JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 20.246.125.85

20.246.125.85 was found in our database!

This IP was reported 323 times. Confidence of Abuse is 100%: ?

100%

ISP	Microsoft Corporation
Usage Type	Data Center/Web Hosting/Transit
ASN	AS8075
Domain Name	microsoft.com
Country	🇺🇸 United States of America
City	Boydton, Virginia

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 20.246.125.85

Whois 20.246.125.85

IP Abuse Reports for 20.246.125.85:

This IP address has been reported a total of 323 times from 275 distinct sources. 20.246.125.85 was first reported on August 27th 2026, and the most recent report was 36 seconds ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇳🇱 tpjg	2026-08-28 00:04:19 (36 seconds ago)	Automated: 15 requests with error status in 120s window from 20.246.125.85. Evidence: /.git/HEAD:404 ... show more Automated: 15 requests with error status in 120s window from 20.246.125.85. Evidence: /.git/HEAD:404,/.env.production:404,/config.php:404,/serviceAccountKey.json:404,/.env.bak:404,/docker-compose.yml:404,/config.json:404,/.aws/config:404,/.config/gcloud/application_default_credentials.json:404,/terraform.tfstate:404,/.aws/credentials:404,/actuator/env:404,/v1/models:404,/.git/config:404,/.streamlit/secrets.toml:404 (+35 more) show less	Web App Attack
🇩🇪 Ilop	2026-08-28 00:03:07 (1 minute ago)	[hp-100] 44 unsolicited packets to honeypot ports 8000,80 (OCI DShield sensor)	Port Scan
🇺🇸 mw	2026-08-28 00:02:01 (2 minutes ago)	GET /.env.bak HTTP/1.1	Web App Attack
🇳🇱 donarev419	2026-08-28 00:01:28 (3 minutes ago)	Connection to port 3000 with data transfer. Data preview: HEAD / HTTP/1.1 Host: 109.110.170.76:3000 ... show more Connection to port 3000 with data transfer. Data preview: HEAD / HTTP/1.1 Host: 109.110.170.76:3000 Connection: close User-Agent: Mozilla/5.0 (X11; Linux x show less	Port Scan Hacking
🇮🇳 evicky2002	2026-08-28 00:01:14 (3 minutes ago)	Confirmed malicious by STILWaters CTI platform (score=100, sources=1)	Hacking Brute-Force SSH
🇩🇪 IloGus	2026-08-28 00:00:59 (3 minutes ago)	WAF repeated trigger detected by Fail2Ban in plesk-modsecurity jail	Web App Attack
Anonymous	2026-08-28 00:00:46 (4 minutes ago)	(NGINX) Security rule triggered from 20.246.125.85 (US/United States/-): 5 in the last 3600 secs	Web App Attack
🇩🇪 XYCoderXY	2026-08-28 00:00:17 (4 minutes ago)	SSH/web brute-force & exploit scanning against lumerux.com (automated report).	Brute-Force SSH
🇩🇪 edena	2026-08-27 23:58:28 (6 minutes ago)	20.246.125.85 - - [28/Aug/2026:01:58:27 +0200] "GET /.streamlit/secrets.toml HTTP/1.1" 403 1826 "htt ... show more 20.246.125.85 - - [28/Aug/2026:01:58:27 +0200] "GET /.streamlit/secrets.toml HTTP/1.1" 403 1826 "https://136.243.1.118:443/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 20.246.125.85 - - [28/Aug/2026:01:58:27 +0200] "GET /.env.production HTTP/1.1" 403 1826 "https://136.243.1.118:443/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 20.246.125.85 - - [28/Aug/2026:01:58:27 +0200] "GET /.env HTTP/1.1" 403 1826 "https://136.243.1.118:443/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" ... show less	Web App Attack Bad Web Bot
