JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

20.206.160.33

Neutral Activity

Abuse confidence score ?

0% Low Risk

16 reports

8 reporters · latest 1 year ago

ISP	Microsoft Corporation
Usage Type	Data Center/Web Hosting/Transit
ASN	AS8075
Domain Name	microsoft.com
Country	🇧🇷 Brazil
City	Campinas, Sao Paulo

ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report Whois

No reports in the last 60 days

20.206.160.33 has been reported 16 times. The most recent report is from 1 year ago.

The full history is preserved below and remains searchable. A 0% score reflects the absence of recent activity, but this is not a guarantee that earlier reports were invalid. Abuse confidence score decays, naturally, over time, when the abusive activity stops.

IP Abuse Reports for 20.206.160.33

Export CSV

This IP address has been reported a total of 16 times from 8 distinct sources. 20.206.160.33 was first reported on September 26th 2025, and the most recent report was 1 year ago.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇺🇸 TPI-Abuse	2025-09-29 16:55:33 (1 year ago)	(mod_security) mod_security (id:210492) triggered by 20.206.160.33 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:210492) triggered by 20.206.160.33 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Sep 29 12:55:26.910986 2025] [security2:error] [pid 17613:tid 17613] [client 20.206.160.33:64851] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "jmnr.net"] [uri "/.env"] [unique_id "aNq5_jdcOrvykypGzTkQsAAAAAA"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 agenciahypelab.com.br	2025-09-29 16:02:27 (1 year ago)	WordPress login brute-force detectado e bloqueado pelo CSF/LFD. Trigger: LF_TRIGGER	Brute-Force SSH
🇺🇸 TPI-Abuse	2025-09-29 15:58:58 (1 year ago)	(mod_security) mod_security (id:210492) triggered by 20.206.160.33 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:210492) triggered by 20.206.160.33 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Sep 29 11:58:54.159527 2025] [security2:error] [pid 12480:tid 12480] [client 20.206.160.33:61465] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "mathewyoung.com"] [uri "/.env"] [unique_id "aNqsvu0SJD8V9e0M1LbXMwAAAAU"] show less	Brute-Force Bad Web Bot Web App Attack
🇮🇹 www.tana.it	2025-09-29 15:25:52 (1 year ago)	PHP scan	Web App Attack
🇺🇸 TPI-Abuse	2025-09-28 16:32:56 (1 year ago)	(mod_security) mod_security (id:210492) triggered by 20.206.160.33 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:210492) triggered by 20.206.160.33 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Sep 28 12:32:51.888058 2025] [security2:error] [pid 25419:tid 25419] [client 20.206.160.33:63796] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "jugsnet.com"] [uri "/.env"] [unique_id "aNljM1W8C7ntdd8VyS7ioAAAAAA"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2025-09-28 03:50:26 (1 year ago)	(mod_security) mod_security (id:210492) triggered by 20.206.160.33 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:210492) triggered by 20.206.160.33 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Sep 27 23:50:22.408833 2025] [security2:error] [pid 16814:tid 16814] [client 20.206.160.33:54775] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "zodiacwin.com"] [uri "/.env"] [unique_id "aNiwfi-Jupb5M2IIFNTJfgAAAAM"] show less	Brute-Force Bad Web Bot Web App Attack
🇧🇷 SvrAdmin	2025-09-27 06:30:48 (1 year ago)	[101] (smtpauth) Failed SMTP AUTH login from 20.206.160.33 (BR/Brazil/-): 5 in the last 3600 secs; P ... show more [101] (smtpauth) Failed SMTP AUTH login from 20.206.160.33 (BR/Brazil/-): 5 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_SMTPAUTH; Logs: 2025-09-27 03:26:14 dovecot_login authenticator failed for (ADMIN) [20.206.160.33]:65469: 535 Incorrect authentication data ([email protected]) 2025-09-27 03:26:20 dovecot_login authenticator failed for (ADMIN) [20.206.160.33]:51169: 535 Incorrect authentication data ([email protected]) 2025-09-27 03:28:13 dovecot_login authenticator failed for (ADMIN) [20.206.160.33]:57805: 535 Incorrect authentication data ([email protected]) 2025-09-27 03:30:36 dovecot_login authenticator failed for (ADMIN) [20.206.160.33]:59941: 535 Incorrect authentication data ([email protected]) 2025-09-27 03:30:42 dovecot_login authenticator failed for (ADMIN) [20.206.160.33]:62936: 535 Incorrect authentication data ([email protected]) show less	Port Scan Hacking Brute-Force Exploited Host
