JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 20.195.178.37

20.195.178.37 was found in our database!

This IP was reported 20 times. Confidence of Abuse is 89%: ?

89%

ISP	Microsoft Corporation
Usage Type	Data Center/Web Hosting/Transit
ASN	AS8075
Domain Name	microsoft.com
Country	🇧🇷 Brazil
City	Campinas, Sao Paulo

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 20.195.178.37

Whois 20.195.178.37

IP Abuse Reports for 20.195.178.37:

This IP address has been reported a total of 20 times from 16 distinct sources. 20.195.178.37 was first reported on August 24th 2026, and the most recent report was 14 hours ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇫🇷 GabrielJST	2026-08-27 10:20:11 (14 hours ago)	(mod_security) mod_security triggered on hostname [redacted] 20.195.178.37 (BR/Brazil/-): (CF_ENABL ... show more (mod_security) mod_security triggered on hostname [redacted] 20.195.178.37 (BR/Brazil/-): (CF_ENABLE) show less	SQL Injection
🇫🇷 dynamix	2026-08-27 06:18:37 (18 hours ago)	Multiple WAF Violations	Web App Attack
Anonymous	2026-08-27 04:41:35 (19 hours ago)	20.195.178.37 - - [27/Aug/2026:04:41:34 +0000] "GET /_profiler/latest HTTP/1.1" 404 437 "-" "Exposur ... show more 20.195.178.37 - - [27/Aug/2026:04:41:34 +0000] "GET /_profiler/latest HTTP/1.1" 404 437 "-" "ExposureScanner/1.0 (internal-security-audit)" ... show less	Bad Web Bot Web App Attack
🇫🇷 a.mohamed.go	2026-08-26 23:07:41 (1 day ago)	20.195.178.37 - - [26/Aug/2026:23:07:37 +0000] "GET /shared/.env HTTP/1.1" 404 153 "-" "ExposureScan ... show more 20.195.178.37 - - [26/Aug/2026:23:07:37 +0000] "GET /shared/.env HTTP/1.1" 404 153 "-" "ExposureScanner/1.0 (internal-security-audit)" ... show less	Hacking Web App Attack
🇫🇷 masterguru	2026-08-26 14:21:04 (1 day ago)	Host header is a numeric IP address. Pattern match "^ (920350-135)	Hacking Bad Web Bot
🇵🇱 nfsec.pl	2026-08-26 07:59:13 (1 day ago)	20.195.178.37 - - [26/Aug/2026:07:58:13 +0000] "GET /.env HTTP/1.1" 403 443 "-" "ExposureScanner/1.0 ... show more 20.195.178.37 - - [26/Aug/2026:07:58:13 +0000] "GET /.env HTTP/1.1" 403 443 "-" "ExposureScanner/1.0 (internal-security-audit)" 20.195.178.37 - - [26/Aug/2026:07:58:18 +0000] "GET /.env.local%20 HTTP/1.1" 403 443 "https://147.135.209.161/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_7_1) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.2 Safari/605.1.15" 20.195.178.37 - - [26/Aug/2026:07:58:27 +0000] "GET /.env~ HTTP/1.1" 403 443 "-" "ExposureScanner/1.0 (internal-security-audit)" 20.195.178.37 - - [26/Aug/2026:07:58:29 +0000] "GET /.env~ HTTP/1.1" 403 443 "https://147.135.209.161/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_7_1) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.2 Safari/605.1.15" 20.195.178.37 - - [26/Aug/2026:07:59:13 +0000] "GET /shared/.env HTTP/1.1" 403 443 "-" "ExposureScanner/1.0 (internal-security-audit)" ... show less	Web App Attack Exploited Host
🇺🇸 HamSammich	2026-08-26 00:24:07 (2 days ago)	Automated sensor: 4 HTTP connection/probe attempts over the last 24h (latest 2026-08-26T00:24Z).	Brute-Force Web App Attack
