JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

20.239.201.109

Recent Activity

Abuse Confidence Score

100% Critical

832 reports

301 reporters · latest 2 hours ago

ISP: Microsoft Corporation
Usage Type: Data Center/Web Hosting/Transit
ASN: AS8075
Domain Name: microsoft.com
Country: 🇭🇰 Hong Kong
City: Hong Kong

ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report Whois

Example preview

Account required for the enhanced features Log in Sign up

Abuse Reports

Export reports CSV

Total reports

832 from 301 distinct reporters

First reported

October 19th 2026

Most recent report

2 hours ago

Last 60 days

Top reporter locations 🇩🇪 Germany 196 🇺🇸 United States of America 150 🇫🇷 France 92

Most common categories Web App Attack 694 Bad Web Bot 240 Brute-Force 188 Hacking 121 Port Scan 52

Recent reports We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇧🇷 Peregrine	2026-10-30 03:11:00 (2 hours ago)	Fail2Ban Jail s2: tomcat-honeypot \| Evidence: 20.239.201.109 172.68.211.96 - - [24/Oct/2026:18:42:14 -0300] "GET /wk/index.php HTTP/1.1" 404 414 20.239.201.109 172.68.211.96 - - [24/Oct/2026:18:42:15 -0300] "GET /inputs.php HTTP/1.1" 404 414 20.239.2 ... show more Fail2Ban Jail s2: tomcat-honeypot \| Evidence: 20.239.201.109 172.68.211.96 - - [24/Oct/2026:18:42:14 -0300] "GET /wk/index.php HTTP/1.1" 404 414 20.239.201.109 172.68.211.96 - - [24/Oct/2026:18:42:15 -0300] "GET /inputs.php HTTP/1.1" 404 414 20.239.201.109 172.68.211.96 - - [24/Oct/2026:18:42:15 -0300] "GET /ioxi-o.php HTTP/1.1" 404 414 20.239.201.109 172.68.211.96 - - [24/Oct/2026:18:42:15 -0300] "GET /function/function.php HTTP/1.1" 404 414 20.239.201.109 172.68.211.96 - - [24/Oct/2026:18:42:16 -0300] "GET /rip.php HTTP/1.1" 404 414 20.239.201.109 172.68.211.96 - - [24/Oct/2026:18:42:16 -0300] "GET /admin.php HTTP/1.1" 404 414 20.239.201.109 172.68.211.96 - - [24/Oct/2026:18:42:16 -0300] "GET /wp-content/uploads/index.php HTTP/1.1" 404 414 show less	Bad Web Bot
Anonymous	2026-10-28 09:19:15 (1 day ago)	FortiWeb WAF: 38 attacks detected. Threat Score: 41400. Types: Client Management(19), Block IP List(19). Origin: Hong Kong.	Web App Attack
🇧🇷 Peregrine	2026-10-28 03:10:57 (2 days ago)	Fail2Ban Jail s2: tomcat-honeypot \| Evidence: 20.239.201.109 172.68.211.96 - - [24/Oct/2026:18:42:14 -0300] "GET /wk/index.php HTTP/1.1" 404 414 20.239.201.109 172.68.211.96 - - [24/Oct/2026:18:42:15 -0300] "GET /inputs.php HTTP/1.1" 404 414 20.239.2 ... show more Fail2Ban Jail s2: tomcat-honeypot \| Evidence: 20.239.201.109 172.68.211.96 - - [24/Oct/2026:18:42:14 -0300] "GET /wk/index.php HTTP/1.1" 404 414 20.239.201.109 172.68.211.96 - - [24/Oct/2026:18:42:15 -0300] "GET /inputs.php HTTP/1.1" 404 414 20.239.201.109 172.68.211.96 - - [24/Oct/2026:18:42:15 -0300] "GET /ioxi-o.php HTTP/1.1" 404 414 20.239.201.109 172.68.211.96 - - [24/Oct/2026:18:42:15 -0300] "GET /function/function.php HTTP/1.1" 404 414 20.239.201.109 172.68.211.96 - - [24/Oct/2026:18:42:16 -0300] "GET /rip.php HTTP/1.1" 404 414 20.239.201.109 172.68.211.96 - - [24/Oct/2026:18:42:16 -0300] "GET /admin.php HTTP/1.1" 404 414 20.239.201.109 172.68.211.96 - - [24/Oct/2026:18:42:16 -0300] "GET /wp-content/uploads/index.php HTTP/1.1" 404 414 show less	Bad Web Bot
🇨🇱 Fernando Soto	2026-10-28 03:05:06 (2 days ago)	WAF propio vps1 (CL): sensx8 score 20 en 1h. sondeo rutas sensibles.	Web App Attack
🇩🇪 www.Examensfragen.de	2026-10-27 20:21:19 (2 days ago)		Web Spam Bad Web Bot
🇮🇩 soc-yk	2026-10-27 20:18:17 (2 days ago)	Type: web_scanning Risk: 100 Events: 1416 Evidence: - Automated hostile web probing detected - Repeated web scanning activity observed - Multi-event operational persistence identified	Web App Attack
