JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 20.51.199.6

20.51.199.6 was found in our database!

This IP was reported 16 times. Confidence of Abuse is 80%: ?

80%

ISP	Microsoft Corporation
Usage Type	Data Center/Web Hosting/Transit
ASN	AS8075
Domain Name	microsoft.com
Country	🇺🇸 United States of America
City	Washington, Virginia

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 20.51.199.6

Whois 20.51.199.6

IP Abuse Reports for 20.51.199.6:

This IP address has been reported a total of 16 times from 15 distinct sources. 20.51.199.6 was first reported on June 3rd 2026, and the most recent report was 3 hours ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
Anonymous	2026-06-17 04:27:47 (3 hours ago)	apache vulnerability scan	Web App Attack
🇺🇸 TPI-Abuse	2026-06-17 04:03:03 (4 hours ago)	(mod_security) mod_security (id:210492) triggered by 20.51.199.6 (-): 1 in the last 300 secs; Ports: ... show more (mod_security) mod_security (id:210492) triggered by 20.51.199.6 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jun 17 00:02:58.011514 2026] [security2:error] [pid 29176:tid 29219] [client 20.51.199.6:33949] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "192.64.150.44"] [uri "/.git/config"] [unique_id "ajIccsiww5DJgdj1RePi-AAAAUs"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 xmission.com	2026-06-17 03:34:24 (4 hours ago)	Blocked by UFW (TCP on 2095) Source port: 33599 TTL: 47 Packet length: 60 TOS: 0x00 This report (fo ... show more Blocked by UFW (TCP on 2095) Source port: 33599 TTL: 47 Packet length: 60 TOS: 0x00 This report (for 20.51.199.6) was generated by: https://github.com/sefinek/UFW-AbuseIPDB-Reporter show less	Port Scan
🇫🇮 6kilowatti	2026-06-17 03:02:27 (5 hours ago)	2026-06-17T06:02:26.551747+03:00 mummo kernel: [UFW BLOCK] IN=enp0s25 OUT= MAC=6c:62:6d:d6:a5:bc:00: ... show more 2026-06-17T06:02:26.551747+03:00 mummo kernel: [UFW BLOCK] IN=enp0s25 OUT= MAC=6c:62:6d:d6:a5:bc:00:00:5e:00:01:58:08:00 SRC=20.51.199.6 DST=83.148.240.21 LEN=60 TOS=0x00 PREC=0x00 TTL=49 ID=27893 DF PROTO=TCP SPT=34118 DPT=2078 WINDOW=64240 RES=0x00 SYN URGP=0 ... show less	Port Scan
Anonymous	2026-06-17 02:30:09 (5 hours ago)	Triggered: repeated knocking on closed ports.	Port Scan
Anonymous	2026-06-17 01:58:34 (6 hours ago)	Unauthorized connection attempt	Port Scan Hacking Exploited Host
Anonymous	2026-06-17 00:55:29 (7 hours ago)	Honeypot hit: Empty payload (likely service probe); 2096 [1], 2077 [1] TCP Reported by: https://gith ... show more Honeypot hit: Empty payload (likely service probe); 2096 [1], 2077 [1] TCP Reported by: https://github.com/sefinek/T-Pot-To-AbuseIPDB show less	Port Scan
🇷🇸 Scan	2026-06-17 00:39:00 (7 hours ago)	MultiHost/MultiPort Probe, Scan, Hack -	Port Scan Hacking
🇨🇦 1gz	2026-06-06 09:10:18 (1 week ago)	Triggered Cloudflare WAF (firewallManaged) from US. Action taken: BLOCK Protocol: HTTP/2 (GET method ... show more Triggered Cloudflare WAF (firewallManaged) from US. Action taken: BLOCK Protocol: HTTP/2 (GET method) Endpoint: / UA: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/148.0.7778.96 Safari/537.36 This report was generated by: https://github.com/sefinek/Cloudflare-WAF-To-AbuseIPDB show less	Bad Web Bot
Anonymous	2026-06-03 08:00:00 (2 weeks ago)	SSH Brute-Force	DDoS Attack Port Scan Hacking Brute-Force SSH
🇹🇷 Threat.live	2026-06-03 06:50:04 (2 weeks ago)	Suspicious Connection Attempts	Brute-Force
🇧🇷 SOC PR	2026-06-03 06:47:36 (2 weeks ago)	IPS: Web Server Exposed Git Repository Information Disclosure.	Hacking
Anonymous	2026-06-03 06:31:36 (2 weeks ago)	Web Attack Gitscanner Traffic Detected	Web App Attack
🇩🇪 Nightreaver	2026-06-03 06:02:45 (2 weeks ago)	20.51.199.6 - - [03/Jun/2026:08:02:38 0200] "GET /.env.backup HTTP/1.1" 404 457 "-" "Mozilla/5.0 (W ... show more 20.51.199.6 - - [03/Jun/2026:08:02:38 0200] "GET /.env.backup HTTP/1.1" 404 457 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0" 20.51.199.6 - - [03/Jun/2026:08:02:40 0200] "GET /.env.save HTTP/1.1" 404 457 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36" 20.51.199.6 - - [03/Jun/2026:08:02:40 0200] "GET /wp-config.php HTTP/1.1" 404 457 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_4_1) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.4 Safari/605.1.15" 20.51.199.6 - - [03/Jun/2026:08:02:43 0200] "GET /config/database.yml HTTP/1.1" 404 457 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36" 20.51.199.6 - - [03/Jun/2026:08:02:44 0200] "GET /phpinfo.php HTTP/1.1" 404 457 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_4_1) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.4 Safari/605.1.15"[...] show less	Bad Web Bot Web App Attack
🇧🇾 lns.bz	2026-06-03 05:50:11 (2 weeks ago)	Too many 404 requests [BY]	Web App Attack

Showing 1 to 15 of 16 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇺🇸 107.151.197.77

🇧🇷 2400:cb00:1058:1000:23ed:589b:e8b5:8ad3

🇧🇷 200.53.78.67

🇳🇱 195.178.110.30

🇮🇳 103.177.235.243

🇵🇰 103.164.9.74

🇮🇳 103.123.226.138

🇷🇺 81.177.101.45

🇺🇸 70.175.180.147

🇫🇷 51.68.226.87

🇨🇳 36.153.54.171

🇷🇴 2.57.121.112

🇬🇧 213.166.84.55

🇹🇬 196.168.30.194

🇲🇾 180.74.84.64

🇮🇳 168.144.157.139

🇩🇪 87.156.176.191

🇺🇸 64.62.197.22

🇨🇳 60.177.36.54

🇲🇾 47.250.41.171