20.171.22.166
Neutral Activity
There is no recent abuse activity, or the IP address is whitelisted.
- ISP
- Microsoft Corporation
- Usage Type
- Data Center/Web Hosting/Transit
- ASN
- AS8075
- Domain Name
- microsoft.com
- Country
- 🇺🇸 United States of America
- City
- Phoenix, Arizona
No reports in the last 60 days
20.171.22.166 has been reported 13 times. The most recent report is from .
The full history is preserved below and remains searchable. A 0% score reflects the absence of recent activity, but this is not a guarantee that earlier reports were invalid. Abuse confidence score decays, naturally, over time, when the abusive activity stops.
Abuse Reports
Total reports
13 from
10 distinct
reporters
First reported
Most recent report
| Reporter | IoA Timestamp (UTC) | Comment | Categories |
|---|---|---|---|
| 🇯🇵 demonsword |
Detected by SentinelX honeypot: sent HTTP CONNECT request probing for an open proxy. Connection was hijacked and held in a tarpit to slow down the scan. Probed target: developers.tiktok.com:443
|
Open Proxy Port Scan | |
| Anonymous |
PSCSERV WPSCAN 20.171.22.166
|
Bad Web Bot Web App Attack | |
| Anonymous |
|
Hacking Web App Attack | |
| 🇨🇱 CTMAN dev |
|
Bad Web Bot | |
| 🇩🇪 www.fransveldman.world |
Fetched browser challenge page 10 times in <2h without solving. Likely bad bot.
|
Bad Web Bot | |
| 🇫🇷 mail.avx.gr |
Plesk Fail2Ban jail: Plesk-Web-Exploits. Evidence: default:80 20.171.22.166 - - [03/Aug/2026:08:06:01 +0300] "GET /.git/config HTTP/1.1" 403 407 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0"
|
Web App Attack | |
| 🇺🇸 RAP |
2026-08-03 07:12:44 UTC Unauthorized activity to TCP port 8080. Web App
|
Port Scan Web App Attack | |
| Anonymous |
|
Brute-Force | |
| Anonymous |
denied traffic to a non-approved destination port. destination port 2096.
|
Port Scan | |
| 🇺🇸 drewf.ink |
[05:06] Attempted HTTP access to an exposed .git repository (HEAD) on the web honeypot
|
Web App Attack | |
| 🇫🇷 mail.avx.gr |
Plesk Fail2Ban jail: Plesk-Web-Exploits. Evidence: default:80 20.171.22.166 - - [03/Aug/2026:08:06:01 +0300] "GET /.git/config HTTP/1.1" 403 407 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0"
|
Web App Attack | |
| 🇩🇪 www.fransveldman.world |
Fetched browser challenge page 10 times in <2h without solving. Likely bad bot.
|
Bad Web Bot | |
| 🇯🇵 demonsword |
Detected by SentinelX honeypot: sent HTTP CONNECT request probing for an open proxy. Connection was hijacked and held in a tarpit to slow down the scan. Probed target: api.binance.com:443
|
Open Proxy Port Scan |
Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown