JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 20.195.187.116

20.195.187.116 was found in our database!

This IP was reported 24 times. Confidence of Abuse is 100%: ?

100%

ISP	Microsoft Corporation
Usage Type	Data Center/Web Hosting/Transit
ASN	AS8075
Domain Name	microsoft.com
Country	🇧🇷 Brazil
City	Campinas, Sao Paulo

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 20.195.187.116

Whois 20.195.187.116

IP Abuse Reports for 20.195.187.116:

This IP address has been reported a total of 24 times from 20 distinct sources. 20.195.187.116 was first reported on August 24th 2026, and the most recent report was 1 day ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇫🇷 GabrielJST	2026-08-27 10:19:53 (1 day ago)	(PERMBLOCK) 20.195.187.116 (BR/Brazil/-) has had more than 1 temp blocks	Hacking
🇮🇳 evicky2002	2026-08-27 06:00:33 (1 day ago)	Confirmed malicious by STILWaters CTI platform (score=100, sources=1)	Hacking Brute-Force SSH
Anonymous	2026-08-27 04:40:27 (1 day ago)	20.195.187.116 - - [27/Aug/2026:04:40:26 +0000] "GET /.env HTTP/1.1" 404 437 "-" "ExposureScanner/1. ... show more 20.195.187.116 - - [27/Aug/2026:04:40:26 +0000] "GET /.env HTTP/1.1" 404 437 "-" "ExposureScanner/1.0 (internal-security-audit)" ... show less	Bad Web Bot Web App Attack
🇫🇷 masterguru	2026-08-26 14:21:08 (2 days ago)	Host header is a numeric IP address. Pattern match "^ (920350-135)	Hacking Bad Web Bot
🇵🇱 nfsec.pl	2026-08-26 07:58:28 (2 days ago)	20.195.187.116 - - [26/Aug/2026:07:58:13 +0000] "GET /.env.local HTTP/1.1" 403 443 "-" "ExposureScan ... show more 20.195.187.116 - - [26/Aug/2026:07:58:13 +0000] "GET /.env.local HTTP/1.1" 403 443 "-" "ExposureScanner/1.0 (internal-security-audit)" 20.195.187.116 - - [26/Aug/2026:07:58:14 +0000] "GET /.env HTTP/1.1" 403 443 "https://147.135.209.161/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_7_1) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.2 Safari/605.1.15" 20.195.187.116 - - [26/Aug/2026:07:58:17 +0000] "GET /.env.staging%00 HTTP/1.1" 403 443 "https://147.135.209.161/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_7_1) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.2 Safari/605.1.15" 20.195.187.116 - - [26/Aug/2026:07:58:18 +0000] "GET /.env%20 HTTP/1.1" 403 443 "https://147.135.209.161/" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)" 20.195.187.116 - - [26/Aug/2026:07:58:28 +0000] "GET /.env.prod HTTP/1.1" 403 443 "https://147.135.209.161/" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)" ... show less	Web App Attack Exploited Host
🇬🇧 f3sc	2026-08-26 06:52:44 (2 days ago)	20.195.187.116 - - [26/Aug/2026:08:52:43 +0200] "GET /web.config HTTP/1.1" 404 739 "-" "ExposureScan ... show more 20.195.187.116 - - [26/Aug/2026:08:52:43 +0200] "GET /web.config HTTP/1.1" 404 739 "-" "ExposureScanner/1.0 (internal-security-audit)" show less	Hacking Web App Attack
🇺🇸 HamSammich	2026-08-26 00:24:06 (2 days ago)	Automated sensor: 4 HTTP connection/probe attempts over the last 24h (latest 2026-08-26T00:24Z).	Brute-Force Web App Attack
🇫🇷 LRNP	2026-08-25 23:58:46 (2 days ago)	_:80 20.195.187.116 - - [25/Aug/2026:23:58:38 +0000] "GET /.env.dev HTTP/1.1" 404 146 "-" "ExposureS ... show more _:80 20.195.187.116 - - [25/Aug/2026:23:58:38 +0000] "GET /.env.dev HTTP/1.1" 404 146 "-" "ExposureScanner/1.0 (internal-security-audit)" _:80 20.195.187.116 - - [25/Aug/2026:23:58:38 +0000] "GET /.env.docker HTTP/1.1" 404 146 "-" "ExposureScanner/1.0 (internal-security-audit)" _:80 20.195.187.116 - - [25/Aug/2026:23:58:39 +0000] "GET /.s3cfg HTTP/1.1" 404 146 "-" "ExposureScanner/1.0 (internal-security-audit)" _:80 20.195.187.116 - - [25/Aug/2026:23:58:40 +0000] "GET /configuration.php.bak HTTP/1.1" 404 146 "-" "ExposureScanner/1.0 (internal-security-audit)" _:80 20.195.187.116 - - [25/Aug/2026:23:58:40 +0000] "GET /wp-config.php.bak HTTP/1.1" 404 146 "-" "ExposureScanner/1.0 (internal-security-audit)" _:80 20.195.187.116 - - [25/Aug/2026:23:58:40 +0000] "GET /LocalSettings.php HTTP/1.1" 404 146 "-" "ExposureScanner/1.0 (internal-security-audit)" _:80 20.195.187.116 - - [25/Aug/2026:23:58:42 +0000] "GET /appsettings.json HTTP/1.1" 404 146 "-" "ExposureScanner/1.0 (internal-security-au ... show less	Bad Web Bot Web App Attack
