JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 20.171.125.215

20.171.125.215 was found in our database!

This IP was reported 27 times. Confidence of Abuse is 100%: ?

100%

ISP	Microsoft Corporation
Usage Type	Data Center/Web Hosting/Transit
ASN	AS8075
Domain Name	microsoft.com
Country	🇺🇸 United States of America
City	Phoenix, Arizona

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 20.171.125.215

Whois 20.171.125.215

IP Abuse Reports for 20.171.125.215:

This IP address has been reported a total of 27 times from 24 distinct sources. 20.171.125.215 was first reported on January 5th 2026, and the most recent report was 22 hours ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇦🇹 urnilxfgbez	2026-06-03 22:45:00 (22 hours ago)	Last 24 Hours suspicious: (DPT=445\|DPT=3389\|DPT=22\|DPT=3306\|DPT=8080\|DPT=23\|DPT=5900\|DPT=1433)	Port Scan
Anonymous	2026-06-03 11:05:45 (1 day ago)	Portscan: TCP/8080, TCP/2087, TCP/8443, TCP/2082, TCP/2083, TCP/2086	Port Scan
🇩🇪 XICTRON	2026-06-03 07:00:04 (1 day ago)	ModSecurity rule violation detected by Fail2Ban	Web App Attack
🇸🇪 NordhTech	2026-06-03 06:15:08 (1 day ago)	More than 3 malicious connection attempts, trying port(s) 2087/tcp, then blocked from services ...	Port Scan Hacking
🇺🇸 TPI-Abuse	2026-06-03 05:46:44 (1 day ago)	(mod_security) mod_security (id:210492) triggered by 20.171.125.215 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210492) triggered by 20.171.125.215 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jun 03 01:46:37.647846 2026] [security2:error] [pid 13629:tid 13629] [client 20.171.125.215:51076] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "192.64.150.154"] [uri "/.git/HEAD"] [unique_id "ah-_vQxJAhz1iHmbByyfBQAAAAQ"] show less	Brute-Force Bad Web Bot Web App Attack
🇵🇱 mkey	2026-06-03 05:31:01 (1 day ago)	[First: 2026-06-03 06:45:08/single] HITS=1 Repeated suspicious IDS-detected activity; sample=Attempt ... show more [First: 2026-06-03 06:45:08/single] HITS=1 Repeated suspicious IDS-detected activity; sample=Attempting to connect to a forbidden port show less	Port Scan Hacking Web App Attack
🇫🇷 LoneRider	2026-06-03 05:22:17 (1 day ago)	[03/Jun/2026:07:22:08.125937 +0200] ah-6AHGDE1uMa2w2clX5dgAAAAU 20.171.125.215 59458 127.0.0.1 7080 ... show more [03/Jun/2026:07:22:08.125937 +0200] ah-6AHGDE1uMa2w2clX5dgAAAAU 20.171.125.215 59458 127.0.0.1 7080 [03/Jun/2026:07:22:10.678236 +0200] ah-6AtUm4vf4GDe-tEN0JwAAAAI 20.171.125.215 45790 127.0.0.1 7080 [03/Jun/2026:07:22:16.986273 +0200] ah-6CBgI-6QbMT3HRHG_MAAAAAM 20.171.125.215 45804 127.0.0.1 7080 ... show less	Hacking
🇩🇪 ManagedStack	2026-06-03 05:15:02 (1 day ago)	Probing access to unauthorized locations	Hacking Exploited Host Web App Attack
🇺🇸 TPI-Abuse	2026-06-03 04:57:05 (1 day ago)	(mod_security) mod_security (id:210492) triggered by 20.171.125.215 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210492) triggered by 20.171.125.215 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jun 03 00:56:57.971492 2026] [security2:error] [pid 11668:tid 11668] [client 20.171.125.215:51910] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "192.64.150.109"] [uri "/.git/config"] [unique_id "ah-0GXx1zrqa-qYAmfRekAAAAA4"] show less	Brute-Force Bad Web Bot Web App Attack
🇹🇷 Threat.live	2026-06-03 03:45:03 (1 day ago)	Threat.live: Web Scan	Web App Attack
🇺🇸 chronos	2026-06-03 03:33:06 (1 day ago)	[AUTORAVALT][[03/06/2026 - 00:33:06 -03:00 UTC] Attack from [Microsoft Corporation] [20.171.125.215] ... show more [AUTORAVALT][[03/06/2026 - 00:33:06 -03:00 UTC] Attack from [Microsoft Corporation] [20.171.125.215] Action: BLocKed Hacking... Unauthorized attempts to access the server. Web App Attack -> Attempts to probe for or exploit installed web applications such as a CMS like WordPress/Drupal, e-commerce solutions, forum software, phpMyAdmin and various other software] ... show less	Hacking Web App Attack
🇺🇸 TPI-Abuse	2026-06-03 03:31:04 (1 day ago)	(mod_security) mod_security (id:210492) triggered by 20.171.125.215 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210492) triggered by 20.171.125.215 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jun 02 23:30:57.288198 2026] [security2:error] [pid 23880:tid 23880] [client 20.171.125.215:51523] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "192.64.150.168"] [uri "/.env"] [unique_id "ah-f8W-N3V3eN1PfM4aoRQAAABA"] show less	Brute-Force Bad Web Bot Web App Attack
Anonymous	2026-06-03 03:29:33 (1 day ago)	Unauthorized connection attempt	Port Scan Hacking Exploited Host
🇺🇸 ISPLtd	2026-06-03 02:55:27 (1 day ago)	Jun 2 23:55:13 20.171.125.215 TCP SPT=50973 DPT=2087 SYN Jun 2 23:55:13 20.171.125.215 TCP SPT=509 ... show more Jun 2 23:55:13 20.171.125.215 TCP SPT=50973 DPT=2087 SYN Jun 2 23:55:13 20.171.125.215 TCP SPT=50946 DPT=8443 SYN Jun 2 23:55:13 20.171.125.215 TCP SPT=50952 DPT=2082 ... show less	Port Scan
Anonymous	2026-06-03 02:15:01 (1 day ago)	suspicious request in access.log	Web App Attack

Showing 1 to 15 of 27 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇳🇱 173.194.169.29

🇺🇸 35.199.180.158

🇺🇸 2607:f8b0:4001:c20::12d

🇨🇳 202.105.98.252

🇨🇱 201.223.49.58

🇧🇷 186.251.71.202

🇧🇷 177.75.47.198

🇺🇸 165.154.255.63

🇨🇳 121.227.152.250

🇨🇳 112.28.130.136

🇦🇷 45.178.2.144

🇺🇸 35.168.238.50

🇺🇸 18.191.90.98

🇨🇳 221.194.221.255

🇺🇸 216.172.190.116

🇺🇸 152.65.185.144

🇦🇫 103.132.98.160

🇺🇸 91.230.168.185

🇬🇧 193.163.125.27

🇳🇱 176.65.148.150