Dashboard›🇩🇪 Germany›20.170.17.213
ABUSE.MOM
THREAT REPORT

IP Threat Report
20.170.17.213

ABUSE.MOM — BEHAVE OR GET EXPOSED

Generated: 2026-09-13 13:14:28
First seen: 2026-08-03 19:04:26
Last seen: 2026-08-16 01:04:18
280

⛔ Verdict: BLOCK

This IP address has been classified as a source of malicious automated activity. Threat score: 280/100. Total malicious requests observed: 19005.

BURSTDANGER_PATHRATIO_404REDIRECT_PROBEUA_SUS
01

Geolocation & Classification

IP Address
20.170.17.213
Type
Hosting
Country
🇩🇪 Germany
City
Frankfurt am Main
ISP
Microsoft Corporation
Organization
Microsoft Azure Cloud (germanywestcentral)
Autonomous System
AS8075 Microsoft Corporation
Hit Count
19005
02

Detection Signatures

SignatureDescriptionPointsSeverity
404 ratio 40-60%Majority of requests returned 404 — enumeration+15
404 ratio >= 60%Majority of requests returned 404 — enumeration+25
Burst 100/10sAbnormally fast request rate — automated scanning+35
Burst 107/10sAbnormally fast request rate — automated scanning+35
Burst 108/10sAbnormally fast request rate — automated scanning+35
Burst 109/10sAbnormally fast request rate — automated scanning+35
Burst 111/10sAbnormally fast request rate — automated scanning+35
Burst 112/10sAbnormally fast request rate — automated scanning+35
Burst 113/10sAbnormally fast request rate — automated scanning+35
Burst 114/10sAbnormally fast request rate — automated scanning+35
Burst 115/10sAbnormally fast request rate — automated scanning+35
Burst 117/10sAbnormally fast request rate — automated scanning+35
Burst 120/10sAbnormally fast request rate — automated scanning+35
Burst 121/10sAbnormally fast request rate — automated scanning+35
Burst 122/10sAbnormally fast request rate — automated scanning+35
Burst 123/10sAbnormally fast request rate — automated scanning+35
Burst 124/10sAbnormally fast request rate — automated scanning+35
Burst 125/10sAbnormally fast request rate — automated scanning+35
Burst 127/10sAbnormally fast request rate — automated scanning+35
Burst 128/10sAbnormally fast request rate — automated scanning+35
Burst 130/10sAbnormally fast request rate — automated scanning+35
Burst 131/10sAbnormally fast request rate — automated scanning+35
Burst 132/10sAbnormally fast request rate — automated scanning+35
Burst 133/10sAbnormally fast request rate — automated scanning+35
Burst 136/10sAbnormally fast request rate — automated scanning+35
Burst 137/10sAbnormally fast request rate — automated scanning+35
Burst 138/10sAbnormally fast request rate — automated scanning+35
Burst 141/10sAbnormally fast request rate — automated scanning+35
Burst 143/10sAbnormally fast request rate — automated scanning+35
Burst 148/10sAbnormally fast request rate — automated scanning+35
Burst 149/10sAbnormally fast request rate — automated scanning+35
Burst 150/10sAbnormally fast request rate — automated scanning+35
Burst 158/10sAbnormally fast request rate — automated scanning+35
Burst 16/10sAbnormally fast request rate — automated scanning+35
Burst 16/2sAbnormally fast request rate — automated scanning+35
Burst 160/10sAbnormally fast request rate — automated scanning+35
Burst 171/10sAbnormally fast request rate — automated scanning+35
Burst 18/10sAbnormally fast request rate — automated scanning+35
Burst 18/2sAbnormally fast request rate — automated scanning+35
Burst 196/10sAbnormally fast request rate — automated scanning+35
Burst 199/10sAbnormally fast request rate — automated scanning+35
Burst 200/10sAbnormally fast request rate — automated scanning+35
Burst 22/10sAbnormally fast request rate — automated scanning+35
Burst 22/2sAbnormally fast request rate — automated scanning+35