🇧🇬 HighWay	2026-10-27 16:46:40 (2 days ago)	20.239.201.109 - - [27/Oct/2026:16:46:32 +0000] "GET /wp-content/uploads/ HTTP/1.1" 404 770 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.239.201.109 - - [27/Oct/2026:16:46:33 ... show more 20.239.201.109 - - [27/Oct/2026:16:46:32 +0000] "GET /wp-content/uploads/ HTTP/1.1" 404 770 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.239.201.109 - - [27/Oct/2026:16:46:33 +0000] "GET /wp-content/themes/admin.php HTTP/1.1" 404 770 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.239.201.109 - - [27/Oct/2026:16:46:33 +0000] "GET /wp-content/themes/index.php HTTP/1.1" 404 770 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.239.201.109 - - [27/Oct/2026:16:46:33 +0000] "GET /wp-content/plugins/index.php HTTP/1.1" 404 770 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.239.201.109 - - [27/Oct/2026:16:46:34 +0000] "GET /wp-includes/PHPMailer/ HTTP/1.1" 404 770 "-" "Mozilla/5.0 (Windows NT 10.0; Win64 ... show less	Bad Web Bot Web App Attack
Anonymous	2026-10-27 16:25:31 (2 days ago)	Banned by Fail2Ban on server	Web App Attack
🇩🇰 floyd_dk	2026-10-27 16:06:41 (2 days ago)	20.239.201.109 - - [27/Oct/2026:16:06:38 +0000] "GET /wp-content/uploads/ HTTP/1.1" 404 555 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.239.201.109 - - [27/Oct/2026:16:06:38 ... show more 20.239.201.109 - - [27/Oct/2026:16:06:38 +0000] "GET /wp-content/uploads/ HTTP/1.1" 404 555 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.239.201.109 - - [27/Oct/2026:16:06:38 +0000] "GET /wp-content/themes/admin.php HTTP/1.1" 404 27 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.239.201.109 - - [27/Oct/2026:16:06:38 +0000] "GET /wp-content/themes/index.php HTTP/1.1" 404 27 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.239.201.109 - - [27/Oct/2026:16:06:39 +0000] "GET /wp-content/plugins/index.php HTTP/1.1" 404 27 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.239.201.109 - - [27/Oct/2026:16:06:39 +0000] "GET /wp-includes/PHPMailer/ HTTP/1.1" 404 555 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x ... show less	Web App Attack
🇦🇺 Proxay Fox	2026-10-27 15:55:01 (2 days ago)	20.239.201.109 - - [28/Oct/2026:01:54:55 +1000] "GET /wp-content/uploads/ HTTP/2.0" 403 166 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" "20.239.201.109" 619 437 TLSv1.3/TLS_AES ... show more 20.239.201.109 - - [28/Oct/2026:01:54:55 +1000] "GET /wp-content/uploads/ HTTP/2.0" 403 166 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" "20.239.201.109" 619 437 TLSv1.3/TLS_AES_256_GCM_SHA384 . 3c91b5c6b5913f1400ffc4b113dde74da734617bed0062bed5610ca8135a075f 20.239.201.109 - - [28/Oct/2026:01:54:55 +1000] "GET /wp-content/themes/admin.php HTTP/2.0" 404 36 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" "20.239.201.109" 63 314 TLSv1.3/TLS_AES_256_GCM_SHA384 . 3c91b5c6b5913f1400ffc4b113dde74da734617bed0062bed5610ca8135a075f 20.239.201.109 - - [28/Oct/2026:01:54:56 +1000] "GET /wp-includes/PHPMailer/ HTTP/2.0" 403 166 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" "20.239.201.109" 59 437 TLSv1.3/TLS_AES_256_GCM_SHA384 . b287d69938d2b88c1562815f2e28eb8e482287db3c6eb330861cce09 ... show less	Brute-Force Web App Attack
🇫🇷 Baking333	2026-10-27 15:38:52 (2 days ago)	[redacted] 20.239.201.109 - - [27/Oct/2026:16:38:50 +0100] "GET /wp-content/uploads/ HTTP/1.1" 301 5837 0/463 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 443 [redacted] 20.239. ... show more [redacted] 20.239.201.109 - - [27/Oct/2026:16:38:50 +0100] "GET /wp-content/uploads/ HTTP/1.1" 301 5837 0/463 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 443 [redacted] 20.239.201.109 - - [27/Oct/2026:16:38:50 +0100] "GET /wp-content/themes/[redacted] HTTP/1.1" 302 1534 0/106764 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 443 show less	Bad Web Bot Web App Attack
🇳🇱 e.fierstra	2026-10-27 15:27:54 (2 days ago)	excessive HTTP 404 errors	Bad Web Bot
🇳🇴 Abuse Buster	2026-10-27 15:24:10 (2 days ago)	20.239.201.109 - [27/Oct/2026:16:24:08 +0100] "GET /wp-content/uploads/ HTTP/2.0" 404 20 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" Connecting ip: 20.239.201.109 Forwared for: ... show more 20.239.201.109 - [27/Oct/2026:16:24:08 +0100] "GET /wp-content/uploads/ HTTP/2.0" 404 20 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" Connecting ip: 20.239.201.109 Forwared for: 20.239.201.109 20.239.201.109 - [27/Oct/2026:16:24:09 +0100] "GET /wp-content/themes/admin.php HTTP/2.0" 404 36 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" Connecting ip: 20.239.201.109 Forwared for: 20.239.201.109 20.239.201.109 - [27/Oct/2026:16:24:09 +0100] "GET /wp-content/themes/index.php HTTP/2.0" 404 36 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" Connecting ip: 20.239.201.109 Forwared for: 20.239.201.109 ... show less	Web App Attack
🇮🇹 Inartis	2026-10-27 15:23:43 (2 days ago)	[Tue Oct 27 16:23:41.335804 2026] [proxy_fcgi:error] [pid 735495:tid 132347823363776] [client 20.239.201.109:7028] AH01071: Got error 'Primary script unknown' [Tue Oct 27 16:23:42.822490 2026] [proxy_fcgi:error] [pid 735495:tid 132346783192768] [clie ... show more [Tue Oct 27 16:23:41.335804 2026] [proxy_fcgi:error] [pid 735495:tid 132347823363776] [client 20.239.201.109:7028] AH01071: Got error 'Primary script unknown' [Tue Oct 27 16:23:42.822490 2026] [proxy_fcgi:error] [pid 735495:tid 132346783192768] [client 20.239.201.109:7028] AH01071: Got error 'Primary script unknown' ... show less	Brute-Force Bad Web Bot Web App Attack
🇫🇮 Christopher Hughes	2026-10-27 14:34:39 (2 days ago)	[Tue Oct 27 14:34:32.631444 2026] [proxy_fcgi:error] [pid 2362233:tid 139845728982592] [client 20.239.201.109:4952] AH01071: Got error 'Primary script unknown' [Tue Oct 27 14:34:34.710760 2026] [proxy_fcgi:error] [pid 2362233:tid 139845108217408] [cl ... show more [Tue Oct 27 14:34:32.631444 2026] [proxy_fcgi:error] [pid 2362233:tid 139845728982592] [client 20.239.201.109:4952] AH01071: Got error 'Primary script unknown' [Tue Oct 27 14:34:34.710760 2026] [proxy_fcgi:error] [pid 2362233:tid 139845108217408] [client 20.239.201.109:4952] AH01071: Got error 'Primary script unknown' [Tue Oct 27 14:34:38.317206 2026] [proxy_fcgi:error] [pid 2362233:tid 139846640567872] [client 20.239.201.109:4952] AH01071: Got error 'Primary script unknown' [Tue Oct 27 14:34:38.574882 2026] [proxy_fcgi:error] [pid 2362233:tid 139846274246208] [client 20.239.201.109:4952] AH01071: Got error 'Primary script unknown' [Tue Oct 27 14:34:39.090134 2026] [proxy_fcgi:error] [pid 2362233:tid 139846665745984] [client 20.239.201.109:4952] AH01071: Got error 'Primary script unknown' ... show less	Web App Attack

Showing 1 to 15 of 832 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown

Recently Reported IPs:

🇧🇪 35.210.13.235

🇺🇸 209.141.47.217

🇨🇭 209.99.190.186

🇳🇱 204.76.203.40

🇨🇳 183.237.142.82

🇫🇷 169.40.142.224

🇿🇦 168.210.29.67

🇺🇸 162.216.149.232

🇸🇬 101.47.8.188

🇩🇪 94.31.78.27

🇵🇱 94.26.68.90

🇮🇹 93.47.60.226

🇫🇷 91.196.152.201

🇮🇱 79.177.155.16

🇦🇱 79.106.203.129

🇳🇱 64.205.72.146

🇺🇸 64.62.197.137

🇩🇪 47.245.136.11

🇺🇸 45.148.235.149

🇹🇿 41.93.28.12