20.65.200.127
Activity Trending Down
This IP hasn't received reports recently, which causes the score to decay.
- ISP
- Microsoft Corporation
- Usage Type
- Data Center/Web Hosting/Transit
- ASN
- AS8075
- Domain Name
- microsoft.com
- Country
- 🇺🇸 United States of America
- City
- San Antonio, Texas
Abuse Reports
Total reports
35 from
24 distinct
reporters
First reported
Most recent report
Old reports
The most recent abuse report for this IP address is from
.
It is possible that this IP is no longer involved in abusive activities.
| Reporter | IoA Timestamp (UTC) | Comment | Categories |
|---|---|---|---|
| 🇧🇷 diego |
[probe-44-49] 2026-11-05 19:19:42, Client: 20.65.200.127, Protocol: 6, Unauthorized activity to HTTP: POST /
|
Web App Attack | |
| 🇳🇱 knock |
Knock-Knock honeypot brute-force: HTTP (1 total hits)
|
Web App Attack | |
| 🇺🇸 NXTwoThou |
174.78
|
Web App Attack | |
| Anonymous |
|
Port Scan Brute-Force SSH | |
| Anonymous |
|
Port Scan Brute-Force SSH | |
| Anonymous |
Repeated unauthorized connection attempts to restricted service observed.
|
Port Scan Hacking Bad Web Bot Web App Attack | |
| 🇳🇱 donarev419 |
Connection to port 80 with data transfer.
Data preview: GET /open/ HTTP/1.1
Host: 87.229.95.155
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) Appl
|
Port Scan Hacking | |
| 🇩🇪 mist x |
Honeypot Web Sensor: Malicious HTTP scanner probe targeting sensitive path: GET /open/ HTTP/1.1
|
Bad Web Bot Web App Attack | |
| 🇧🇷 diego |
[probe-44-49] 2026-09-03 02:10:21, Client: 20.65.200.127, Protocol: 6, Unauthorized activity to HTTP: GET /open/
|
Web App Attack | |
| 🇺🇸 MPL |
tcp/80
|
Port Scan | |
| 🇬🇧 andypiper |
CrowdSec ban for AbuseIPDB Top List
|
Brute-Force Web App Attack | |
| 🇺🇸 MPL |
tcp/443 (2 or more attempts)
|
Port Scan | |
| 🇺🇸 Axel |
Blocked by UFW on LAXHH [80/tcp] | SPT: 42896 | TTL: 49 | LEN: 52 | TOS: 0x00 • Reported by: github.com/sefinek/UFW-AbuseIPDB-Reporter
|
Port Scan | |
| 🇺🇸 Tman111 |
Unsolicited connection attempt to web ports (80/443). No service is offered to direct-to-IP traffic; connection dropped. Scanner/bot behavior.
|
Port Scan | |
| 🇷🇺 genokrad |
Website scan TCP 80/443 "/open/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KH"
|
Port Scan Web App Attack |
Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown