JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 20.205.122.89

20.205.122.89 was found in our database!

This IP was reported 383 times. Confidence of Abuse is 100%: ?

100%

ISP	Microsoft Corporation
Usage Type	Data Center/Web Hosting/Transit
ASN	AS8075
Domain Name	microsoft.com
Country	🇭🇰 Hong Kong
City	Hong Kong

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 20.205.122.89

Whois 20.205.122.89

IP Abuse Reports for 20.205.122.89:

This IP address has been reported a total of 383 times from 174 distinct sources. 20.205.122.89 was first reported on October 3rd 2026, and the most recent report was 1 week ago.

Old Reports: The most recent abuse report for this IP address is from 1 week ago . It is possible that this IP is no longer involved in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇬🇧 sc user	2026-10-13 21:37:24 (1 week ago)	Fail2Ban nginx: repeated suspicious HTTP requests consistent with automated probing, scanning or bad ... show more Fail2Ban nginx: repeated suspicious HTTP requests consistent with automated probing, scanning or bad bot behaviour. Technical log details and local server identifiers intentionally omitted for privacy. show less	Bad Web Bot Web App Attack Port Scan
🇬🇧 sc user	2026-10-12 05:51:59 (2 weeks ago)	Fail2Ban nginx: repeated suspicious HTTP requests consistent with automated probing, scanning or bad ... show more Fail2Ban nginx: repeated suspicious HTTP requests consistent with automated probing, scanning or bad bot behaviour. Technical log details and local server identifiers intentionally omitted for privacy. show less	Bad Web Bot Web App Attack Port Scan
🇳🇱 Site.eu	2026-10-11 22:02:49 (2 weeks ago)	Excessive multi-domain requests	Brute-Force
🇧🇷 Peregrine	2026-10-11 03:09:49 (2 weeks ago)	Fail2Ban Jail: tomcat-honeypot \| Evidence: 20.205.122.89 172.68.211.120 - - [07/Oct/2026:02:20:01 -0 ... show more Fail2Ban Jail: tomcat-honeypot \| Evidence: 20.205.122.89 172.68.211.120 - - [07/Oct/2026:02:20:01 -0300] "GET /admin.php HTTP/1.1" 404 414 20.205.122.89 172.68.211.82 - - [07/Oct/2026:02:20:02 -0300] "GET /goods.php HTTP/1.1" 404 414 20.205.122.89 172.68.211.82 - - [07/Oct/2026:02:20:02 -0300] "GET /file.php HTTP/1.1" 404 414 20.205.122.89 172.68.211.82 - - [07/Oct/2026:02:20:03 -0300] "GET /adminfuns.php HTTP/1.1" 404 414 20.205.122.89 172.68.211.82 - - [07/Oct/2026:02:20:03 -0300] "GET /404.php HTTP/1.1" 404 414 20.205.122.89 172.68.211.82 - - [07/Oct/2026:02:20:03 -0300] "GET /wk/index.php HTTP/1.1" 404 414 show less	Bad Web Bot
🇬🇧 sc user	2026-10-10 11:38:19 (2 weeks ago)	Fail2Ban nginx: repeated suspicious HTTP requests consistent with automated probing, scanning or bad ... show more Fail2Ban nginx: repeated suspicious HTTP requests consistent with automated probing, scanning or bad bot behaviour. Technical log details and local server identifiers intentionally omitted for privacy. show less	Bad Web Bot Web App Attack Port Scan
🇫🇮 Kimmo Rieskaniemi	2026-10-10 06:31:09 (2 weeks ago)	CrowdSec triggered crowdsecurity/http-probing	Web App Attack Hacking
🇬🇧 MrTumnus	2026-10-10 05:53:46 (2 weeks ago)	This IP was detected by CrowdSec triggering crowdsecurity/http-probing	Web App Attack Hacking
🇬🇧 oja	2026-10-10 05:46:26 (2 weeks ago)	Aggressive web scanner	Web App Attack
🇳🇱 Alt255	2026-10-10 05:15:48 (2 weeks ago)	[ti-07al] Web exploit scanning: 1 suspicious requests detected by fail2ban jail apache-scanner. Exam ... show more [ti-07al] Web exploit scanning: 1 suspicious requests detected by fail2ban jail apache-scanner. Example: 20.205.122.89 - - [10/Oct/2026:07:15:47 +0200] "GET /alfa.php HTTP/1.1" 403 2108 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" ... show less	Bad Web Bot Web App Attack
🇺🇸 fazar	2026-10-10 04:11:44 (2 weeks ago)	crowdsecurity/http-probing on node: us01	Web App Attack Hacking
Anonymous	2026-10-10 03:38:57 (2 weeks ago)	Attempted access to sensitive endpoint (/wp-content/admin.php) detected. Automated scan or unauthori ... show more Attempted access to sensitive endpoint (/wp-content/admin.php) detected. Automated scan or unauthorized probing. show less	Web App Attack
🇩🇪 svr	2026-10-10 02:53:13 (2 weeks ago)	Abusive Automated Web Scanner	Web App Attack
Anonymous	2026-10-10 01:40:51 (2 weeks ago)	(caddyscan) Scanner path probe from 20.205.122.89 (HK/Hong Kong/-): 5 in the last 3600 secs; Ports: ... show more (caddyscan) Scanner path probe from 20.205.122.89 (HK/Hong Kong/-): 5 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: [REDACTED] 200 2627 20.205.122.89 - - [10/Oct/2026:01:40:41 +0000] "GET /wp-admin/maint/index.php HTTP/1.1" [REDACTED] 200 2627 20.205.122.89 - - [10/Oct/2026:01:40:44 +0000] "GET /wp-admin/js/widgets/ HTTP/1.1" [REDACTED] 200 2627 20.205.122.89 - - [10/Oct/2026:01:40:46 +0000] "GET /xmlrpc.php HTTP/1.1" [REDACTED] 200 2627 20.205.122.89 - - [10/Oct/2026:01:40:46 +0000] "GET /wp-admin/css/colors/blue/index.php HTTP/1.1" [REDACTED] 200 2627 20.205.122.89 - - [10/Oct/2026:01:40:48 +0000] "GET /wp-admin/index.php HTTP/1.1" show less	Port Scan
🇺🇸 antlac1	2026-10-10 01:21:51 (2 weeks ago)	crowdsecurity/http-probing	Brute-Force Web App Attack
Anonymous	2026-10-10 00:30:52 (2 weeks ago)	[Drupal AbuseIPDB module] Request path is blacklisted. /wp-admin/maint/index.php	Web App Attack

Showing 1 to 15 of 383 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇩🇪 217.60.76.58

🇸🇪 193.181.234.37

🇸🇪 185.246.128.171

🇦🇷 179.42.170.77

🇳🇱 176.65.149.171

🇺🇸 162.240.148.15

🇨🇳 140.179.111.176

🇧🇪 34.62.116.145

🇧🇷 34.39.188.31

🇨🇳 221.233.53.175

🇨🇳 219.159.79.49

🇺🇸 207.168.127.141

🇧🇷 205.210.31.163

🇳🇱 200.138.46.191

🇧🇪 198.235.24.248

🇷🇺 195.239.97.254

🇫🇷 188.138.28.29

🇧🇷 186.193.124.143

🇩🇿 105.102.68.41

🇧🇩 103.123.168.59