20.205.115.225
Activity Trending Down
This IP hasn't received reports recently, which causes the score to decay.
- ISP
- Microsoft Corporation
- Usage Type
- Data Center/Web Hosting/Transit
- ASN
- AS8075
- Domain Name
- microsoft.com
- Country
- 🇭🇰 Hong Kong
- City
- Hong Kong
Abuse Reports
Total reports
63 from
36 distinct
reporters
First reported
Most recent report
Old reports
The most recent abuse report for this IP address is from
.
It is possible that this IP is no longer involved in abusive activities.
| Reporter | IoA Timestamp (UTC) | Comment | Categories |
|---|---|---|---|
| 🇫🇮 Panamaaa |
Port scan detected; Brute-force attack detected
|
Port Scan Brute-Force | |
| Anonymous |
2026-10-05 02:26:42 warning[4227827]: host unknown[20.205.115.225]: unauthorized access attempted: tcp/20780
|
Port Scan Brute-Force | |
| 🇭🇰 sandra361 |
|
Port Scan | |
| 🇭🇰 sandra361 |
|
Port Scan | |
| 🇭🇰 CyberFox |
30310/tcp,30311/tcp,30313/tcp,30315/tcp,30308/tcp,30314/tcp,30309/tcp,30312/tcp (8 or more attempts)
|
Port Scan | |
| Anonymous |
3480/tcp,3473/tcp,3478/tcp,3474/tcp,3477/tcp,3479/tcp,3476/tcp,3475/tcp (8 or more attempts)
|
Port Scan | |
| 🇮🇩 FallingGong2833 |
tcp/23
|
Port Scan | |
| 🇹🇷 Domainhizmetleri.com |
Source: DH Hunter (Honeypot) | Reason: HTTP Probe (5985/tcp) [non-standard port]
|
Web App Attack | |
| 🇨🇦 smick |
Brute-force attack.
|
Brute-Force | |
| 🇪🇸 raiolanetworks.com |
Honeypot detection: credential brute-force; port scan / service probe. 4 events observed. 1 login attempts. 2 distinct ports targeted. Reported automatically from a honeypot sensor.
|
Port Scan Brute-Force | |
| 🇹🇭 Sawasdee |
Port Scan
...
|
Port Scan | |
| 🇹🇭 Sawasdee |
Port Scan
...
|
Port Scan | |
| 🇫🇷 ✨ |
Rule : Security
Rule: Security
Event: Security
S-1-0-0 - - 0x0 S-1-0-0 administrator - 0xc000006d %#13 0xc0000064 3 NtLmSsp NTLM - - - 0 0x0 - 20.205.115.225 47338
|
Port Scan Hacking Brute-Force | |
| 🇨🇳 leonfetter |
Dasheng Security: 1 failed logons in 1440 minutes
|
Brute-Force | |
| 🇺🇸 JCB |
20.205.115.225 - - [19/Sep/2026:18:09:36 +0300] "POST /wsman?PSVersion=5.1.19041.1 HTTP/1.1" 404 196 "-" "Microsoft WinRM Client"
...
|
Web App Attack |
Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown