JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 20.118.172.148

20.118.172.148 was found in our database!

This IP was reported 1,082 times. Confidence of Abuse is 100%: ?

100%

ISP	Microsoft Corporation
Usage Type	Data Center/Web Hosting/Transit
ASN	AS8075
Domain Name	microsoft.com
Country	🇺🇸 United States of America
City	Phoenix, Arizona

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 20.118.172.148

Whois 20.118.172.148

IP Abuse Reports for 20.118.172.148:

This IP address has been reported a total of 1,082 times from 555 distinct sources. 20.118.172.148 was first reported on March 4th 2022, and the most recent report was 22 minutes ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇩🇪 hchristo	2026-08-20 06:53:51 (22 minutes ago)	[Thu Aug 20 08:53:48.617716 2026] [proxy_fcgi:error] [pid 51575:tid 51631] [client 20.118.172.148:37 ... show more [Thu Aug 20 08:53:48.617716 2026] [proxy_fcgi:error] [pid 51575:tid 51631] [client 20.118.172.148:37210] AH01071: Got error 'Primary script unknown\n' [Thu Aug 20 08:53:49.035089 2026] [proxy_fcgi:error] [pid 51575:tid 51636] [client 20.118.172.148:37210] AH01071: Got error 'Primary script unknown\n' [Thu Aug 20 08:53:49.556499 2026] [proxy_fcgi:error] [pid 51575:tid 51633] [client 20.118.172.148:37210] AH01071: Got error 'Primary script unknown\n' [Thu Aug 20 08:53:50.442095 2026] [proxy_fcgi:error] [pid 51575:tid 51676] [client 20.118.172.148:37210] AH01071: Got error 'Primary script unknown\n' [Thu Aug 20 08:53:50.798332 2026] [proxy_fcgi:error] [pid 51575:tid 51667] [client 20.118.172.148:37210] AH01071: Got error 'Primary script unknown\n' ... show less	Brute-Force
Anonymous	2026-08-20 06:48:04 (28 minutes ago)	Bloqueado automaticamente por CrowdSec escenario crowdsecurity/http-probing	Brute-Force
🇦🇺 electronico	2026-08-20 06:41:23 (34 minutes ago)	20.118.172.148 - - [20/Aug/2026:17:41:20 +1100] "GET /wp-content/plugins/hellopress/wp_filemanager.p ... show more 20.118.172.148 - - [20/Aug/2026:17:41:20 +1100] "GET /wp-content/plugins/hellopress/wp_filemanager.php HTTP/1.1" 404 7393 "-" "-" 20.118.172.148 - - [20/Aug/2026:17:41:20 +1100] "GET /this_is_a_new_hello_world.php HTTP/1.1" 404 2049 "-" "-" 20.118.172.148 - - [20/Aug/2026:17:41:20 +1100] "GET /class-t.api.php HTTP/1.1" 404 2049 "-" "-" 20.118.172.148 - - [20/Aug/2026:17:41:20 +1100] "GET /zwso.php HTTP/1.1" 404 2049 "-" "-" 20.118.172.148 - - [20/Aug/2026:17:41:21 +1100] "GET /wp-admin/css/colors/blue/index.php HTTP/1.1" 404 2049 "-" "-" 20.118.172.148 - - [20/Aug/2026:17:41:21 +1100] "GET /class19.php HTTP/1.1" 404 2049 "-" "-" 20.118.172.148 - - [20/Aug/2026:17:41:21 +1100] "GET /class20.php HTTP/1.1" 404 2049 "-" "-" 20.118.172.148 - - [20/Aug/2026:17:41:22 +1100] "GET /admin.php?p= HTTP/1.1" 404 2049 "-" "-" 20.118.172.148 - - [20/Aug/2026:17:41:22 +1100] "GET /randkeyword.php HTTP/1.1" 404 2049 "-" "-" 20.118.172.148 - - [20/Aug/2026:17:41:22 +1100] "GET /fwe.php HTTP/1.1" 404 204 ... show less	Brute-Force Web App Attack
🇩🇪 Skyrider	2026-08-20 06:30:41 (45 minutes ago)	Nginx: HTTP 4xx probe/scan attempts. Automated fail2ban report.	Bad Web Bot Web App Attack
🇩🇪 Blexyel	2026-08-20 06:17:18 (58 minutes ago)	20.118.172.148 - - [20/Aug/2026:08:17:17 +0200] "GET /wp-includes/images/wp-login.php HTTP/1.1" 301 ... show more 20.118.172.148 - - [20/Aug/2026:08:17:17 +0200] "GET /wp-includes/images/wp-login.php HTTP/1.1" 301 162 "-" "-" ... show less	Brute-Force Web App Attack
🇩🇪 Jarda_H	2026-08-20 06:10:13 (1 hour ago)	php-url-scan Attack Detected	Hacking Web App Attack
🇺🇸 chrisj	2026-08-20 06:06:59 (1 hour ago)	[Thu Aug 20 06:06:57.335209 2026] [proxy_fcgi:error] [pid 1229827:tid 1229910] [client 20.118.172.14 ... show more [Thu Aug 20 06:06:57.335209 2026] [proxy_fcgi:error] [pid 1229827:tid 1229910] [client 20.118.172.148:27970] AH01071: Got error 'Primary script unknown' [Thu Aug 20 06:06:59.262402 2026] [proxy_fcgi:error] [pid 1229827:tid 1229915] [client 20.118.172.148:27970] AH01071: Got error 'Primary script unknown' [Thu Aug 20 06:06:59.358315 2026] [proxy_fcgi:error] [pid 1229827:tid 1229907] [client 20.118.172.148:27970] AH01071: Got error 'Primary script unknown' ... show less	Brute-Force
🇬🇷 setupgr	2026-08-20 05:57:46 (1 hour ago)	(mod_security) mod_security (id:1000001) triggered by 20.118.172.148 (US/United States/Arizona/Phoen ... show more (mod_security) mod_security (id:1000001) triggered by 20.118.172.148 (US/United States/Arizona/Phoenix/-/[AS8075 MICROSOFT-CORP-MSN-AS-BLOCK]): 1 in the last 86400 secs (CF_ENABLE); Ports: *; Direction: inout; Trigger: LF_MODSEC; Logs: [Thu Aug 20 08:57:45.314886 2026] [security2:error] [pid 2785:tid 2846] [remote 20.118.172.148:0] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/about.php" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec/modsec2.user.conf"] [line "103"] [id "1000001"] [msg "Bad file blocked: /images/images/about.php"] [severity "CRITICAL"] [tag "security"] [hostname "endoscope.center"] [uri "/images/images/about.php"] [unique_id "aoaXWatRku-Zr0msiyjjMwAB1A4"] show less	Port Scan
🇺🇸 chrisj	2026-08-20 05:46:53 (1 hour ago)	[Thu Aug 20 05:46:53.527765 2026] [proxy_fcgi:error] [pid 1229827:tid 1229885] [client 20.118.172.14 ... show more [Thu Aug 20 05:46:53.527765 2026] [proxy_fcgi:error] [pid 1229827:tid 1229885] [client 20.118.172.148:36228] AH01071: Got error 'Primary script unknown' [Thu Aug 20 05:46:53.609174 2026] [proxy_fcgi:error] [pid 1229827:tid 1229884] [client 20.118.172.148:36228] AH01071: Got error 'Primary script unknown' [Thu Aug 20 05:46:53.700269 2026] [proxy_fcgi:error] [pid 1229827:tid 1229882] [client 20.118.172.148:36228] AH01071: Got error 'Primary script unknown' ... show less	Brute-Force
🇪🇸 beats	2026-08-20 05:38:34 (1 hour ago)	Reported by CrowdSec	Brute-Force Bad Web Bot Web App Attack
🇱🇻 garmtech.com	2026-08-20 05:34:54 (1 hour ago)	Attempted access to sensitive endpoint (/wp-content/plugins/hellopress/wp_filemanager.php) detected. ... show more Attempted access to sensitive endpoint (/wp-content/plugins/hellopress/wp_filemanager.php) detected. Automated scan or unauthorized probing. show less	Web App Attack
🇩🇪 BlueWire Hosting	2026-08-20 05:32:47 (1 hour ago)	Suspicious HTTP(s) activity without a user agent provided	Bad Web Bot
🇺🇸 antlac1	2026-08-20 05:28:17 (1 hour ago)	crowdsecurity/http-wordpress-scan	Brute-Force Web App Attack
🇬🇧 openstrike.co.uk	2026-08-20 05:13:56 (2 hours ago)	152 attacks on PHP URLs, ACME URLs: GET /rh.php HTTP/1.1 GET /.well-known/acme-challenge/index.php H ... show more 152 attacks on PHP URLs, ACME URLs: GET /rh.php HTTP/1.1 GET /.well-known/acme-challenge/index.php HTTP/1.1 show less	Web App Attack
🇫🇮 albionfreemarket.com	2026-08-20 05:12:42 (2 hours ago)	20.118.172.148 - - [20/Aug/2026:05:12:40 +0000] "GET /cah.php HTTP/2.0" 403 555 "-" "Mozilla/5.0 (Wi ... show more 20.118.172.148 - - [20/Aug/2026:05:12:40 +0000] "GET /cah.php HTTP/2.0" 403 555 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 0.000 "-" "US" 20.118.172.148 - - [20/Aug/2026:05:12:41 +0000] "GET /files/index.php HTTP/2.0" 403 555 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 0.000 "-" "US" ... show less	Bad Web Bot Web App Attack

Showing 1 to 15 of 1082 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇫🇷 2400:cb00:532:1000:e1ca:97be:af0f:f32e

🇩🇪 213.209.159.25

🇧🇪 198.235.24.169

🇷🇺 194.190.87.166

🇦🇷 186.19.22.2

🇻🇳 116.99.172.160

🇮🇳 103.139.56.199

🇺🇸 65.49.1.22

🇰🇪 41.90.179.253

🇨🇳 39.105.64.243

🇺🇸 20.163.32.79

🇺🇸 207.90.244.12

🇺🇦 193.107.107.189

🇭🇰 156.225.1.70

🇨🇳 112.63.11.201

🇬🇧 88.97.219.3

🇨🇦 85.217.149.54

🇫🇷 85.217.140.49

🇺🇦 78.26.187.36

🇫🇮 62.204.14.234