JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 20.38.3.247

20.38.3.247 was found in our database!

This IP was reported 1,399 times. Confidence of Abuse is 100%: ?

100%

ISP	Microsoft Corporation
Usage Type	Data Center/Web Hosting/Transit
ASN	AS8075
Domain Name	microsoft.com
Country	🇺🇸 United States of America
City	Phoenix, Arizona

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 20.38.3.247

Whois 20.38.3.247

IP Abuse Reports for 20.38.3.247:

This IP address has been reported a total of 1,399 times from 633 distinct sources. 20.38.3.247 was first reported on August 14th 2026, and the most recent report was 13 minutes ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇺🇸 ctidrv	2026-08-20 07:55:09 (13 minutes ago)	Honeypot detection. Threat score: 90/100. Collector: shell_trap. \| Request: GET /1.php \| rDNS: 20.38 ... show more Honeypot detection. Threat score: 90/100. Collector: shell_trap. \| Request: GET /1.php \| rDNS: 20.38.3.247 \| Attacks detected: webshell \| Reasons: webshell_probe show less	Web App Attack Exploited Host
🇦🇺 2000cn.com.au	2026-08-20 07:39:56 (28 minutes ago)	This IP was detected by CrowdSec triggering crowdsecurity/http-probing	Web App Attack Hacking
🇵🇱 strefapi_com	2026-08-20 07:30:33 (37 minutes ago)	Brute-force, web ...	Hacking Brute-Force Web App Attack
🇩🇪 McClay	2026-08-20 07:07:01 (1 hour ago)	HTTP-404 spam:20.38.3.247 - - [20/Aug/2026:09:06:57 +0200] "GET /wp-content/plugins/hellopress/wp_fi ... show more HTTP-404 spam:20.38.3.247 - - [20/Aug/2026:09:06:57 +0200] "GET /wp-content/plugins/hellopress/wp_filemanager.php HTTP/1.1" 404 5178 "-" "-" 20.38.3.247 - - [20/Aug/2026:09:06:57 +0200] "GET /this_is_a_new_hello_world.php HTTP/1.1" 404 212 "-" "-" 20.38.3.247 - - [20/Aug/2026:09:06:57 +0200] "GET /media.php HTTP/1.1" 404 212 "-" "-" 20.38.3.247 - - [20/Aug/2026:09:06:58 +0200] "GET /admin.php HTTP/1.1" 404 212 "-" "-" 20.38.3.247 - - [20/Aug/2026:09:06:58 +0200] "GET /mac.php HTTP/1.1" 404 212 "-" "-" 20.38.3.247 - - [20/Aug/2026:09:06:58 +0200] "GET /1.php HTTP/1.1" 404 212 "-" "-" 20.38.3.247 - - [20/Aug/2026:09:06:58 +0200] "GET /coffee.php HTTP/1.1" 404 212 "-" "-" 20.38.3.247 - - [20/Aug/2026:09:06:59 +0200] "GET /classwithtostring.php?p= HTTP/1.1" 404 212 "-" "-" 20.38.3.247 - - [20/Aug/2026:09:06:59 +0200] "GET /wp-ws68.php?p= HTTP/1.1" 404 212 "-" "-" 20.38.3.247 - - [20/Aug/2026:09:06:59 +0200] "GET /yj09.php HTTP/1.1" 404 212 "-" "-" 20.38.3.247 - - [20/Aug/2026:09:07:00 +0200] "GET /scxy. ... show less	Web App Attack
🇺🇸 Epimetheus	2026-08-20 06:56:21 (1 hour ago)	Unauthorized access attempts: [GET] /new.php [GET] /file1221.php [GET] /wpxml.php [GET] /dex.php [G ... show more Unauthorized access attempts: [GET] /new.php [GET] /file1221.php [GET] /wpxml.php [GET] /dex.php [GET] /82.php [GET] /wp-content/plugins/hellopress/wp_filemanager.php [GET] /coffexium.php UA: Unknown show less	Web App Attack
🇺🇸 craudiovizai	2026-08-20 06:30:18 (1 hour ago)	Automated honeypot detection. honeypot against a Next.js application. Paths: /wp-content/plugins/hel ... show more Automated honeypot detection. honeypot against a Next.js application. Paths: /wp-content/plugins/hellopress/wp_filemanager.php. Blocked at the edge. show less	Web App Attack Bad Web Bot