🇧🇷 SvrAdmin	2025-09-26 20:03:20 (1 year ago)	[101] (smtpauth) Failed SMTP AUTH login from 20.206.160.33 (BR/Brazil/-): 5 in the last 3600 secs; P ... show more [101] (smtpauth) Failed SMTP AUTH login from 20.206.160.33 (BR/Brazil/-): 5 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_SMTPAUTH; Logs: 2025-09-26 16:58:34 dovecot_login authenticator failed for (ADMIN) [20.206.160.33]:52568: 535 Incorrect authentication data ([email protected]) 2025-09-26 16:58:51 dovecot_login authenticator failed for (ADMIN) [20.206.160.33]:55164: 535 Incorrect authentication data ([email protected]) 2025-09-26 16:58:59 dovecot_login authenticator failed for (ADMIN) [20.206.160.33]:56940: 535 Incorrect authentication data ([email protected]) 2025-09-26 17:02:13 dovecot_login authenticator failed for (ADMIN) [20.206.160.33]:50072: 535 Incorrect authentication data ([email protected]) 2025-09-26 17:03:16 dovecot_login authenticator failed for (ADMIN) [20.206.160.33]:49271: 535 Incorrect authentication data ([email protected]) show less	Port Scan Hacking Brute-Force Exploited Host
🇧🇷 websync	2025-09-26 19:33:56 (1 year ago)	Kept connecting and disconnecting without issuing any commands	DDoS Attack
🇧🇷 SvrAdmin	2025-09-26 15:04:04 (1 year ago)	[293] (smtpauth) Failed SMTP AUTH login from 20.206.160.33 (BR/Brazil/-): 5 in the last 3600 secs; P ... show more [293] (smtpauth) Failed SMTP AUTH login from 20.206.160.33 (BR/Brazil/-): 5 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_SMTPAUTH; Logs: Sep 26 11:29:37 cwp01 postfix/smtpd[1279]: warning: unknown[20.206.160.33]: SASL LOGIN authentication failed: UGFzc3dvcmQ6 Sep 26 11:40:14 cwp01 postfix/smtpd[2957]: warning: unknown[20.206.160.33]: SASL LOGIN authentication failed: UGFzc3dvcmQ6 Sep 26 11:48:04 cwp01 postfix/smtpd[3803]: warning: unknown[20.206.160.33]: SASL LOGIN authentication failed: UGFzc3dvcmQ6 Sep 26 11:57:57 cwp01 postfix/smtpd[4954]: warning: unknown[20.206.160.33]: SASL LOGIN authentication failed: UGFzc3dvcmQ6 Sep 26 12:04:01 cwp01 postfix/smtpd[5529]: warning: unknown[20.206.160.33]: SASL LOGIN authentication failed: UGFzc3dvcmQ6 show less	Port Scan Hacking Brute-Force Exploited Host
🇧🇷 LM Security	2025-09-26 15:00:03 (1 year ago)	2025-09-26 11:59:30 dovecot_login authenticator failed for (ADMIN) [20.206.160.33]:49294: 535 Incorr ... show more 2025-09-26 11:59:30 dovecot_login authenticator failed for (ADMIN) [20.206.160.33]:49294: 535 Incorrect authentication data (set_id=grupofiscal@[redacted]company.com.br) 2025-09-26 11:55:35 dovecot_login authenticator failed for (ADMIN) [20.206.160.33]:61907: 535 Incorrect authentication data (set_id=pamela.dorneles@[redacted]holding.com.br) show less	Brute-Force
🇧🇷 SvrAdmin	2025-09-26 14:41:15 (1 year ago)	[315] (smtpauth) Failed SMTP AUTH login from 20.206.160.33 (BR/Brazil/-): 5 in the last 3600 secs; P ... show more [315] (smtpauth) Failed SMTP AUTH login from 20.206.160.33 (BR/Brazil/-): 5 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_SMTPAUTH; Logs: Sep 26 10:43:15 cwp01 postfix/smtpd[32676]: warning: unknown[20.206.160.33]: SASL LOGIN authentication failed: UGFzc3dvcmQ6 Sep 26 11:33:58 cwp01 postfix/smtpd[5448]: warning: unknown[20.206.160.33]: SASL LOGIN authentication failed: UGFzc3dvcmQ6 Sep 26 11:40:28 cwp01 postfix/smtpd[5448]: warning: unknown[20.206.160.33]: SASL LOGIN authentication failed: UGFzc3dvcmQ6 Sep 26 11:40:43 cwp01 postfix/smtpd[5448]: warning: unknown[20.206.160.33]: SASL LOGIN authentication failed: UGFzc3dvcmQ6 Sep 26 11:41:10 cwp01 postfix/smtpd[5448]: warning: unknown[20.206.160.33]: SASL LOGIN authentication failed: UGFzc3dvcmQ6 show less	Port Scan Hacking Brute-Force Exploited Host
🇺🇸 agenciahypelab.com.br	2025-09-26 13:55:11 (1 year ago)	WordPress login brute-force detectado e bloqueado pelo CSF/LFD. Trigger: LF_TRIGGER	Brute-Force SSH
🇩🇪 vhnmn	2025-09-26 13:06:22 (1 year ago)	spam/brute force attack blocked attempt from fail2ban ...	Email Spam Brute-Force
🇨🇦 Julio Covolato	2025-09-26 12:00:02 (1 year ago)	Imap or Submission login brute-force attacks.	Brute-Force

Showing 1 to 15 of 16 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇺🇸 198.46.134.48

🇮🇩 223.25.110.76

🇵🇭 222.126.105.187

🇰🇷 211.178.247.182

🇨🇴 191.110.215.194

🇨🇴 190.242.173.233

🇨🇷 186.4.53.199

🇹🇼 111.253.199.67

🇹🇼 110.24.36.6

🇨🇳 60.2.173.138

🇩🇪 45.115.26.59

🇨🇳 43.142.94.140

🇩🇿 41.111.183.207

🇮🇱 213.151.58.20

🇪🇬 81.10.31.125

🇩🇪 69.5.169.92

🇹🇼 61.220.235.10

🇸🇬 47.128.39.66

🇺🇸 40.124.180.6

🇰🇷 211.63.34.149