🇳🇱 tpjg	2026-08-25 20:54:42 (3 days ago)	Automated: 15 requests with error status in 120s window from 20.195.187.116. Evidence: /.env.backup: ... show more Automated: 15 requests with error status in 120s window from 20.195.187.116. Evidence: /.env.backup:301,/.env.local:301,/.env.production:301,/.env.development:301,/.env.backup:301,/.env.production:301,/favicon.ico:301,/favicon.ico:301,/%2F.env.development:301,/%2F.env.development:301,/.env.development%20:301,/.env.production%00:301,/.env.development/:301,/.env.production/:301,//:301 (+35 more) show less	Web App Attack
🇫🇷 masterguru	2026-08-25 19:59:24 (3 days ago)	Host header is a numeric IP address. Pattern match "^ (920350-131)	Hacking Bad Web Bot
🇦🇺 electronico	2026-08-25 17:10:11 (3 days ago)	20.195.187.116 - - [26/Aug/2026:04:10:03 +1100] "GET /backend/.env HTTP/1.1" 404 7447 "-" "ExposureS ... show more 20.195.187.116 - - [26/Aug/2026:04:10:03 +1100] "GET /backend/.env HTTP/1.1" 404 7447 "-" "ExposureScanner/1.0 (internal-security-audit)" 20.195.187.116 - - [26/Aug/2026:04:10:03 +1100] "GET /.yarnrc.yml HTTP/1.1" 404 2104 "-" "ExposureScanner/1.0 (internal-security-audit)" 20.195.187.116 - - [26/Aug/2026:04:10:04 +1100] "GET /id_rsa HTTP/1.1" 404 2104 "-" "ExposureScanner/1.0 (internal-security-audit)" 20.195.187.116 - - [26/Aug/2026:04:10:05 +1100] "GET /database.php HTTP/1.1" 404 2104 "-" "ExposureScanner/1.0 (internal-security-audit)" 20.195.187.116 - - [26/Aug/2026:04:10:07 +1100] "GET /appsettings.Production.json HTTP/1.1" 404 2104 "-" "ExposureScanner/1.0 (internal-security-audit)" 20.195.187.116 - - [26/Aug/2026:04:10:08 +1100] "GET /compose.yml HTTP/1.1" 404 2104 "-" "ExposureScanner/1.0 (internal-security-audit)" 20.195.187.116 - - [26/Aug/2026:04:10:08 +1100] "GET /secret.json HTTP/1.1" 404 7447 "-" "ExposureScanner/1.0 (internal-security-audit)" 20.195.187.116 - - [26/Aug/2 ... show less	Brute-Force Web App Attack
🇺🇸 Som1ght3n	2026-08-25 13:50:47 (3 days ago)	Attempted to access sensitive application configuration files, specifically `/.env.env.local`, which ... show more Attempted to access sensitive application configuration files, specifically `/.env.env.local`, which indicates a malicious web application probe. show less	Hacking
🇫🇷 GabrielJST	2026-08-25 13:40:13 (3 days ago)	(mod_security) mod_security triggered on hostname [redacted] 20.195.187.116 (BR/Brazil/-): (CF_ENAB ... show more (mod_security) mod_security triggered on hostname [redacted] 20.195.187.116 (BR/Brazil/-): (CF_ENABLE) show less	SQL Injection
Anonymous	2026-08-25 13:16:31 (3 days ago)	Web App Attack	Brute-Force Exploited Host Web App Attack
🇳🇱 tpjg	2026-08-25 09:18:03 (3 days ago)	Automated: 15 requests with error status in 120s window from 20.195.187.116. Evidence: /.env.save:30 ... show more Automated: 15 requests with error status in 120s window from 20.195.187.116. Evidence: /.env.save:301,/.env.old:301,/.env.dev/:301,/.env.prod/:301,/.env.development:301,/.env.development:301,/.env.save:301,/.env.development:301,/.env:301,/.env.production:301,/.env.staging:301,/.env:301,/favicon.ico:301,/.env.local:301,/.env.local:301 show less	Web App Attack

Showing 1 to 15 of 24 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇷🇺 217.150.37.249

🇺🇸 207.90.244.18

🇺🇸 207.90.244.14

🇹🇼 198.235.24.53

🇬🇧 193.163.125.151

🇦🇷 181.90.44.240

🇦🇷 181.9.227.231

🇺🇸 147.185.132.23

🇨🇳 120.230.20.231

🇺🇸 66.240.205.34

🇹🇼 61.231.201.148

🇨🇳 47.105.85.123

🇭🇺 45.9.168.192

🇺🇸 34.138.122.106

🇻🇳 14.171.177.208

🇺🇸 205.210.31.97

🇺🇸 205.210.31.82

🇧🇴 200.105.164.98

🇳🇱 192.42.116.112

🇨🇴 181.78.0.2