JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 20.220.189.161

20.220.189.161 was found in our database!

This IP was reported 415 times. Confidence of Abuse is 100%: ?

100%

ISP	Microsoft Corporation
Usage Type	Data Center/Web Hosting/Transit
ASN	AS8075
Domain Name	microsoft.com
Country	🇨🇦 Canada
City	Toronto, Ontario

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 20.220.189.161

Whois 20.220.189.161

IP Abuse Reports for 20.220.189.161:

This IP address has been reported a total of 415 times from 241 distinct sources. 20.220.189.161 was first reported on August 21st 2026, and the most recent report was 5 minutes ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇫🇮 albionfreemarket.com	2026-08-24 18:36:40 (5 minutes ago)	20.220.189.161 - - [24/Aug/2026:18:36:38 +0000] "GET /cah.php HTTP/2.0" 403 555 "-" "Mozilla/5.0 (Wi ... show more 20.220.189.161 - - [24/Aug/2026:18:36:38 +0000] "GET /cah.php HTTP/2.0" 403 555 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 0.000 "-" "CA" 20.220.189.161 - - [24/Aug/2026:18:36:38 +0000] "GET /files/index.php HTTP/2.0" 403 555 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 0.000 "-" "CA" ... show less	Bad Web Bot Web App Attack
🇵🇱 lns.bz	2026-08-24 18:22:25 (20 minutes ago)	Too many 404 requests [BY]	Web App Attack
🇫🇷 giulio gorobey	2026-08-24 18:10:18 (32 minutes ago)	[Drupal AbuseIPDB module] Request path is blacklisted. /wp-includes/block-supports	Web App Attack
🇭🇺 kranem	2026-08-24 18:00:45 (41 minutes ago)	Triggered Cloudflare WAF from CA. Action taken: BLOCK ASN: 8075 (Microsoft Corporation) Protocol: HT ... show more Triggered Cloudflare WAF from CA. Action taken: BLOCK ASN: 8075 (Microsoft Corporation) Protocol: HTTP/1.1 (GET method) Endpoint: / Timestamp: 2026-08-24T17:14:32Z User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 show less	Bad Web Bot
Anonymous	2026-08-24 17:56:43 (45 minutes ago)	20.220.189.161 - - [24/Aug/2026:19:56:32 +0200] "GET /cah.php HTTP/1.1" 404 28619 20.220.189.161 - - ... show more 20.220.189.161 - - [24/Aug/2026:19:56:32 +0200] "GET /cah.php HTTP/1.1" 404 28619 20.220.189.161 - - [24/Aug/2026:19:56:33 +0200] "GET /images/images/about.php HTTP/1.1" 404 28620 20.220.189.161 - - [24/Aug/2026:19:56:34 +0200] "GET /222.php HTTP/1.1" 404 28620 20.220.189.161 - - [24/Aug/2026:19:56:35 +0200] "GET /classwithtostring.php HTTP/1.1" 404 28620 20.220.189.161 - - [24/Aug/2026:19:56:36 +0200] "GET /lock360.php HTTP/1.1" 404 28620 20.220.189.161 - - [24/Aug/2026:19:56:37 +0200] "GET /up.php HTTP/1.1" 404 28619 20.220.189.161 - - [24/Aug/2026:19:56:38 +0200] "GET /admin.php HTTP/1.1" 404 28620 20.220.189.161 - - [24/Aug/2026:19:56:39 +0200] "GET /chosen.php HTTP/1.1" 404 28619 20.220.189.161 - - [24/Aug/2026:19:56:40 +0200] "GET /inputs.php HTTP/1.1" 404 28619 20.220.189.161 - - [24/Aug/2026:19:56:40 +0200] "GET /o.php HTTP/1.1" 404 28619 ... show less	Web Spam Web App Attack
🇦🇹 penguin-solutions.at	2026-08-24 17:55:18 (47 minutes ago)	Excessive 403/404 errors ...	Brute-Force Web App Attack
🇩🇪 macrob	2026-08-24 17:33:25 (1 hour ago)	2026/08/24 17:33:23 [error] 470054#470054: 516046090 access forbidden by rule, client: 20.220.189.1 ... show more 2026/08/24 17:33:23 [error] 470054#470054: 516046090 access forbidden by rule, client: 20.220.189.161, server: binixo.ro, request: "GET /wp-includes/block-supports/ HTTP/2.0", host: "binixo.ro" 2026/08/24 17:33:24 [error] 470054#470054: 516033730 access forbidden by rule, client: 20.220.189.161, server: binixo.ro, request: "GET /wp-includes/images/ HTTP/2.0", host: "binixo.ro" 2026/08/24 17:33:24 [error] 470051#470051: 516045699 access forbidden by rule, client: 20.220.189.161, server: binixo.ro, request: "GET /wp-content/index.php HTTP/2.0", host: "binixo.ro" ... show less	Web App Attack
🇺🇸 koinkash.org	2026-08-24 16:51:29 (1 hour ago)	They are fraudulent. Malicious threat actor requesting php file /cah.php	Web App Attack