Burst 27/10sAbnormally fast request rate — automated scanning+35
Burst 27/2sAbnormally fast request rate — automated scanning+35
Burst 29/2sAbnormally fast request rate — automated scanning+35
Burst 30/10sAbnormally fast request rate — automated scanning+35
Burst 30/2sAbnormally fast request rate — automated scanning+35
Burst 31/2sAbnormally fast request rate — automated scanning+35
Burst 32/10sAbnormally fast request rate — automated scanning+35
Burst 32/2sAbnormally fast request rate — automated scanning+35
Burst 34/2sAbnormally fast request rate — automated scanning+35
Burst 35/2sAbnormally fast request rate — automated scanning+35
Burst 36/10sAbnormally fast request rate — automated scanning+35
Burst 36/2sAbnormally fast request rate — automated scanning+35
Burst 37/2sAbnormally fast request rate — automated scanning+35
Burst 38/2sAbnormally fast request rate — automated scanning+35
Burst 39/2sAbnormally fast request rate — automated scanning+35
Burst 40/2sAbnormally fast request rate — automated scanning+35
Burst 42/2sAbnormally fast request rate — automated scanning+35
Burst 43/2sAbnormally fast request rate — automated scanning+35
Burst 44/10sAbnormally fast request rate — automated scanning+35
Burst 44/2sAbnormally fast request rate — automated scanning+35
Burst 45/2sAbnormally fast request rate — automated scanning+35
Burst 46/2sAbnormally fast request rate — automated scanning+35
Burst 47/2sAbnormally fast request rate — automated scanning+35
Burst 48/10sAbnormally fast request rate — automated scanning+35
Burst 48/2sAbnormally fast request rate — automated scanning+35
Burst 49/2sAbnormally fast request rate — automated scanning+35
Burst 51/2sAbnormally fast request rate — automated scanning+35
Burst 52/2sAbnormally fast request rate — automated scanning+35
Burst 53/2sAbnormally fast request rate — automated scanning+35
Burst 54/2sAbnormally fast request rate — automated scanning+35
Burst 55/2sAbnormally fast request rate — automated scanning+35
Burst 56/2sAbnormally fast request rate — automated scanning+35
Burst 57/2sAbnormally fast request rate — automated scanning+35
Burst 58/2sAbnormally fast request rate — automated scanning+35
Burst 59/2sAbnormally fast request rate — automated scanning+35
Burst 60/10sAbnormally fast request rate — automated scanning+35
Burst 60/2sAbnormally fast request rate — automated scanning+35
Burst 61/2sAbnormally fast request rate — automated scanning+35
Burst 62/2sAbnormally fast request rate — automated scanning+35
Burst 63/2sAbnormally fast request rate — automated scanning+35
Burst 64/10sAbnormally fast request rate — automated scanning+35
Burst 64/2sAbnormally fast request rate — automated scanning+35
Burst 65/2sAbnormally fast request rate — automated scanning+35
Burst 66/10sAbnormally fast request rate — automated scanning+35
Burst 66/2sAbnormally fast request rate — automated scanning+35
Burst 73/2sAbnormally fast request rate — automated scanning+35
Burst 76/2sAbnormally fast request rate — automated scanning+35
Burst 77/2sAbnormally fast request rate — automated scanning+35
Burst 88/10sAbnormally fast request rate — automated scanning+35
Burst 96/10sAbnormally fast request rate — automated scanning+35
Burst 99/10sAbnormally fast request rate — automated scanning+35
Danger medium hits: 1Medium-risk: admin panels, config files+10
Danger medium hits: 100Medium-risk: admin panels, config files+60
Danger medium hits: 101Medium-risk: admin panels, config files+60
Danger medium hits: 1033Medium-risk: admin panels, config files+60
Danger medium hits: 108Medium-risk: admin panels, config files+60
Danger medium hits: 114Medium-risk: admin panels, config files+60