🇬🇧 rooster	2026-08-27 23:49:16 (15 minutes ago)	[28/Aug/2026:00:47:01 +0100] 404 - GET http 141.147.73.25 "/x7f9q2z" [Client 20.246.125.85] [Length ... show more [28/Aug/2026:00:47:01 +0100] 404 - GET http 141.147.73.25 "/x7f9q2z" [Client 20.246.125.85] [Length 183] [Gzip 3.21] "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" "-" [28/Aug/2026:00:49:16 +0100] 404 - GET http 141.147.73.25 "/v1/models" [Client 20.246.125.85] [Length 183] [Gzip 3.21] "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" "http://141.147.73.25:80/" [28/Aug/2026:00:49:16 +0100] 404 - GET http 141.147.73.25 "/terraform.tfstate" [Client 20.246.125.85] [Length 183] [Gzip 3.21] "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" "http://141.147.73.25:80/" [28/Aug/2026:00:49:16 +0100] 404 - GET http 141.147.73.25 "/serviceAccountKey.json" [Client 20.246.125.85] [Length 183] [Gzip 3.21] "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrom ... show less	Hacking Web App Attack
Anonymous	2026-08-27 23:45:28 (19 minutes ago)	20.246.125.85 - - [28/Aug/2026:01:45:27 +0200] "GET /config.php HTTP/1.1" 403 6483 "https://176.162. ... show more 20.246.125.85 - - [28/Aug/2026:01:45:27 +0200] "GET /config.php HTTP/1.1" 403 6483 "https://176.162.144.165:443/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 20.246.125.85 - - [28/Aug/2026:01:45:27 +0200] "GET /.git/config HTTP/1.1" 403 406 "https://176.162.144.165:443/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" ... show less	Web App Attack
🇮🇪 AutosOnShow	2026-08-27 23:45:05 (19 minutes ago)	blocked for webapp attack \| path requested: /.env \| seen at 2026-08-27 23:44:37.867 \|	Web App Attack
🇫🇷 Lino Project	2026-08-27 23:44:06 (20 minutes ago)	20.246.125.85 - - [28/Aug/2026:01:44:04 +0200] "GET /config.json HTTP/1.1" 302 463 "http://5.182.33. ... show more 20.246.125.85 - - [28/Aug/2026:01:44:04 +0200] "GET /config.json HTTP/1.1" 302 463 "http://5.182.33.157:80/" "Mozilla/5.0 (iPhone; CPU iPhone OS 17_7 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.7 Mobile/15E148 Safari/604.1" 20.246.125.85 - - [28/Aug/2026:01:44:04 +0200] "GET /config.php HTTP/1.1" 302 461 "http://5.182.33.157:80/" "Mozilla/5.0 (iPhone; CPU iPhone OS 17_7 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.7 Mobile/15E148 Safari/604.1" ... show less	Brute-Force Bad Web Bot Web App Attack
🇬🇧 f3sc	2026-08-27 23:41:42 (23 minutes ago)	20.246.125.85 - - [28/Aug/2026:01:41:41 +0200] "GET /actuator/env HTTP/1.1" 404 683 "http://54.38.78 ... show more 20.246.125.85 - - [28/Aug/2026:01:41:41 +0200] "GET /actuator/env HTTP/1.1" 404 683 "http://54.38.78.214:80/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" show less	Hacking Web App Attack
🇮🇩 Burayot	2026-08-27 23:35:08 (29 minutes ago)	LF_MODSEC: (mod_security) mod_security (id:1000001) triggered by 20.246.125.85 (US/United States/-): ... show more LF_MODSEC: (mod_security) mod_security (id:1000001) triggered by 20.246.125.85 (US/United States/-): 1 in the last 3600 secs show less	Web App Attack

Showing 1 to 15 of 323 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇳🇱 185.242.226.17

🇩🇪 167.94.145.25

🇩🇪 151.243.11.19

🇺🇸 137.184.108.218

🇻🇳 103.131.71.236

🇨🇦 51.161.33.215

🇫🇷 51.159.110.167

🇨🇳 39.73.196.147

🇬🇧 18.170.223.75

🇧🇴 186.121.233.2

🇨🇴 186.1.175.163

🇧🇷 181.189.43.221

🇦🇷 181.46.9.9

🇸🇬 172.253.211.90

🇺🇸 172.253.9.220

🇺🇸 162.216.150.121

🇺🇸 149.130.217.139

🇫🇮 147.185.133.197

🇨🇳 120.226.201.27

🇳🇱 91.92.40.52