JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 20.92.77.159

20.92.77.159 was found in our database!

This IP was reported 2,653 times. Confidence of Abuse is 100%: ?

100%

ISP	Microsoft Corporation
Usage Type	Data Center/Web Hosting/Transit
ASN	AS8075
Domain Name	microsoft.com
Country	🇦🇺 Australia
City	Sydney, New South Wales

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 20.92.77.159

Whois 20.92.77.159

IP Abuse Reports for 20.92.77.159:

This IP address has been reported a total of 2,653 times from 849 distinct sources. 20.92.77.159 was first reported on October 3rd 2026, and the most recent report was 11 hours ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇺🇸 Rayulcifer	2026-10-22 07:01:43 (11 hours ago)	[Fri Oct 09 16:10:41.780199 2026] [authz_core:error] [pid 1108475:tid 140444910458560] [client 20.92 ... show more [Fri Oct 09 16:10:41.780199 2026] [authz_core:error] [pid 1108475:tid 140444910458560] [client 20.92.77.159:50766] AH01630: client denied by server configuration: proxy:http://localhost:4000/wp-content/plugins/hellopress/wp_filemanager.php [Fri Oct 09 16:10:41.978698 2026] [authz_core:error] [pid 1108475:tid 140445883553472] [client 20.92.77.159:50766] AH01630: client denied by server configuration: proxy:http://localhost:4000/this_is_a_new_hello_world.php [Fri Oct 09 16:10:42.209701 2026] [authz_core:error] [pid 1108475:tid 140446789506752] [client 20.92.77.159:50766] AH01630: client denied by server configuration: proxy:http://localhost:4000/xc32tl6p1ockohrquxkroCfm.php [Fri Oct 09 16:10:42.409112 2026] [authz_core:error] [pid 1108475:tid 140446839862976] [client 20.92.77.159:50766] AH01630: client denied by server configuration: proxy:http://localhost:4000/wp-filemannger4h.php [Fri Oct 09 16:10:42.637186 2026] [authz_core:error] [pid 1108475:tid 140446965688000] [client 20.92.77.159 ... show less	Brute-Force SSH
Anonymous	2026-10-21 13:21:52 (1 day ago)	fail2ban jail apache-scanner: 20.92.77.159 - - [02/Oct/2026:23:30:17 -0700] "GET /admin.php HTTP/1.1 ... show more fail2ban jail apache-scanner: 20.92.77.159 - - [02/Oct/2026:23:30:17 -0700] "GET /admin.php HTTP/1.1" 404 123711 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.92.77.159 - - [02/Oct/2026:23:30:17 -0700] "GET /1index.php HTTP/1.1" 404 123711 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.92.77.159 - - [02/Oct/2026:23:30:18 -0700] "GET /adminfuns.php HTTP/1.1" 404 123711 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.92.77.159 - - [02/Oct/2026:23:30:18 -0700] "GET /wp-includes/fonts/ HTTP/1.1" 403 514 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.92.77.159 - - [02/Oct/2026:23:30:18 -0700] "GET /wp-content/admin.php HTTP/1.1" 40 show less	Web App Attack Port Scan
🇨🇦 zXero	2026-10-21 12:29:33 (1 day ago)	Fail2Ban automatic report - jail: no-wordpress	Brute-Force SSH DDoS Attack
🇩🇪 ghostwarriors	2026-10-21 11:21:20 (1 day ago)	Webpage scraping	Brute-Force Bad Web Bot Web App Attack
🇧🇷 Peregrine	2026-10-21 03:15:05 (1 day ago)	Fail2Ban ct101 Jail: tomcat-honeypot \| Evidence: 20.92.77.159 104.22.127.70 - - [08/Oct/2026:15:29:5 ... show more Fail2Ban ct101 Jail: tomcat-honeypot \| Evidence: 20.92.77.159 104.22.127.70 - - [08/Oct/2026:15:29:59 -0300] "GET /admin.php HTTP/1.1" 404 18193 show less	Bad Web Bot
Anonymous	2026-10-20 07:11:47 (2 days ago)	T: f2b 404 5x	Web App Attack
Anonymous	2026-10-20 06:55:42 (2 days ago)	B: f2b 404 5x	Web App Attack
🇧🇷 Peregrine	2026-10-20 03:14:39 (2 days ago)	Fail2Ban ct101 Jail: tomcat-honeypot \| Evidence: 20.92.77.159 104.22.127.70 - - [08/Oct/2026:15:29:5 ... show more Fail2Ban ct101 Jail: tomcat-honeypot \| Evidence: 20.92.77.159 104.22.127.70 - - [08/Oct/2026:15:29:59 -0300] "GET /admin.php HTTP/1.1" 404 18193 show less	Bad Web Bot
🇺🇸 1cyb3rpunk	2026-10-19 20:13:03 (2 days ago)	Coordinated campaign CMP-1786835248-000: 1782 IPs sharing an attack fingerprint (acme_challenge_prob ... show more Coordinated campaign CMP-1786835248-000: 1782 IPs sharing an attack fingerprint (acme_challenge_probe, admin_panel_probe, asset_directory_probe, attacker_objective_inferred, aws_creds_file_probe, aws_imds_probe). Observed on sectrace.org honeypot surface. show less	Port Scan Brute-Force Bad Web Bot Web App Attack
Anonymous	2026-10-19 17:26:32 (3 days ago)	fail2ban: apache-php-scan jail (1 hits in 2419200s)	Web App Attack Hacking
🇩🇪 IVski.com	2026-10-19 15:19:26 (3 days ago)	IVski WAF \| Remote administration interface probe detected	Hacking Brute-Force Web App Attack
🇩🇪 rh24	2026-10-18 22:00:06 (3 days ago)	HTTP flood or excessive requests, blocked by host firewall.	DDoS Attack Web App Attack
🇧🇷 Peregrine	2026-10-18 03:15:21 (4 days ago)	Fail2Ban ct101 Jail: tomcat-honeypot \| Evidence: 20.92.77.159 104.22.127.70 - - [08/Oct/2026:15:29:5 ... show more Fail2Ban ct101 Jail: tomcat-honeypot \| Evidence: 20.92.77.159 104.22.127.70 - - [08/Oct/2026:15:29:59 -0300] "GET /admin.php HTTP/1.1" 404 18193 show less	Bad Web Bot
🇩🇪 rh24	2026-10-17 22:00:06 (4 days ago)	HTTP flood or excessive requests, blocked by host firewall.	DDoS Attack Web App Attack
🇧🇷 Host One	2026-10-17 07:30:23 (5 days ago)	Web vulnerability scanning: automated requests without User-Agent; WordPress xmlrpc.php abuse. Block ... show more Web vulnerability scanning: automated requests without User-Agent; WordPress xmlrpc.php abuse. Blocked by firewall on 5 different hosting servers. Protocol TCP, port 80, 443 (HTTP/HTTPS). Automated report. show less	Brute-Force Bad Web Bot Web App Attack

Showing 1 to 15 of 2653 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇫🇷 91.231.89.113

🇺🇸 147.185.132.133

🇺🇸 138.68.3.114

🇮🇳 117.242.121.25

🇨🇳 116.147.148.233

🇮🇳 103.217.85.79

🇸🇮 102.220.160.42

🇳🇱 45.148.10.152

🇧🇪 34.140.31.161

🇯🇵 34.84.225.41

🇻🇳 210.245.20.230

🇦🇷 200.81.166.150

🇺🇸 185.180.141.110

🇳🇱 185.136.15.111

🇺🇸 172.40.3.94

🇷🇺 95.181.25.212

🇳🇱 77.91.71.25

🇳🇱 45.148.10.183

🇻🇳 42.114.230.33

🇩🇿 41.111.227.10