JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 20.81.47.117

20.81.47.117 was found in our database!

This IP was reported 30 times. Confidence of Abuse is 100%: ?

100%

ISP	Microsoft Corporation
Usage Type	Data Center/Web Hosting/Transit
ASN	AS8075
Domain Name	microsoft.com
Country	🇺🇸 United States of America
City	Washington, Virginia

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 20.81.47.117

Whois 20.81.47.117

IP Abuse Reports for 20.81.47.117:

This IP address has been reported a total of 30 times from 25 distinct sources. 20.81.47.117 was first reported on February 6th 2025, and the most recent report was 23 hours ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇧🇷 Peregrine	2026-06-04 03:13:27 (23 hours ago)	Fail2Ban ct101 Jail: tomcat-honeypot \| Evidence: - 20.81.47.117 - - [02/Jun/2026:19:57:32 -0300] "GE ... show more Fail2Ban ct101 Jail: tomcat-honeypot \| Evidence: - 20.81.47.117 - - [02/Jun/2026:19:57:32 -0300] "GET /.git/config HTTP/1.1" 404 18193 show less	Bad Web Bot
🇦🇹 urnilxfgbez	2026-06-03 22:45:00 (1 day ago)	Last 24 Hours suspicious: (DPT=445\|DPT=3389\|DPT=22\|DPT=3306\|DPT=8080\|DPT=23\|DPT=5900\|DPT=1433)	Port Scan
🇷🇸 Scan	2026-06-03 02:29:05 (1 day ago)	MultiHost/MultiPort Probe, Scan, Hack -	Port Scan Hacking
🇧🇷 Peregrine	2026-06-02 22:57:34 (2 days ago)	Fail2Ban ct101 Jail: tomcat-honeypot \| Evidence: - 20.81.47.117 - - [02/Jun/2026:19:57:32 -0300] "GE ... show more Fail2Ban ct101 Jail: tomcat-honeypot \| Evidence: - 20.81.47.117 - - [02/Jun/2026:19:57:32 -0300] "GET /.git/config HTTP/1.1" 404 18193 show less	Bad Web Bot
🇦🇹 urnilxfgbez	2026-06-02 22:45:00 (2 days ago)	Last 24 Hours suspicious: (DPT=445\|DPT=3389\|DPT=22\|DPT=3306\|DPT=8080\|DPT=23\|DPT=5900\|DPT=1433)	Port Scan
🇱🇻 instant	2026-06-02 22:41:27 (2 days ago)	02.06.2026 22:41:27 Git repository scan (/.git)	Hacking Web App Attack
🇺🇸 TPI-Abuse	2026-06-02 22:34:11 (2 days ago)	(mod_security) mod_security (id:210492) triggered by 20.81.47.117 (-): 1 in the last 300 secs; Ports ... show more (mod_security) mod_security (id:210492) triggered by 20.81.47.117 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jun 02 18:34:08.365384 2026] [security2:error] [pid 19020:tid 19036] [client 20.81.47.117:17796] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "192.64.150.84"] [uri "/.git/HEAD"] [unique_id "ah9aYDa37jh3oL6AVDsHVwAAAU4"] show less	Brute-Force Bad Web Bot Web App Attack
🇫🇷 dynamix	2026-06-02 21:53:56 (2 days ago)	Multiple WAF Violations	Web App Attack
🇺🇸 xmission.com	2026-06-02 21:17:06 (2 days ago)	Blocked by UFW (TCP on 2082) Source port: 16891 TTL: 48 Packet length: 60 TOS: 0x00 This report (fo ... show more Blocked by UFW (TCP on 2082) Source port: 16891 TTL: 48 Packet length: 60 TOS: 0x00 This report (for 20.81.47.117) was generated by: https://github.com/sefinek/UFW-AbuseIPDB-Reporter show less	Port Scan
