JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

20.83.158.249

Neutral Activity

Abuse Confidence Score

0% Low Risk

29 reports

20 reporters · latest 3 months ago

ISP: Microsoft Corporation
Usage Type: Data Center/Web Hosting/Transit
ASN: AS8075
Domain Name: microsoft.com
Country: 🇺🇸 United States of America
City: Dulles Town Center, Virginia

ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report Whois

No reports in the last 60 days

20.83.158.249 has been reported 29 times. The most recent report is from 3 months ago.

The full history is preserved below and remains searchable. A 0% score reflects the absence of recent activity, but this is not a guarantee that earlier reports were invalid. Abuse confidence score decays, naturally, over time, when the abusive activity stops.

Abuse Reports

Export reports CSV

Total reports

29 from 20 distinct reporters

First reported

May 14th 2026

Most recent report

3 months ago

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇺🇸 TPI-Abuse	2026-08-03 13:32:10 UTC · (3 months ago)	(mod_security) mod_security (id:210492) triggered by 20.83.158.249 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Aug 03 09:32:06.303897 2026] [security2:error] [pid 21085:tid 21085] [client 20.83.158.249:39579] M ... show more (mod_security) mod_security (id:210492) triggered by 20.83.158.249 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Aug 03 09:32:06.303897 2026] [security2:error] [pid 21085:tid 21085] [client 20.83.158.249:39579] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "192.64.150.67"] [uri "/.git/HEAD"] [unique_id "anCYVgL0o4fN0utcXJfmFgAAAA0"] show less	Brute-Force Bad Web Bot Web App Attack
🇩🇪 anycast_ac	2026-08-03 12:59:00 UTC · (3 months ago)	[mirai-detector honeypot] Inbound attack against our honeypot on tcp/8443 (generic).	DDoS Attack IoT Targeted Brute-Force
🇺🇸 cwytech	2026-08-03 12:46:35 UTC · (3 months ago)	Fleet-wide ban from the Ghostfleet 👻. Triggered by scenario: cwy/pf-geofence-high.	Hacking
🇩🇪 anycast_ac	2026-08-03 12:43:23 UTC · (3 months ago)	[mirai-detector honeypot] Inbound attack against our honeypot on tcp/8080 (http). Commands captured: $	DDoS Attack IoT Targeted Brute-Force
🇧🇾 lns.bz	2026-08-03 12:21:43 UTC · (3 months ago)	Too many 404 requests [BY]	Web App Attack
🇺🇸 TPI-Abuse	2026-08-03 10:56:56 UTC · (3 months ago)	(mod_security) mod_security (id:210492) triggered by 20.83.158.249 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Aug 03 06:56:51.073225 2026] [security2:error] [pid 3583932:tid 3583934] [client 20.83.158.249:4047 ... show more (mod_security) mod_security (id:210492) triggered by 20.83.158.249 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Aug 03 06:56:51.073225 2026] [security2:error] [pid 3583932:tid 3583934] [client 20.83.158.249:40475] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "192.64.150.126"] [uri "/.git/HEAD"] [unique_id "anBz81IYu0OLS3hDmxpTtAAAAUA"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 IndigoRidge	2026-08-03 10:39:29 UTC · (3 months ago)	20.83.158.249 - - [03/Aug/2026:06:39:12 -0400] "GET /.git/config HTTP/1.1" 301 162 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_4_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36" 20.83.158.249 - - [03/Aug/2026:06:39:17 -040 ... show more 20.83.158.249 - - [03/Aug/2026:06:39:12 -0400] "GET /.git/config HTTP/1.1" 301 162 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_4_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36" 20.83.158.249 - - [03/Aug/2026:06:39:17 -0400] "GET /.env HTTP/1.1" 301 162 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36" 20.83.158.249 - - [03/Aug/2026:06:39:28 -0400] "GET /.aws/credentials HTTP/1.1" 301 162 "-" "Mozilla/5.0 (Linux; Android 14; Pixel 8) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Mobile Safari/537.36" ... show less	Web App Attack
🇺🇸 TPI-Abuse	2026-08-03 10:33:39 UTC · (3 months ago)	(mod_security) mod_security (id:210492) triggered by 20.83.158.249 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Aug 03 06:33:31.650483 2026] [security2:error] [pid 3787210:tid 3787210] [client 20.83.158.249:4053 ... show more (mod_security) mod_security (id:210492) triggered by 20.83.158.249 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Aug 03 06:33:31.650483 2026] [security2:error] [pid 3787210:tid 3787210] [client 20.83.158.249:40535] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "192.64.150.45"] [uri "/.git/HEAD"] [unique_id "anBue7Nj2TH22mOcYEajdwAAACk"] show less	Brute-Force Bad Web Bot Web App Attack
Anonymous	2026-08-03 10:25:10 UTC · (3 months ago)	denied traffic to a non-approved destination port. destination port 2087.	Port Scan
🇫🇷 dynamix	2026-08-03 09:54:32 UTC · (3 months ago)	Multiple WAF Violations	Web App Attack
🇺🇸 brantknudson.org	2026-08-03 09:36:10 UTC · (3 months ago)	Request path 'GET /.git/HEAD HTTP/1.1'	Web App Attack Hacking
🇺🇸 TPI-Abuse	2026-08-03 09:32:03 UTC · (3 months ago)	(mod_security) mod_security (id:210492) triggered by 20.83.158.249 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Aug 03 05:31:57.656962 2026] [security2:error] [pid 1711801:tid 1711801] [client 20.83.158.249:3994 ... show more (mod_security) mod_security (id:210492) triggered by 20.83.158.249 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Aug 03 05:31:57.656962 2026] [security2:error] [pid 1711801:tid 1711801] [client 20.83.158.249:39949] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "192.64.150.26"] [uri "/.git/HEAD"] [unique_id "anBgDbjO9_ALa8AFi9E5TwAAABM"] show less	Brute-Force Bad Web Bot Web App Attack
Anonymous	2026-08-03 09:27:31 UTC · (3 months ago)	20.83.158.249 detected on srv01	Port Scan
🇮🇹 VHosting	2026-07-31 23:30:04 UTC · (3 months ago)	Detected mail brute force attack from 4 different servers	Brute-Force
🇷🇸 Scan	2026-06-03 00:27:24 UTC · (5 months ago)	MultiHost/MultiPort Probe, Scan, Hack -	Port Scan Hacking

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown

Recently Reported IPs:

🇳🇱 195.178.110.76

🇧🇷 154.80.128.121

🇵🇱 2400:cb00:73:1000:ecc9:388c:58f2:4c49

🇨🇦 216.174.64.188

🇨🇳 202.111.183.254

🇲🇺 197.225.146.23

🇷🇴 193.46.255.86

🇮🇳 145.79.134.25

🇨🇦 144.217.61.131

🇵🇰 122.50.1.77

🇹🇼 114.44.244.184

🇧🇪 35.210.140.34

🇷🇺 5.254.240.233

🇮🇷 193.151.133.105

🇧🇬 193.24.211.219

🇪🇨 186.4.135.194

🇳🇱 140.150.22.230

🇵🇭 112.198.134.227

🇺🇸 98.81.135.89

🇵🇹 95.93.91.44