JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 68.220.63.5

68.220.63.5 was found in our database!

This IP was reported 13 times. Confidence of Abuse is 40%: ?

40%

ISP	Microsoft Corporation
Usage Type	Data Center/Web Hosting/Transit
ASN	AS8075
Domain Name	microsoft.com
Country	🇺🇸 United States of America
City	San Jose, California

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 68.220.63.5

Whois 68.220.63.5

IP Abuse Reports for 68.220.63.5:

This IP address has been reported a total of 13 times from 11 distinct sources. 68.220.63.5 was first reported on January 6th 2026, and the most recent report was 1 week ago.

Old Reports: The most recent abuse report for this IP address is from 1 week ago . It is possible that this IP is no longer involved in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇦🇺 FEWA	2026-07-01 08:31:15 (1 week ago)	Fail2Ban Ban Triggered	Hacking Bad Web Bot Web App Attack
Anonymous	2026-07-01 04:12:49 (1 week ago)	Sensitive Configuration File Disclosure.	Hacking
🇯🇵 SentinalX by uzumaru	2026-06-19 09:03:55 (3 weeks ago)	Detected by SentinelX honeypot: sent HTTP CONNECT request probing for an open proxy. Connection was ... show more Detected by SentinelX honeypot: sent HTTP CONNECT request probing for an open proxy. Connection was hijacked and held in a tarpit to slow down the scan. Probed target: ptlogin.4399.com:443 show less	Open Proxy Port Scan
🇷🇸 Scan	2026-06-15 00:48:21 (3 weeks ago)	MultiHost/MultiPort Probe, Scan, Hack -	Port Scan Hacking
🇺🇸 TPI-Abuse	2026-06-14 23:03:38 (3 weeks ago)	(mod_security) mod_security (id:210492) triggered by 68.220.63.5 (-): 1 in the last 300 secs; Ports: ... show more (mod_security) mod_security (id:210492) triggered by 68.220.63.5 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Jun 14 19:03:34.189337 2026] [security2:error] [pid 1406:tid 1406] [client 68.220.63.5:30787] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "192.64.150.171"] [uri "/.git/config"] [unique_id "ai8zRijK5JKgr3_uscUuFQAAAAs"] show less	Brute-Force Bad Web Bot Web App Attack
🇹🇷 Threat.live	2026-06-14 22:40:03 (3 weeks ago)	Suspicious Connection Attempts	Brute-Force
🇺🇸 Hulk Smash	2026-06-14 21:37:06 (3 weeks ago)	Automated report, webserver-auth troll for exploits and/or SSH Attempts	Brute-Force Hacking
🇫🇷 breubit	2026-06-14 21:14:41 (3 weeks ago)	68.220.63.5 - - [14/Jun/2026:23:14:41 +0200] "GET /.git/HEAD HTTP/1.1" 404 455 "-" "Mozilla/5.0 (Mac ... show more 68.220.63.5 - - [14/Jun/2026:23:14:41 +0200] "GET /.git/HEAD HTTP/1.1" 404 455 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_4_1) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.4 Safari/605.1.15" ... show less	Web App Attack
🇯🇵 knock	2026-06-14 20:46:04 (3 weeks ago)	Knock-Knock honeypot brute-force: proto8 (9 total hits)	Brute-Force
🇺🇸 TPI-Abuse	2026-06-14 18:34:21 (3 weeks ago)	(mod_security) mod_security (id:210492) triggered by 68.220.63.5 (-): 1 in the last 300 secs; Ports: ... show more (mod_security) mod_security (id:210492) triggered by 68.220.63.5 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Jun 14 14:34:18.558165 2026] [security2:error] [pid 11722:tid 11722] [client 68.220.63.5:30859] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "192.64.150.140"] [uri "/.git/HEAD"] [unique_id "ai70KlNOtlKKJ63ax0cfcQAAABs"] show less	Brute-Force Bad Web Bot Web App Attack
🇩🇪 Tamsy	2026-06-14 18:24:57 (3 weeks ago)	HTTPD - Web Application scripting attack	Web App Attack
🇦🇺 FEWA	2026-05-01 09:52:15 (2 months ago)	Fail2Ban Ban Triggered	Hacking Bad Web Bot Web App Attack
🇳🇱 donarev419	2026-01-06 20:23:30 (6 months ago)	Abused redis on 6379 2026-01-06T20:23:30Z server "+OK static.87.229.95.155.deluxhost.net Redis 7.0. ... show more Abused redis on 6379 2026-01-06T20:23:30Z server "+OK static.87.229.95.155.deluxhost.net Redis 7.0.5 " 2026-01-06T20:23:30Z client "info " 2026-01-06T20:23:31Z server "$94 # Server redis_version:7.0.5 os:Linux 6.8.0-90-generic x86_64 arch_bits:64 uptime_in_seconds:0 " 2026-01-06T20:23:31Z client "CONFIG GET dbfilename " 2026-01-06T20:23:31Z server "-ERR unknown command 'CONFIG' " 2026-01-06T20:23:32Z client "CONFIG GET dir " 2026-01-06T20:23:32Z server "-ERR unknown command 'CONFIG' " 2026-01-06T20:23:33Z client "CONFIG SET dir /root/.ssh/ " 2026-01-06T20:23:33Z server "-ERR unknown command 'CONFIG' " 2026-01-06T20:23:34Z client "CONFIG SET dir /var/spool/cron/ " 2026-01-06T20:23:34Z server "-ERR unknown command 'CONFIG' " 2026-01-06T20:23:35Z client "CONFIG SET dbfilename -ERR Unknown subcommand or wrong number of arguments for 'get'. Try CONFIG HELP. " 2026-01-06T20:23:35Z server "-ERR unknown command 'CONFIG' " 2026-01-06T20:23:36Z client "CONFIG SET dir -ERR Unknown subcommand or wrong numb show less	Port Scan Bad Web Bot

Showing 1 to 13 of 13 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇩🇪 193.124.20.237

🇹🇭 159.192.133.140

🇩🇴 152.167.107.133

🇨🇳 121.8.209.94

🇺🇸 91.230.168.127

🇮🇶 65.20.143.45

🇺🇸 47.89.228.114

🇺🇸 45.58.52.25

🇷🇴 2.57.122.150

🇩🇪 2a04:4e40:e000:0:232:cf29:9aa2:d54b

🇩🇪 2a04:4e40:e000:0:fa:f164:34dd:35ba

🇰🇷 211.37.174.180

🇳🇱 104.248.207.84

🇧🇩 103.127.176.34

🇳🇴 84.210.97.183

🇭🇳 45.238.141.14

🇰🇷 211.106.133.202

🇺🇸 198.98.62.211

🇧🇷 179.51.153.37

🇺🇦 176.105.201.235