Danger medium hits: 128Medium-risk: admin panels, config files+60
Danger medium hits: 130Medium-risk: admin panels, config files+60
Danger medium hits: 131Medium-risk: admin panels, config files+60
Danger medium hits: 132Medium-risk: admin panels, config files+60
Danger medium hits: 144Medium-risk: admin panels, config files+60
Danger medium hits: 15Medium-risk: admin panels, config files+60
Danger medium hits: 150Medium-risk: admin panels, config files+60
Danger medium hits: 160Medium-risk: admin panels, config files+60
Danger medium hits: 18Medium-risk: admin panels, config files+60
Danger medium hits: 184Medium-risk: admin panels, config files+60
Danger medium hits: 192Medium-risk: admin panels, config files+60
Danger medium hits: 2Medium-risk: admin panels, config files+20
Danger medium hits: 20Medium-risk: admin panels, config files+60
Danger medium hits: 202Medium-risk: admin panels, config files+60
Danger medium hits: 21Medium-risk: admin panels, config files+60
Danger medium hits: 219Medium-risk: admin panels, config files+60
Danger medium hits: 221Medium-risk: admin panels, config files+60
Danger medium hits: 224Medium-risk: admin panels, config files+60
Danger medium hits: 252Medium-risk: admin panels, config files+60
Danger medium hits: 264Medium-risk: admin panels, config files+60
Danger medium hits: 27Medium-risk: admin panels, config files+60
Danger medium hits: 276Medium-risk: admin panels, config files+60
Danger medium hits: 284Medium-risk: admin panels, config files+60
Danger medium hits: 294Medium-risk: admin panels, config files+60
Danger medium hits: 296Medium-risk: admin panels, config files+60
Danger medium hits: 30Medium-risk: admin panels, config files+60
Danger medium hits: 308Medium-risk: admin panels, config files+60
Danger medium hits: 310Medium-risk: admin panels, config files+60
Danger medium hits: 316Medium-risk: admin panels, config files+60
Danger medium hits: 32Medium-risk: admin panels, config files+60
Danger medium hits: 326Medium-risk: admin panels, config files+60
Danger medium hits: 330Medium-risk: admin panels, config files+60
Danger medium hits: 334Medium-risk: admin panels, config files+60
Danger medium hits: 338Medium-risk: admin panels, config files+60
Danger medium hits: 36Medium-risk: admin panels, config files+60
Danger medium hits: 364Medium-risk: admin panels, config files+60
Danger medium hits: 370Medium-risk: admin panels, config files+60
Danger medium hits: 385Medium-risk: admin panels, config files+60
Danger medium hits: 386Medium-risk: admin panels, config files+60
Danger medium hits: 4Medium-risk: admin panels, config files+40
Danger medium hits: 40Medium-risk: admin panels, config files+60
Danger medium hits: 415Medium-risk: admin panels, config files+60
Danger medium hits: 416Medium-risk: admin panels, config files+60
Danger medium hits: 418Medium-risk: admin panels, config files+60
Danger medium hits: 42Medium-risk: admin panels, config files+60
Danger medium hits: 427Medium-risk: admin panels, config files+60
Danger medium hits: 428Medium-risk: admin panels, config files+60
Danger medium hits: 43Medium-risk: admin panels, config files+60
Danger medium hits: 442Medium-risk: admin panels, config files+60
Danger medium hits: 45Medium-risk: admin panels, config files+60
Danger medium hits: 454Medium-risk: admin panels, config files+60
Danger medium hits: 460Medium-risk: admin panels, config files+60
Danger medium hits: 479Medium-risk: admin panels, config files+60
Danger medium hits: 48Medium-risk: admin panels, config files+60
Danger medium hits: 50Medium-risk: admin panels, config files+60
Danger medium hits: 516Medium-risk: admin panels, config files+60
