JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 20.55.87.181

20.55.87.181 was found in our database!

This IP was reported 140 times. Confidence of Abuse is 71%: ?

71%

ISP	Microsoft Corporation
Usage Type	Data Center/Web Hosting/Transit
ASN	AS8075
Domain Name	microsoft.com
Country	🇺🇸 United States of America
City	Washington, Virginia

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 20.55.87.181

Whois 20.55.87.181

IP Abuse Reports for 20.55.87.181:

This IP address has been reported a total of 140 times from 74 distinct sources. 20.55.87.181 was first reported on August 23rd 2025, and the most recent report was 3 days ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇩🇪 markawes	2026-06-03 06:27:01 (3 days ago)	[markis] Auto banned by Fail2Ban. Reason: Malicious web scan / attempted access to sensitive paths. ... show more [markis] Auto banned by Fail2Ban. Reason: Malicious web scan / attempted access to sensitive paths. Evidence: 20.55.87.181 - - [03/Jun/2026:07:26:56 +0100] "GET /.env.local HTTP/1.1" 404 455 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36" 20.55.87.181 - - [03/Jun/2026:07:26:59 +0100] "GET /.env.backup HTTP/1.1" 404 455 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36" 20.55.87.181 - - [03/Jun/2026:07:27:00 +0100] "GET /.env.save HTTP/1.1" 404 455 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14.4; rv:125.0) Gecko/20100101 Firefox/125.0" show less	Port Scan Hacking Web App Attack
🇹🇭 Sawasdee	2026-06-03 06:06:06 (3 days ago)	Unwanted checking 80 or 443 port ...	Bad Web Bot
🇹🇼 ip4.tw	2026-06-03 06:00:03 (3 days ago)	Malicious web scan	Hacking Web App Attack
🇺🇸 TPI-Abuse	2026-06-03 04:56:54 (3 days ago)	(mod_security) mod_security (id:210492) triggered by 20.55.87.181 (-): 1 in the last 300 secs; Ports ... show more (mod_security) mod_security (id:210492) triggered by 20.55.87.181 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jun 03 00:56:50.162949 2026] [security2:error] [pid 14849:tid 14849] [client 20.55.87.181:62528] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "192.64.150.73"] [uri "/.git/HEAD"] [unique_id "ah-0EmF_Yl11jFsVqEYS-wAAAAY"] show less	Brute-Force Bad Web Bot Web App Attack
🇳🇱 SchorelWeb	2026-06-02 15:52:10 (4 days ago)	Cluster member (Omitted) (FR/France/-) said, DENY 20.55.87.181, Reason:[Security Patte(Omitted) Matc ... show more Cluster member (Omitted) (FR/France/-) said, DENY 20.55.87.181, Reason:[Security Patte(Omitted) Match: wp-config\.php (URL: /wp-config.php.bak)] show less	Brute-Force SSH
🇺🇸 RAP	2026-06-02 05:02:27 (4 days ago)	2026-06-02 05:02:27 UTC Unauthorized activity to TCP port 8443. Web App	Port Scan Web App Attack
🇫🇷 ISPLtd	2026-06-02 04:38:01 (4 days ago)	Jun 2 01:38:00 20.55.87.181 TCP SPT=46132 DPT=2087 SYN Jun 2 01:38:00 20.55.87.181 TCP SPT=46201 D ... show more Jun 2 01:38:00 20.55.87.181 TCP SPT=46132 DPT=2087 SYN Jun 2 01:38:00 20.55.87.181 TCP SPT=46201 DPT=2083 SYN Jun 2 01:38:00 20.55.87.181 TCP SPT=46102 DPT=8443 ... show less	Port Scan
🇺🇸 MPL	2026-06-02 04:17:29 (4 days ago)	tcp port scan (7 or more attempts)	Port Scan
