JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

20.186.94.209

Recent Activity

Abuse confidence score ?

100% Critical

111 reports

73 reporters · latest 18 hours ago

ISP	Microsoft Corporation
Usage Type	Data Center/Web Hosting/Transit
ASN	AS8075
Domain Name	microsoft.com
Country	🇺🇸 United States of America
City	Boydton, Virginia

ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report Whois

Reports Activity

Example preview

Report Categories (Last 60 Days)

Example preview

Top Reporter Countries (Last 60 Days)

Example preview

Account required for the enhanced features Log in Sign up

IP Abuse Reports for 20.186.94.209

Export CSV

This IP address has been reported a total of 111 times from 73 distinct sources. 20.186.94.209 was first reported on October 6th 2026, and the most recent report was 18 hours ago. In the last 60 days, the top reporter locations were: Germany with 21 reports; United States of America with 17 reports; France with 16 reports. The most common categories in these recent reports were: Web App Attack 85 times; Bad Web Bot 37 times; Hacking 27 times; Brute-Force 24 times; Port Scan 10 times; Other 11 times.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇺🇸 Lunar Studios	2026-10-14 14:40:03 (18 hours ago)	14 web requests to 14 probe paths: GET /.env.dev 404, GET /.env.swp 404, GET /.git/HEAD 404, /.git/c ... show more 14 web requests to 14 probe paths: GET /.env.dev 404, GET /.env.swp 404, GET /.git/HEAD 404, /.git/config, /.env.local, /.env.save. Seen 2026-10-14 14:40 to 2026-10-14 14:40 UTC (1 min). show less	Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-10-14 14:34:13 (18 hours ago)	(mod_security) mod_security (id:210492) triggered by 20.186.94.209 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:210492) triggered by 20.186.94.209 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 14 10:34:08.034467 2026] [security2:error] [pid 12232:tid 12232] [client 20.186.94.209:0] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "785insulation.com"] [uri "/.env"] [unique_id "as-S4Iutf911JSl8MxGuYwAAABc"] show less	Brute-Force Bad Web Bot Web App Attack
🇩🇪 conseilgouz	2026-10-14 14:19:43 (18 hours ago)	ave-17 : Block hidden directories=>/.env.txt(/)	Hacking
🇺🇸 Mundo Bueno	2026-10-14 12:51:33 (20 hours ago)	[ISILIA Protection v2.3] Tentative d'accès: /.env.staging [RATE LIMITED - 1800s quarantine] \| Pays: ... show more [ISILIA Protection v2.3] Tentative d'accès: /.env.staging [RATE LIMITED - 1800s quarantine] \| Pays: US \| UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Sa show less	Hacking Web App Attack
🇩🇪 sternwart	2026-10-14 12:33:23 (20 hours ago)	Automatisch erkannt: Zugriff auf /.env.txt (alpasana.ch)	Web App Attack Bad Web Bot
Anonymous	2026-10-14 11:48:24 (21 hours ago)	(config_exploit_scan) Configuratie Scanner / Nep GPTBot 20.186.94.209 (-): 3 in the last 3600 secs; ... show more (config_exploit_scan) Configuratie Scanner / Nep GPTBot 20.186.94.209 (-): 3 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: 20.186.94.209 - - [14/Oct/2026:13:48:23 +0200] "GET /pathscan-4beb320bc503-nope.env HTTP/1.1" 406 463 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36" 20.186.94.209 - - [14/Oct/2026:13:48:23 +0200] "GET /.env.save HTTP/1.1" 406 4815 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36" 20.186.94.209 - - [14/Oct/2026:13:48:23 +0200] "GET /.env.staging HTTP/1.1" 406 4814 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36" show less	Port Scan