Danger medium hits: 52Medium-risk: admin panels, config files+60
Danger medium hits: 521Medium-risk: admin panels, config files+60
Danger medium hits: 58Medium-risk: admin panels, config files+60
Danger medium hits: 60Medium-risk: admin panels, config files+60
Danger medium hits: 63Medium-risk: admin panels, config files+60
Danger medium hits: 64Medium-risk: admin panels, config files+60
Danger medium hits: 65Medium-risk: admin panels, config files+60
Danger medium hits: 66Medium-risk: admin panels, config files+60
Danger medium hits: 72Medium-risk: admin panels, config files+60
Danger medium hits: 74Medium-risk: admin panels, config files+60
Danger medium hits: 80Medium-risk: admin panels, config files+60
Danger medium hits: 84Medium-risk: admin panels, config files+60
Danger medium hits: 90Medium-risk: admin panels, config files+60
Danger medium hits: 94Medium-risk: admin panels, config files+60
Danger medium hits: 96Medium-risk: admin panels, config files+60
Danger medium hits: 98Medium-risk: admin panels, config files+60
Danger strong hits: 1High-risk paths: shells, RCE vectors, exploits+25
Danger strong hits: 10High-risk paths: shells, RCE vectors, exploits+100
Danger strong hits: 11High-risk paths: shells, RCE vectors, exploits+100
Danger strong hits: 12High-risk paths: shells, RCE vectors, exploits+100
Danger strong hits: 122High-risk paths: shells, RCE vectors, exploits+100
Danger strong hits: 124High-risk paths: shells, RCE vectors, exploits+100
Danger strong hits: 14High-risk paths: shells, RCE vectors, exploits+100
Danger strong hits: 148High-risk paths: shells, RCE vectors, exploits+100
Danger strong hits: 15High-risk paths: shells, RCE vectors, exploits+100
Danger strong hits: 16High-risk paths: shells, RCE vectors, exploits+100
Danger strong hits: 18High-risk paths: shells, RCE vectors, exploits+100
Danger strong hits: 183High-risk paths: shells, RCE vectors, exploits+100
Danger strong hits: 186High-risk paths: shells, RCE vectors, exploits+100
Danger strong hits: 189High-risk paths: shells, RCE vectors, exploits+100
Danger strong hits: 192High-risk paths: shells, RCE vectors, exploits+100
Danger strong hits: 2High-risk paths: shells, RCE vectors, exploits+50
Danger strong hits: 20High-risk paths: shells, RCE vectors, exploits+100
Danger strong hits: 21High-risk paths: shells, RCE vectors, exploits+100
Danger strong hits: 22High-risk paths: shells, RCE vectors, exploits+100
Danger strong hits: 24High-risk paths: shells, RCE vectors, exploits+100
Danger strong hits: 241High-risk paths: shells, RCE vectors, exploits+100
Danger strong hits: 244High-risk paths: shells, RCE vectors, exploits+100
Danger strong hits: 27High-risk paths: shells, RCE vectors, exploits+100
Danger strong hits: 273High-risk paths: shells, RCE vectors, exploits+100
Danger strong hits: 3High-risk paths: shells, RCE vectors, exploits+75
Danger strong hits: 30High-risk paths: shells, RCE vectors, exploits+100
Danger strong hits: 31High-risk paths: shells, RCE vectors, exploits+100
Danger strong hits: 37High-risk paths: shells, RCE vectors, exploits+100
Danger strong hits: 4High-risk paths: shells, RCE vectors, exploits+100
Danger strong hits: 6High-risk paths: shells, RCE vectors, exploits+100
Danger strong hits: 7High-risk paths: shells, RCE vectors, exploits+100
Danger strong hits: 8High-risk paths: shells, RCE vectors, exploits+100
Danger strong hits: 9High-risk paths: shells, RCE vectors, exploits+100
Danger strong hits: 96High-risk paths: shells, RCE vectors, exploits+100
Probe 302→404Behavioral anomaly detected by automated analysis+20
UA suspiciousBehavioral anomaly detected by automated analysis+15
Σ = 11150
03