🇬🇧 essinghigh	2026-06-02 04:11:34 (4 days ago)	IPS Detection: 20.55.87.181 -> DPT: 2087	Port Scan
🇺🇸 kosada.com	2026-06-02 03:52:47 (4 days ago)	Web vulnerability probing: /app/config/parameters.yml (bogus vhost/SNI)	Web App Attack
🇳🇱 thedreamer.nl	2026-06-02 03:19:46 (4 days ago)	20.55.87.181 - - [02/Jun/2026:05:14:23 +0200] "GET /.git/config HTTP/1.1" 499 0 "-" "Mozilla/5.0 (X1 ... show more 20.55.87.181 - - [02/Jun/2026:05:14:23 +0200] "GET /.git/config HTTP/1.1" 499 0 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36" "US" "Washington" "38.70950" "-78.15390" 20.55.87.181 - - [02/Jun/2026:05:14:24 +0200] "GET /.env HTTP/1.1" 499 0 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_4_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36" "US" "Washington" "38.70950" "-78.15390" 20.55.87.181 - - [02/Jun/2026:05:14:24 +0200] "GET /.env.local HTTP/1.1" 499 0 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14.4; rv:125.0) Gecko/20100101 Firefox/125.0" "US" "Washington" "38.70950" "-78.15390" 20.55.87.181 - - [02/Jun/2026:05:14:26 +0200] "GET /.env.backup HTTP/1.1" 499 0 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)" "US" "Washington" "38.70950" "-78.15390" ... show less	Hacking Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-06-02 03:16:30 (4 days ago)	(mod_security) mod_security (id:210492) triggered by 20.55.87.181 (-): 1 in the last 300 secs; Ports ... show more (mod_security) mod_security (id:210492) triggered by 20.55.87.181 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jun 01 23:16:23.635371 2026] [security2:error] [pid 4450:tid 4450] [client 20.55.87.181:46984] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "192.64.150.176"] [uri "/.git/config"] [unique_id "ah5LB0kdDkUpLRF7jnWkTAAAAAo"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 MPL	2026-06-02 03:07:26 (4 days ago)	tcp port scan (8 or more attempts)	Port Scan
🇯🇵 demonsword	2026-05-01 15:08:46 (1 month ago)	Detected by SentinelX honeypot: sent HTTP CONNECT request probing for an open proxy. Connection was ... show more Detected by SentinelX honeypot: sent HTTP CONNECT request probing for an open proxy. Connection was hijacked and held in a tarpit to slow down the scan. Probed target: www.eastmoney.com:443 show less	Open Proxy Port Scan
🇺🇸 Rayulcifer	2026-04-20 11:24:37 (1 month ago)	20.55.87.181 - - [20/Apr/2026:06:24:37 -0500] "\x16\x03\x01\x05\xd4\x01" 400 392 "-" "-" 20.55.87.18 ... show more 20.55.87.181 - - [20/Apr/2026:06:24:37 -0500] "\x16\x03\x01\x05\xd4\x01" 400 392 "-" "-" 20.55.87.181 - - [20/Apr/2026:06:24:37 -0500] "\x16\x03\x01\x05\xd4\x01" 400 392 "-" "-" ... show less	Open Proxy Port Scan Hacking Web App Attack SSH

Showing 1 to 15 of 140 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇲🇽 187.140.79.156

🇳🇱 185.223.235.7

🇨🇳 183.36.243.67

🇺🇸 172.203.242.24

🇨🇳 58.50.206.158

🇺🇸 13.222.73.81

🇺🇸 205.210.31.65

🇪🇹 196.189.236.216

🇳🇱 193.176.31.243

🇮🇩 180.243.148.189

🇦🇷 152.169.154.26

🇺🇸 147.185.132.219

🇺🇸 135.237.125.135

🇨🇳 119.255.245.44

🇨🇳 111.10.244.187

🇵🇱 95.214.54.27

🇬🇧 91.108.97.247

🇳🇱 86.54.31.38

🇧🇬 79.124.62.230

🇷🇺 45.80.129.150