🇨🇿 rawnullbyte	2026-08-20 06:04:35 (2 hours ago)	🚨 Honeypot triggered! 🖥️ System: NPot 🎯 Target: Unknown 🛣️ Path: /wp-content/plugins/hellopress/wp_f ... show more 🚨 Honeypot triggered! 🖥️ System: NPot 🎯 Target: Unknown 🛣️ Path: /wp-content/plugins/hellopress/wp_filemanager.php 👤 Attacker IP: 20.38.3.247 ⏰ Time: 2026-08-20 06:04:35 📡 User-Agent: Unknown show less	Web App Attack
🇫🇷 largo-it.net	2026-08-20 05:19:19 (2 hours ago)	Aug 20 07:19:16 vps-9f3cdc33 haproxy[2804943]: 20.38.3.247:47735 [20/Aug/2026:07:19:16.751] www_fron ... show more Aug 20 07:19:16 vps-9f3cdc33 haproxy[2804943]: 20.38.3.247:47735 [20/Aug/2026:07:19:16.751] www_frontend~ sav_largo_cluster/sav_https 0/0/11/19/30 404 7535 - - ---- 106/60/0/0/0 0/0 "GET /wp-content/plugins/hellopress/wp_filemanager.php HTTP/1.1" Aug 20 07:19:17 vps-9f3cdc33 haproxy[2804943]: 20.38.3.247:47735 [20/Aug/2026:07:19:17.074] www_frontend~ sav_largo_cluster/sav_https 0/0/10/22/32 404 7535 - - ---- 105/59/0/0/0 0/0 "GET /this_is_a_new_hello_world.php HTTP/1.1" Aug 20 07:19:17 vps-9f3cdc33 haproxy[2804943]: 20.38.3.247:47735 [20/Aug/2026:07:19:17.398] www_frontend~ sav_largo_cluster/sav_https 0/0/11/140/151 404 7536 - - ---- 105/59/0/0/0 0/0 "GET /media.php HTTP/1.1" Aug 20 07:19:18 vps-9f3cdc33 haproxy[2804943]: 20.38.3.247:47735 [20/Aug/2026:07:19:17.841] www_frontend~ sav_largo_cluster/sav_https 0/0/10/151/161 404 7536 - - ---- 105/59/0/0/0 0/0 "GET /admin.php HTTP/1.1" Aug 20 07:19:18 vps-9f3cdc33 haproxy[2804943]: 20.38.3.247:47735 [20/Aug/2026:07:19:18.293] www_frontend~ ... show less	Hacking Bad Web Bot Web App Attack
🇩🇪 jasperedv.de	2026-08-20 05:11:04 (2 hours ago)	Apache Login - Brutforcing	Web App Attack Brute-Force
🇫🇮 Kimmo Rieskaniemi	2026-08-20 04:54:04 (3 hours ago)	CrowdSec triggered crowdsecurity/http-probing	Web App Attack Hacking
🇫🇷 UnixPrime	2026-08-20 04:50:44 (3 hours ago)	20.38.3.247 - - [20/Aug/2026:06:50:30 +0200] "GET /admin.php HTTP/1.1" 404 146 "-" "-" 20.38.3.247 - ... show more 20.38.3.247 - - [20/Aug/2026:06:50:30 +0200] "GET /admin.php HTTP/1.1" 404 146 "-" "-" 20.38.3.247 - - [20/Aug/2026:06:50:43 +0200] "GET /admin.php?p= HTTP/1.1" 404 146 "-" "-" ... show less	Bad Web Bot Web App Attack
Anonymous	2026-08-20 04:43:03 (3 hours ago)	PARMACOM WEBEXPLOIT 20.38.3.247 (20.38.3.247)	Web App Attack
🇩🇪 bazter.pro	2026-08-20 04:24:15 (3 hours ago)	Fail2Ban: apache-ratelimit - 20 failures	Port Scan Bad Web Bot Web App Attack
🇺🇸 jfz-abuse	2026-08-20 04:17:31 (3 hours ago)	fail2ban: apache-php-recon ...	Web App Attack
🇫🇷 HerrWolf	2026-08-20 04:15:03 (3 hours ago)	CrowdSec Detection: crowdsecurity/http-admin-interface-probing	Web App Attack

Showing 1 to 15 of 1399 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇩🇪 217.154.150.0

🇺🇸 216.25.89.150

🇻🇳 171.231.196.244

🇺🇸 167.172.238.52

🇸🇬 129.226.200.18

🇮🇳 122.172.81.118

🇵🇱 74.248.133.44

🇺🇸 46.28.194.17

🇻🇳 14.225.218.99

🇩🇪 217.154.13.82

🇺🇸 195.184.76.69

🇦🇷 190.83.67.72

🇲🇽 189.216.143.40

🇫🇷 172.71.118.249

🇫🇷 172.71.118.248

🇺🇸 162.216.149.252

🇷🇺 95.25.43.102

🇫🇷 91.196.152.36

🇹🇷 88.250.51.231

🇬🇧 87.236.176.74