🇫🇷 LRNP	2026-08-25 23:58:59 (2 days ago)	_:80 20.195.178.37 - - [25/Aug/2026:23:58:38 +0000] "GET /backend/.env HTTP/1.1" 404 146 "-" "Exposu ... show more _:80 20.195.178.37 - - [25/Aug/2026:23:58:38 +0000] "GET /backend/.env HTTP/1.1" 404 146 "-" "ExposureScanner/1.0 (internal-security-audit)" _:80 20.195.178.37 - - [25/Aug/2026:23:58:41 +0000] "GET /bootstrap.properties HTTP/1.1" 404 146 "-" "ExposureScanner/1.0 (internal-security-audit)" _:80 20.195.178.37 - - [25/Aug/2026:23:58:43 +0000] "GET /Pulumi.yaml HTTP/1.1" 404 146 "-" "ExposureScanner/1.0 (internal-security-audit)" _:80 20.195.178.37 - - [25/Aug/2026:23:58:44 +0000] "GET /.git/refs/heads/master HTTP/1.1" 404 146 "-" "ExposureScanner/1.0 (internal-security-audit)" _:80 20.195.178.37 - - [25/Aug/2026:23:58:45 +0000] "GET /_debugbar/open HTTP/1.1" 404 146 "-" "ExposureScanner/1.0 (internal-security-audit)" _:443 20.195.178.37 - - [25/Aug/2026:23:58:51 +0000] "GET /.env.staging HTTP/1.1" 404 146 "-" "ExposureScanner/1.0 (internal-security-audit)" _:443 20.195.178.37 - - [25/Aug/2026:23:58:55 +0000] "GET /api/.env HTTP/1.1" 404 146 "-" "ExposureScanner/1.0 (internal-security-audi ... show less	Bad Web Bot Web App Attack
🇳🇱 tpjg	2026-08-25 20:54:41 (2 days ago)	Automated: 15 requests with error status in 120s window from 20.195.178.37. Evidence: /.env.staging: ... show more Automated: 15 requests with error status in 120s window from 20.195.178.37. Evidence: /.env.staging:301,/.env.production:301,/.env.local:301,/.env.local:301,/.env.local:301,/favicon.ico:301,/%2F.env.backup:301,/%2F.env.backup:301,/.env.backup:301,/.env.backup:301,/.env/:301,/.env.production:301,/favicon.ico:301,/%00:301,/;:301 (+35 more) show less	Web App Attack
🇫🇷 masterguru	2026-08-25 19:59:24 (2 days ago)	Host header is a numeric IP address. Pattern match "^ (920350-131)	Hacking Bad Web Bot
🇫🇷 pm33	2026-08-25 16:04:08 (2 days ago)	Probing for resource vulnerabilities HTTP(S)	Web App Attack
🇫🇷 COMAITE	2026-08-25 14:07:04 (2 days ago)	Common web attack from 20.195.178.37.	Web App Attack
Anonymous	2026-08-25 13:16:31 (2 days ago)	Web App Attack	Brute-Force Exploited Host Web App Attack
🇳🇱 tpjg	2026-08-25 09:18:03 (2 days ago)	Automated: 15 requests with error status in 120s window from 20.195.178.37. Evidence: /favicon.ico:3 ... show more Automated: 15 requests with error status in 120s window from 20.195.178.37. Evidence: /favicon.ico:301,/favicon.ico:301,/.env.prod%20:301,/%2F.env.swp:301,/%2F.env.swp:301,/.env.old:301,//.env.production:301,/.env.development:301,/.env.staging:301,/.env:301,/favicon.ico:301,/.env.backup:301,/.env.backup;:301,/.env.local:301,/.env.local:301 show less	Web App Attack
🇵🇱 Budyn	2026-08-24 23:19:07 (3 days ago)	Automated threat detected by Budyn Honeypot Sinkhole. Attack type: CRITICAL: ModSecurity WAF Exploit ... show more Automated threat detected by Budyn Honeypot Sinkhole. Attack type: CRITICAL: ModSecurity WAF Exploit Block. Malicious scanner triggered a security trap targeting emulated vulnerabilities. Evidence: HOST: 51.83.237.XX \| URI: /.env.development \| UA: ExposureScanner/1.0 (internal-security-audit) \| BODY: [Empty / GET Request] show less	Hacking Web App Attack

Showing 1 to 15 of 20 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇫🇷 2400:cb00:532:1000:b8df:8f37:2160:854c

🇧🇪 198.235.24.235

🇬🇧 193.163.125.118

🇲🇽 187.190.51.208

🇻🇪 186.14.59.127

🇮🇷 185.11.71.130

🇧🇷 177.181.7.139

🇯🇵 172.105.196.91

🇧🇷 170.81.153.160

🇧🇷 168.194.106.1

🇺🇸 149.76.152.209

🇺🇸 137.184.49.152

🇺🇸 107.180.88.176

🇹🇼 101.13.5.49

🇺🇸 100.51.6.16

🇺🇸 85.89.194.214

🇩🇪 69.5.169.77

🇺🇸 66.132.172.214

🇺🇸 34.26.240.171

🇮🇹 2.196.73.143