Observed Activity

Reconstructed HTTP requests from server access logs. Target domains redacted for security.

[redacted]
GET
/
200
[redacted]
GET
/page
200
Requests shown: 2 · HTTP 404: 0 · Dangerous patterns: 0

* Typical request patterns for detected signatures. Actual target domains are redacted.

04

Timeline

2026-08-03 19:04:26
First malicious request detected
IP entered monitoring from server access logs
During observation
Multiple detection signatures triggered
404 ratio 40-60% (+15), 404 ratio >= 60% (+25), Burst 100/10s (+35)
2026-08-16 01:04:18
Last malicious request observed
Total score reached: 280/100
Next cycle
IP blocked — all subsequent requests denied (HTTP 403)
Added to blocklist automatically
05

Network Provider

Microsoft Corporation
AS8075 · 🇩🇪 Germany
06

Recommendations

Actions taken & recommended

  • IP 20.170.17.213 is blocked at application level (HTTP 403)
  • Consider blocking at firewall level (iptables/CSF) to reduce server load
  • Report abuse to the network provider via their abuse contact
  • Ensure sensitive files (.env, .git, backups) are not accessible from the web

🔎 Path Enumeration Protection

Block scanning from 20.170.17.213: rate-limit 404 responses per IP, deploy a honeypot 404 page, ensure no backup files are web-accessible.

🌊 Flood / DDoS Mitigation

Implement limit_req_zone in nginx. Deploy CDN with DDoS protection. Configure SYN cookies and connection tracking to throttle 20.170.17.213.

🤖 Bot Detection

Address UA spoofing from 20.170.17.213: maintain blocklist of known malicious UA strings, require consistent UA across sessions, implement TLS fingerprinting.

09

Blacklist Status (DNSBL)

This IP was checked against major DNS-based blacklists used by mail servers and firewalls worldwide.

✓ Clean
dnsbl.dronebl.org
✓ Clean
b.barracudacentral.org
✓ Clean
cbl.abuseat.org
✓ Clean
psbl.surriel.com
✓ Clean
zen.spamhaus.org
✓ Clean
bl.blocklist.de
✓ Clean
spam.dnsbl.sorbs.net

Checked: Spamhaus, SpamCop, Barracuda, SORBS, CBL, UCEProtect. Results may change over time.

10

Threat Analysis

20.170.17.213 has been assigned a threat score of 280/100 (Critical). With this rating, the IP falls into the critical severity bracket — among the most dangerous addresses in our monitoring database.

The following attack categories were identified:

Path EnumerationRequest FloodingUser-Agent Anomaly

📊 Threat Analysis

Our monitoring infrastructure has identified 20.170.17.213, geolocated to Frankfurt am Main, Germany, operating on the network of Microsoft Corporation, as a source of suspicious network activity. The address has been active for 12 days in our monitoring system, producing 19,005 flagged requests at a rate of ~1583.8/day. This address belongs to a datacenter or cloud hosting provider. Hosting IPs are frequently leveraged by threat actors who rent cheap VPS instances specifically for conducting attacks. The combination of 3 distinct attack vectors indicates a sophisticated, multi-pronged threat actor deploying automated tools that probe multiple attack surfaces simultaneously. Germany currently accounts for 105 blocked IPs in our database, making it a significant source of malicious traffic. With a threat score of 280/100, this IP is among the most dangerous addresses in our database. Immediate and complete blocking is strongly recommended.

This IP belongs to a hosting or data center provider. Malicious traffic from hosting infrastructure often originates from compromised VPS instances, rented servers used for scanning campaigns, or abused free-tier cloud accounts. Hosting providers typically respond to abuse reports within 24-72 hours.

11

Related Threats

🇩🇪 Top threats from Germany

15.220.152.241 (320)35.246.204.221 (320)159.100.30.125 (318)185.168.29.98 (313)77.81.65.244 (313)View all →

🏢 Same network: AS8075

20.52.136.55 (280)20.218.119.12 (280)20.52.132.62 (280)20.113.56.22 (280)51.116.238.8 (280)View all →
12

Security Intelligence

💡 DDoS Mitigation Approaches

Distributed denial of service attacks overwhelm infrastructure with traffic volume. Effective mitigation combines always-on traffic scrubbing, anycast network distribution, rate limiting, and the ability to quickly scale absorption capacity during attacks.

💡 Data Center IP Reputation

IPs originating from data centers and hosting providers account for a disproportionate amount of malicious traffic. Compromised VPS instances, bulletproof hosting, and abused trial accounts create persistent attack infrastructure that can be difficult to shut down.

🔍 Check Any IP Address

Share this report:
AboutDisclaimerTermsAbuse Reports Tracker
Report generated 13.09.2026 13:14
Behave or get exposed