JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 20.168.157.84

20.168.157.84 was found in our database!

This IP was reported 13 times. Confidence of Abuse is 50%: ?

50%

ISP	Microsoft Corporation
Usage Type	Data Center/Web Hosting/Transit
ASN	AS8075
Domain Name	microsoft.com
Country	🇺🇸 United States of America
City	San Jose, California

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 20.168.157.84

Whois 20.168.157.84

IP Abuse Reports for 20.168.157.84:

This IP address has been reported a total of 13 times from 8 distinct sources. 20.168.157.84 was first reported on April 18th 2026, and the most recent report was 12 hours ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇺🇸 TPI-Abuse	2026-06-14 16:39:21 (12 hours ago)	(mod_security) mod_security (id:210492) triggered by 20.168.157.84 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:210492) triggered by 20.168.157.84 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Jun 14 12:39:18.024548 2026] [security2:error] [pid 4553:tid 4576] [client 20.168.157.84:10585] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "192.64.150.86"] [uri "/.git/HEAD"] [unique_id "ai7ZNqpd5IHcXcFCIYwp0gAAAFM"] show less	Brute-Force Bad Web Bot Web App Attack
Anonymous	2026-06-14 14:57:29 (14 hours ago)	2026-06-14T15:57:28.471109+01:00 vps kernel: [43189205.108778] [PORTSCAN DETECTED] IN=ens3 OUT= MAC= ... show more 2026-06-14T15:57:28.471109+01:00 vps kernel: [43189205.108778] [PORTSCAN DETECTED] IN=ens3 OUT= MAC=fa:16:3e:66:f6:24:02:37:19:0d:c2:f3:08:00 SRC=20.168.157.84 DST=54.37.14.118 LEN=60 TOS=0x00 PREC=0x00 TTL=43 ID=34773 DF PROTO=TCP SPT=9905 DPT=2078 WINDOW=64240 RES=0x00 SYN URGP=0 ... show less	Port Scan Brute-Force
🇺🇸 TPI-Abuse	2026-06-14 13:37:59 (15 hours ago)	(mod_security) mod_security (id:210492) triggered by 20.168.157.84 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:210492) triggered by 20.168.157.84 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Jun 14 09:37:53.570974 2026] [security2:error] [pid 19899:tid 19899] [client 20.168.157.84:9270] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "192.64.150.141"] [uri "/.git/HEAD"] [unique_id "ai6usZdowJqzPUaf-KNtZQAAAAc"] show less	Brute-Force Bad Web Bot Web App Attack
🇹🇼 kk_it_man	2026-06-14 13:30:11 (15 hours ago)		Port Scan
🇺🇸 xmission.com	2026-06-14 11:50:03 (17 hours ago)	Blocked by UFW (TCP on 2087) Source port: 10267 TTL: 52 Packet length: 60 TOS: 0x00 This report (fo ... show more Blocked by UFW (TCP on 2087) Source port: 10267 TTL: 52 Packet length: 60 TOS: 0x00 This report (for 20.168.157.84) was generated by: https://github.com/sefinek/UFW-AbuseIPDB-Reporter show less	Port Scan
Anonymous	2026-06-13 14:55:33 (1 day ago)	Port Scan	Port Scan
Anonymous	2026-06-13 12:54:44 (1 day ago)	Unauthorized connection attempt	Port Scan Hacking Exploited Host
🇺🇸 TPI-Abuse	2026-06-13 12:08:44 (1 day ago)	(mod_security) mod_security (id:210492) triggered by 20.168.157.84 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:210492) triggered by 20.168.157.84 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Jun 13 08:08:39.683752 2026] [security2:error] [pid 7665:tid 7665] [client 20.168.157.84:46115] ModSecurity: Access denied with code 403 (phase 1). Matched phrase ".htpasswd" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "192.64.150.214"] [uri "/.htpasswd"] [unique_id "ai1IR7-laaOmCE0QCrR6YwAAABo"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 xmission.com	2026-06-13 11:46:07 (1 day ago)	Blocked by UFW (TCP on 8443) Source port: 46112 TTL: 52 Packet length: 60 TOS: 0x00 This report (fo ... show more Blocked by UFW (TCP on 8443) Source port: 46112 TTL: 52 Packet length: 60 TOS: 0x00 This report (for 20.168.157.84) was generated by: https://github.com/sefinek/UFW-AbuseIPDB-Reporter show less	Port Scan
🇯🇵 demonsword	2026-05-11 15:02:59 (1 month ago)	Detected by SentinelX honeypot: sent HTTP CONNECT request probing for an open proxy. Connection was ... show more Detected by SentinelX honeypot: sent HTTP CONNECT request probing for an open proxy. Connection was hijacked and held in a tarpit to slow down the scan. Probed target: cloudflare.com:443 show less	Open Proxy Port Scan
🇯🇵 demonsword	2026-05-08 19:52:34 (1 month ago)	Detected by SentinelX honeypot: sent HTTP CONNECT request probing for an open proxy. Connection was ... show more Detected by SentinelX honeypot: sent HTTP CONNECT request probing for an open proxy. Connection was hijacked and held in a tarpit to slow down the scan. Probed target: example.com:443 show less	Open Proxy Port Scan
🇺🇸 Rayulcifer	2026-04-24 18:07:28 (1 month ago)	20.168.157.84 - - [24/Apr/2026:13:07:27 -0500] "GET http://clients2.google.com/time/1/current?cup2ke ... show more 20.168.157.84 - - [24/Apr/2026:13:07:27 -0500] "GET http://clients2.google.com/time/1/current?cup2key=9:jKuAA7YpEpTksL1r1ZCGUKTuaVCRKBABy_jSrHY5qss&cup2hreq=e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 HTTP/1.1" 200 855 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36" 20.168.157.84 - - [24/Apr/2026:13:07:27 -0500] "CONNECT www.google.com:443 HTTP/1.1" 502 488 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36" ... show less	Open Proxy Port Scan Hacking Web App Attack SSH
🇺🇸 Rayulcifer	2026-04-18 05:09:09 (1 month ago)	20.168.157.84 - - [18/Apr/2026:00:09:06 -0500] "GET https://cloud.xiliancloud.cn HTTP/1.1" 200 85738 ... show more 20.168.157.84 - - [18/Apr/2026:00:09:06 -0500] "GET https://cloud.xiliancloud.cn HTTP/1.1" 200 85738 "https://www.google.com/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.168.157.84 - - [18/Apr/2026:00:09:08 -0500] "GET https://cloud.xiliancloud.cn HTTP/1.1" 200 85737 "https://www.google.com/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" ... show less	Open Proxy Port Scan Hacking Web App Attack SSH

Showing 1 to 13 of 13 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇺🇸 207.90.244.19

🇺🇸 205.210.31.46

🇲🇽 187.190.203.31

🇳🇱 185.242.226.73

🇨🇱 179.57.170.71

🇮🇩 163.7.0.179

🇩🇪 161.35.205.74

🇦🇷 148.227.121.245

🇪🇸 144.178.142.167

🇦🇷 143.105.136.86

🇨🇳 123.160.221.145

🇻🇳 103.118.29.7

🇺🇸 98.18.139.123

🇺🇿 93.188.83.96

🇷🇺 92.36.94.19

🇺🇸 74.87.117.149

🇨🇳 58.33.97.119

🇫🇷 51.83.40.102

🇨🇱 34.176.107.97

🇵🇰 14.192.132.33