🇩🇪 ITSNF	2026-10-14 08:55:08 (1 day ago)	Blocked by os-abuseipdb; 64 hits, proto=tcp, ports=443,80	Port Scan Hacking
Anonymous	2026-10-14 08:49:55 (1 day ago)	(caddyscan) Scanner path probe from 20.186.94.209 (US/United States/-): 5 in the last 3600 secs; Por ... show more (caddyscan) Scanner path probe from 20.186.94.209 (US/United States/-): 5 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: [REDACTED] 200 2627 20.186.94.209 - - [14/Oct/2026:08:49:50 +0000] "GET /.env.dev HTTP/1.1" [REDACTED] 200 2627 20.186.94.209 - - [14/Oct/2026:08:49:50 +0000] "GET /.env.save HTTP/1.1" [REDACTED] 200 2627 20.186.94.209 - - [14/Oct/2026:08:49:50 +0000] "GET /.git/HEAD HTTP/1.1" [REDACTED] 200 2627 20.186.94.209 - - [14/Oct/2026:08:49:50 +0000] "GET /.env.old HTTP/1.1" [REDACTED] 200 2627 20.186.94.209 - - [14/Oct/2026:08:49:50 +0000] "GET /.env.staging HTTP/1.1" show less	Port Scan
🇳🇱 Alt255	2026-10-14 08:00:43 (1 day ago)	[cb-15al] Web exploit scanning: 1 suspicious requests detected by fail2ban jail apache-scanner. Exam ... show more [cb-15al] Web exploit scanning: 1 suspicious requests detected by fail2ban jail apache-scanner. Example: 20.186.94.209 - - [14/Oct/2026:10:00:38 +0200] "GET /.env.dev HTTP/1.1" 404 119612 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36" ... show less	Bad Web Bot Web App Attack
🇫🇷 masterguru	2026-10-14 06:11:08 (1 day ago)	Restricted File Access Attempt. Matched phrase ".env" at REQUEST_FILENAME. (930130-195)	Hacking Web App Attack
🇨🇦 polycoda	2026-10-14 05:41:26 (1 day ago)	AutoBlock: 🎯 Vulnerability Scanner (Non Decay-Based) - ↪️ Excessive 30X Errors (Decay-Based)	Hacking Bad Web Bot Web App Attack
🇫🇷 ELYAZ	2026-10-14 05:40:33 (1 day ago)	(y3) Failed access -byebye- from 20.186.94.209 (US/United States/-): (CF_ENABLE)	Hacking
🇵🇱 Budyn	2026-10-14 05:33:19 (1 day ago)	Automated threat detected by Budyn Honeypot Sinkhole. Attack type: Enterprise & Framework Recon Scan ... show more Automated threat detected by Budyn Honeypot Sinkhole. Attack type: Enterprise & Framework Recon Scanner. Malicious scanner triggered a security trap targeting emulated vulnerabilities. Evidence: HOST: jenkins.budyn.ovh \| URI: /.env.txt \| UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 \| BODY: [Empty / GET Request] show less	Bad Web Bot Web App Attack
🇩🇪 big-cloud.nl	2026-10-14 05:14:33 (1 day ago)	Try to access /wp-content/plugins/elementor-pro/readme.txt	Web App Attack
🇮🇱 spd.co.il	2026-10-14 05:02:19 (1 day ago)	Web application attack detected	Hacking Web App Attack

Showing 1 to 15 of 111 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇲🇽 187.216.224.85

🇺🇸 172.239.200.12

🇨🇴 149.130.173.58

🇵🇭 143.44.145.118

🇳🇱 109.160.32.128

🇧🇬 78.128.113.74

🇸🇦 142.247.182.229

🇨🇳 124.88.113.23

🇷🇺 109.173.39.103

🇳🇱 109.160.32.160

🇳🇱 109.160.32.135

🇳🇱 104.250.184.4

🇧🇩 103.131.100.78

🇬🇧 77.67.26.141

🇺🇸 23.236.141.56

🇬🇧 5.226.140.81

🇷🇴 2.57.122.76

🇧🇷 138.97.3.124

🇵🇭 138.84.153.236

🇨🇳 125.124.226.217