🇩🇪 conseilgouz	2026-08-24 16:33:31 (2 hours ago)	ece-7 : Trying access unauthorized files/dir=>/wp-includes/block-supports/	Hacking
🇫🇷 sthoyer.de	2026-08-24 16:19:54 (2 hours ago)	20.220.189.161 - - [24/Aug/2026:18:19:52 +0200] "GET /cah.php HTTP/1.1" 302 495 "-" "Mozilla/5.0 (Wi ... show more 20.220.189.161 - - [24/Aug/2026:18:19:52 +0200] "GET /cah.php HTTP/1.1" 302 495 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.220.189.161 - - [24/Aug/2026:18:19:52 +0200] "GET /files/index.php HTTP/1.1" 302 495 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.220.189.161 - - [24/Aug/2026:18:19:52 +0200] "GET /wp-includes/block-supports/ HTTP/1.1" 302 495 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" ... show less	Web App Attack
🇺🇸 WellSpring	2026-08-24 16:18:10 (2 hours ago)	Automated probe detected by Ody Sentinel / WellSpr.ing. Type: wordpress_includes. Path: /wp-includes ... show more Automated probe detected by Ody Sentinel / WellSpr.ing. Type: wordpress_includes. Path: /wp-includes/block-supports/. Auto-blocked after threshold exceeded. Dossier: https://wellspr.ing/dossier/sentinel-20-220-189-161 show less	Web App Attack
🇹🇷 oalver	2026-08-24 16:15:03 (2 hours ago)	Detected by SiberKapan threat intelligence platform (siberkapan.org). Attack types: nginx_path_signa ... show more Detected by SiberKapan threat intelligence platform (siberkapan.org). Attack types: nginx_path_signature, nginx_rate_flood, nginx_404_flood. Sources: nginx. Details: path_signature: request to /wp-admin/css/colors/index.php (HTTP 404); 404_flood: 10 requests to /classwithtostring.php (HTTP 404) within 60s; rate_flood: 30 requests to /adminfuns.php (HTTP 404) within 10s. First seen: 2026-08-22. Risk score: 100/100. show less	Web App Attack
Anonymous	2026-08-24 15:56:14 (2 hours ago)	Fail2Ban wordpress-forbidden on Security-Instance. Persistent malicious activity detected. Evidence: ... show more Fail2Ban wordpress-forbidden on Security-Instance. Persistent malicious activity detected. Evidence: 2026/08/24 17:56:12 [error] 4177#4177: 7220 directory index of "/var/www/html/wordpress_main/wp-includes/block-supports/" is forbidden, client: 20.220.189.161, server: dtalens.com, request: "GET /wp-includes/block-supports/ HTTP/1.1", host: "dtalens.com" 2026/08/24 17:56:12 [error] 4177#4177: 7220 directory index of "/var/www/html/wordpress_main/wp-includes/images/" is forbidden, client: 20.220.189.161, server: dtalens.com, request: "GET /wp-includes/images/ HTTP/1.1", host: "dtalens.com" 2026/08/24 17:56:12 [error] 4177#4177: *7220 directory index of "/var/www/html/wordpress_main/wp-includes/images/smilies/" is forbidden, client: 20.220.189.161, server: dtalens.com, request: "GET /wp-inc show less	Hacking Web App Attack
🇵🇱 strefapi_com	2026-08-24 15:14:11 (3 hours ago)	Brute-force, web ...	Hacking Brute-Force Web App Attack
🇩🇪 macrob	2026-08-24 15:11:33 (3 hours ago)	2026/08/24 15:11:31 [error] 470053#470053: 515635550 access forbidden by rule, client: 20.220.189.1 ... show more 2026/08/24 15:11:31 [error] 470053#470053: 515635550 access forbidden by rule, client: 20.220.189.161, server: binixo.com, request: "GET /wp-includes/block-supports/ HTTP/2.0", host: "binixo.com" 2026/08/24 15:11:32 [error] 470054#470054: 515635542 access forbidden by rule, client: 20.220.189.161, server: binixo.com, request: "GET /wp-includes/images/ HTTP/2.0", host: "binixo.com" 2026/08/24 15:11:32 [error] 470053#470053: 515635563 access forbidden by rule, client: 20.220.189.161, server: binixo.com, request: "GET /wp-content/index.php HTTP/2.0", host: "binixo.com" ... show less	Web App Attack

Showing 1 to 15 of 415 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇳🇱 185.249.40.156

🇧🇷 177.10.23.188

🇫🇮 65.109.178.234

🇹🇼 220.129.74.157

🇧🇷 205.210.31.223

🇧🇷 187.106.84.116

🇺🇸 184.73.137.109

🇳🇵 157.10.100.12

🇻🇳 27.79.4.185

🇨🇦 20.48.160.90

🇹🇷 2602:fa5d::a9

🇨🇳 223.89.70.73

🇧🇪 198.235.24.174

🇧🇷 189.57.204.50

🇨🇱 181.42.16.160

🇧🇷 177.75.201.252

🇨🇴 152.200.181.42

🇺🇸 142.252.153.62

🇨🇳 124.117.195.83

🇺🇸 104.209.144.33