JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 20.97.196.162

20.97.196.162 was found in our database!

This IP was reported 24 times. Confidence of Abuse is 58%: ?

58%

ISP	Microsoft Corporation
Usage Type	Data Center/Web Hosting/Transit
ASN	AS8075
Domain Name	microsoft.com
Country	🇺🇸 United States of America
City	Boydton, Virginia

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 20.97.196.162

Whois 20.97.196.162

IP Abuse Reports for 20.97.196.162:

This IP address has been reported a total of 24 times from 18 distinct sources. 20.97.196.162 was first reported on March 21st 2026, and the most recent report was 8 hours ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇫🇷 sthoyer.de	2026-06-14 21:33:28 (8 hours ago)	Jun 14 23:33:26 sthoyer kernel: [IPTables-Dropped-I] IN=eth0 OUT= MAC=00:50:56:43:00:af:c0:69:11:cd: ... show more Jun 14 23:33:26 sthoyer kernel: [IPTables-Dropped-I] IN=eth0 OUT= MAC=00:50:56:43:00:af:c0:69:11:cd:10:f7:08:00 SRC=20.97.196.162 DST=173.212.223.67 LEN=60 TOS=0x00 PREC=0x00 TTL=50 ID=11606 DF PROTO=TCP SPT=60483 DPT=2078 WINDOW=64240 RES=0x00 SYN URGP=0 Jun 14 23:33:26 sthoyer kernel: [IPTables-Dropped-I] IN=eth0 OUT= MAC=00:50:56:43:00:af:c0:69:11:cd:10:f7:08:00 SRC=20.97.196.162 DST=173.212.223.67 LEN=60 TOS=0x00 PREC=0x00 TTL=50 ID=62980 DF PROTO=TCP SPT=60481 DPT=2083 WINDOW=64240 RES=0x00 SYN URGP=0 Jun 14 23:33:26 sthoyer kernel: [IPTables-Dropped-I] IN=eth0 OUT= MAC=00:50:56:43:00:af:c0:69:11:cd:10:f7:08:00 SRC=20.97.196.162 DST=173.212.223.67 LEN=60 TOS=0x00 PREC=0x00 TTL=49 ID=48930 DF PROTO=TCP SPT=60484 DPT=2082 WINDOW=64240 RES=0x00 SYN URGP=0 Jun 14 23:33:26 sthoyer kernel: [IPTables-Dropped-I] IN=eth0 OUT= MAC=00:50:56:43:00:af:c0:69:11:cd:10:f7:08:00 SRC=20.97.196.162 DST=173.212.223.67 LEN=60 TOS=0x00 PREC=0x00 TTL=50 ID=31892 DF PROTO=TCP SPT=60481 DPT=2086 WINDOW ... show less	Port Scan
🇺🇸 Axel	2026-06-14 20:04:22 (9 hours ago)	Blocked by UFW on MVI [2078/tcp] \| SPT: 60433 \| TTL: 48 \| LEN: 60 \| TOS: 0x00 • Reported by: github. ... show more Blocked by UFW on MVI [2078/tcp] \| SPT: 60433 \| TTL: 48 \| LEN: 60 \| TOS: 0x00 • Reported by: github.com/sefinek/UFW-AbuseIPDB-Reporter show less	Port Scan
🇩🇪 centurion	2026-06-14 19:58:36 (9 hours ago)	Blocked by UFW on ns02 [2078/tcp] Source port: 60438 TTL: 45 Packet length: 60 TOS: 0x00 This repor ... show more Blocked by UFW on ns02 [2078/tcp] Source port: 60438 TTL: 45 Packet length: 60 TOS: 0x00 This report was generated by: https://github.com/sefinek/UFW-AbuseIPDB-Reporter show less	Port Scan
🇫🇮 Kimmo Rieskaniemi	2026-06-14 18:21:23 (11 hours ago)	CrowdSec triggered crowdsecurity/http-sensitive-files	Web App Attack Hacking
🇷🇴 abuse_IP_reporter	2026-06-14 17:45:14 (12 hours ago)	Jun 14 19:46:33 server UFW BLOCK SRC=20.97.196.162 DF PROTO=TCP SPT=60432	Port Scan
🇺🇸 MPL	2026-06-14 17:12:19 (12 hours ago)	tcp port scan (20 or more attempts)	Port Scan
🇯🇵 demonsword	2026-06-06 14:02:55 (1 week ago)	Detected by SentinelX honeypot: sent HTTP CONNECT request probing for an open proxy. Connection was ... show more Detected by SentinelX honeypot: sent HTTP CONNECT request probing for an open proxy. Connection was hijacked and held in a tarpit to slow down the scan. Probed target: load.vmheaven.io:443 show less	Open Proxy Port Scan
🇺🇸 mw	2026-05-24 00:00:38 (3 weeks ago)	GET /poc.jsp?cmd=cat+%2Fetc%2Fpasswd HTTP/1.1	Web App Attack
Anonymous	2026-05-20 21:15:25 (3 weeks ago)	(PERMBLOCK) 20.97.196.162 (US/United States/-) has had more than 4 temp blocks in the last 86400 sec ... show more (PERMBLOCK) 20.97.196.162 (US/United States/-) has had more than 4 temp blocks in the last 86400 secs; Ports: *; Direction: inout; Trigger: LF_PERMBLOCK_COUNT; Logs: show less	Port Scan
