity rejected a query	Brute-Force Hacking Web App Attack
🇳🇱 BlueWire Hosting	2026-06-12 08:17:07 (1 week ago)	Probing websites for vulnerabilities	Web App Attack
🇺🇸 technojoe99	2026-06-12 04:02:32 (1 week ago)	Exploit scan from 20.168.152.60. GET /.env HTTP/1.1.	Web App Attack
🇺🇸 Mundo Bueno	2026-06-12 02:32:25 (1 week ago)	[ISILIA Protection v2.1] Tentative d'accès: /.env \| Pays: US \| UA: Mozilla/5.0 (Windows NT 10.0; Win ... show more [ISILIA Protection v2.1] Tentative d'accès: /.env \| Pays: US \| UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Sa show less	Hacking Web App Attack

Showing 1 to 15 of 80 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇻🇳 115.77.111.2

🇳🇱 193.176.31.218

🇵🇰 182.184.116.119

🇸🇦 167.86.129.49

🇩🇪 139.59.146.150

🇵🇰 119.73.103.62

🇱🇹 81.30.98.62

🇧🇬 79.124.40.138

🇺🇸 54.175.25.87

🇺🇸 20.84.101.167

🇳🇱 176.65.139.92

🇳🇱 175.110.112.8

🇬🇧 92.238.76.255

🇺🇸 74.82.47.19

🇨🇳 223.109.252.160

🇨🇳 222.222.73.70

🇪🇹 196.190.180.18

🇳🇱 195.178.110.26

🇨🇦 192.175.93.57

🇮🇷 188.212.70.31