🇬🇧 prime_fusion_ld	2026-06-02 21:00:56 (2 days ago)	Blocked by CSF/LFD on vps.primefusion.co.uk. Trigger: 1 Ports: *	Port Scan
🇬🇧 Apache	2026-06-02 20:07:03 (2 days ago)	(mod_security) mod_security (id:210492) triggered by 20.81.47.117 (US/United States/-): 5 in the las ... show more (mod_security) mod_security (id:210492) triggered by 20.81.47.117 (US/United States/-): 5 in the last 300 secs (CF_ENABLE) show less	Brute-Force Web App Attack
🇺🇸 xmission.com	2026-06-02 19:54:50 (2 days ago)	Blocked by UFW (TCP on 2087) Source port: 16717 TTL: 48 Packet length: 60 TOS: 0x00 This report (fo ... show more Blocked by UFW (TCP on 2087) Source port: 16717 TTL: 48 Packet length: 60 TOS: 0x00 This report (for 20.81.47.117) was generated by: https://github.com/sefinek/UFW-AbuseIPDB-Reporter show less	Port Scan
🇫🇷 sthoyer.de	2026-06-02 19:53:35 (2 days ago)	Jun 2 21:53:33 sthoyer kernel: [IPTables-Dropped-I] IN=eth0 OUT= MAC=00:50:56:43:00:af:c0:69:11:cd: ... show more Jun 2 21:53:33 sthoyer kernel: [IPTables-Dropped-I] IN=eth0 OUT= MAC=00:50:56:43:00:af:c0:69:11:cd:10:f7:08:00 SRC=20.81.47.117 DST=173.212.223.67 LEN=60 TOS=0x00 PREC=0x00 TTL=49 ID=24973 DF PROTO=TCP SPT=16669 DPT=2087 WINDOW=64240 RES=0x00 SYN URGP=0 Jun 2 21:53:33 sthoyer kernel: [IPTables-Dropped-I] IN=eth0 OUT= MAC=00:50:56:43:00:af:c0:69:11:cd:10:f7:08:00 SRC=20.81.47.117 DST=173.212.223.67 LEN=60 TOS=0x00 PREC=0x00 TTL=50 ID=20362 DF PROTO=TCP SPT=16679 DPT=2082 WINDOW=64240 RES=0x00 SYN URGP=0 Jun 2 21:53:33 sthoyer kernel: [IPTables-Dropped-I] IN=eth0 OUT= MAC=00:50:56:43:00:af:c0:69:11:cd:10:f7:08:00 SRC=20.81.47.117 DST=173.212.223.67 LEN=60 TOS=0x00 PREC=0x00 TTL=49 ID=59369 DF PROTO=TCP SPT=16653 DPT=8443 WINDOW=64240 RES=0x00 SYN URGP=0 Jun 2 21:53:33 sthoyer kernel: [IPTables-Dropped-I] IN=eth0 OUT= MAC=00:50:56:43:00:af:c0:69:11:cd:10:f7:08:00 SRC=20.81.47.117 DST=173.212.223.67 LEN=60 TOS=0x00 PREC=0x00 TTL=50 ID=27207 DF PROTO=TCP SPT=16705 DPT=2086 WINDOW=642 ... show less	Port Scan
🇳🇱 BIV	2026-06-02 19:40:18 (2 days ago)	Honeypot multi-source hit. Sources: dshield:fw,tpot:P0f,tpot:Suricata. Ports: 2082,2083,2086,2087,44 ... show more Honeypot multi-source hit. Sources: dshield:fw,tpot:P0f,tpot:Suricata. Ports: 2082,2083,2086,2087,443,80,8080,8443. Automated tiered (T-Pot+DShield). show less	Port Scan Hacking Bad Web Bot
🇵🇱 webadmin	2026-06-02 19:02:25 (2 days ago)		Web App Attack

Showing 1 to 15 of 30 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇮🇪 2a05:d018:bb5:3301:61d2:e649:a23c:f71d

🇪🇸 217.160.226.51

🇳🇱 93.123.109.62

🇸🇬 47.84.110.6

🇺🇸 2607:ff10:c8:594::c

🇺🇸 2607:f8b0:4001:c0c::124

🇹🇷 176.88.31.138

🇺🇸 162.216.150.203

🇺🇸 162.216.149.213

🇮🇳 139.59.22.90

🇺🇸 64.23.217.64

🇲🇾 47.250.89.132

🇬🇧 35.203.211.186

🇺🇸 20.65.194.57

🇹🇷 5.11.221.119

🇧🇷 205.210.31.180

🇳🇱 193.176.31.229

🇳🇱 176.65.148.189

🇺🇸 165.232.137.226

🇨🇦 159.89.112.64