Anonymous	2026-05-20 19:45:52 (3 weeks ago)	(caddyscan) Scanner path probe from 20.97.196.162 (US/United States/-): 5 in the last 3600 secs; Por ... show more (caddyscan) Scanner path probe from 20.97.196.162 (US/United States/-): 5 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: [REDACTED] 200 2627 20.97.196.162 - - [20/May/2026:19:45:50 +0000] "GET /config/.env HTTP/1.1" [REDACTED] 200 2627 20.97.196.162 - - [20/May/2026:19:45:50 +0000] "GET /.git/config HTTP/1.1" [REDACTED] 200 2627 20.97.196.162 - - [20/May/2026:19:45:50 +0000] "GET /.env HTTP/1.1" [REDACTED] 200 2627 20.97.196.162 - - [20/May/2026:19:45:50 +0000] "GET /.env HTTP/1.1" [REDACTED] 200 2627 20.97.196.162 - - [20/May/2026:19:45:50 +0000] "GET /@fs/.git/config?import&raw HTTP/1.1" show less	Port Scan
🇺🇸 TPI-Abuse	2026-05-20 17:58:20 (3 weeks ago)	(mod_security) mod_security (id:210492) triggered by 20.97.196.162 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:210492) triggered by 20.97.196.162 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed May 20 13:58:13.391669 2026] [security2:error] [pid 18300:tid 18300] [client 20.97.196.162:0] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "eddysgroup.com"] [uri "/config/.env"] [unique_id "ag32NUZVuRPHIfVJMhfcQQAAAAU"] show less	Brute-Force Bad Web Bot Web App Attack
Anonymous	2026-05-20 17:50:34 (3 weeks ago)	(caddyscan) Scanner path probe from 20.97.196.162 (US/United States/-): 5 in the last 3600 secs; Por ... show more (caddyscan) Scanner path probe from 20.97.196.162 (US/United States/-): 5 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: [REDACTED] 200 2627 20.97.196.162 - - [20/May/2026:17:50:30 +0000] "GET /config/.env HTTP/1.1" [REDACTED] 200 2627 20.97.196.162 - - [20/May/2026:17:50:30 +0000] "GET /.git/config HTTP/1.1" [REDACTED] 200 2627 20.97.196.162 - - [20/May/2026:17:50:30 +0000] "GET /.env HTTP/1.1" [REDACTED] 200 2627 20.97.196.162 - - [20/May/2026:17:50:30 +0000] "GET /.env HTTP/1.1" [REDACTED] 200 2627 20.97.196.162 - - [20/May/2026:17:50:31 +0000] "GET /@fs/.git/config?import&raw HTTP/1.1" show less	Port Scan
Anonymous	2026-05-20 16:57:53 (3 weeks ago)	(caddyscan) Scanner path probe from 20.97.196.162 (US/United States/-): 5 in the last 3600 secs; Por ... show more (caddyscan) Scanner path probe from 20.97.196.162 (US/United States/-): 5 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: [REDACTED] 200 2627 20.97.196.162 - - [20/May/2026:16:57:52 +0000] "GET /.git/config HTTP/1.1" [REDACTED] 200 2627 20.97.196.162 - - [20/May/2026:16:57:52 +0000] "GET /.env HTTP/1.1" [REDACTED] 200 2627 20.97.196.162 - - [20/May/2026:16:57:52 +0000] "GET /.env HTTP/1.1" [REDACTED] 200 2627 20.97.196.162 - - [20/May/2026:16:57:52 +0000] "GET /@fs/.git/config?import&raw HTTP/1.1" [REDACTED] 200 2627 20.97.196.162 - - [20/May/2026:16:57:52 +0000] "GET /@fs/.git/config?import?raw HTTP/1.1" show less	Port Scan
Anonymous	2026-05-20 15:38:26 (3 weeks ago)	(caddyscan) Scanner path probe from 20.97.196.162 (US/United States/-): 5 in the last 3600 secs; Por ... show more (caddyscan) Scanner path probe from 20.97.196.162 (US/United States/-): 5 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: [REDACTED] 200 2627 20.97.196.162 - - [20/May/2026:15:38:22 +0000] "GET /config/.env HTTP/1.1" [REDACTED] 200 2627 20.97.196.162 - - [20/May/2026:15:38:22 +0000] "GET /.git/config HTTP/1.1" [REDACTED] 200 2627 20.97.196.162 - - [20/May/2026:15:38:22 +0000] "GET /.env HTTP/1.1" [REDACTED] 200 2627 20.97.196.162 - - [20/May/2026:15:38:22 +0000] "GET /.env HTTP/1.1" [REDACTED] 200 2627 20.97.196.162 - - [20/May/2026:15:38:23 +0000] "GET /@fs/.git/config?import&raw HTTP/1.1" show less	Port Scan
🇮🇱 spd.co.il	2026-04-08 13:01:36 (2 months ago)	Web application attack detected	Hacking Web App Attack

Showing 1 to 15 of 24 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇺🇸 162.216.150.125

🇨🇳 159.75.115.184

🇮🇹 158.173.77.35

🇫🇷 75.119.130.133

🇫🇷 51.68.34.131

🇪🇬 41.128.181.199

🇸🇬 34.21.142.214

🇺🇸 20.55.87.129

🇮🇹 5.77.85.148

🇰🇷 211.253.37.225

🇱🇹 193.187.115.120

🇸🇬 192.161.55.151

🇧🇷 187.58.66.231

🇮🇹 158.173.77.29

🇭🇰 152.32.172.177

🇯🇵 123.222.108.7

🇺🇸 107.150.110.170

🇩🇪 91.98.134.147

🇳🇱 45.148.10.151

🇺🇸 216.218.206.87