JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

20.53.239.152

Recent Activity

Abuse confidence score ?

100% Critical

548 reports

262 reporters · latest 6 minutes ago

ISP	Microsoft Corporation
Usage Type	Data Center/Web Hosting/Transit
ASN	AS8075
Domain Name	microsoft.com
Country	🇦🇺 Australia
City	Sydney, New South Wales

ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report Whois

Reports Activity

Example preview

Report Categories (Last 60 Days)

Example preview

Top Reporter Countries (Last 60 Days)

Example preview

Account required for the enhanced features Log in Sign up

IP Abuse Reports for 20.53.239.152

Export CSV

This IP address has been reported a total of 548 times from 262 distinct sources. 20.53.239.152 was first reported on October 19th 2026, and the most recent report was 6 minutes ago. In the last 60 days, the top reporter locations were: Germany with 134 reports; United States of America with 110 reports; France with 51 reports. The most common categories in these recent reports were: Web App Attack 444 times; Bad Web Bot 142 times; Brute-Force 131 times; Hacking 111 times; Port Scan 39 times; Other 44 times.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇪🇸 el-brujo	2026-10-25 00:44:04 (6 minutes ago)	Cloudflare WAF: Request Path: /wp-conf.php Request Query: Host: warzone.elhacker.net userAgent: Moz ... show more Cloudflare WAF: Request Path: /wp-conf.php Request Query: Host: warzone.elhacker.net userAgent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Action: block Source: firewallCustom ASN Description: Microsoft Corporation Country: AU Method: GET Timestamp: 2026-10-25T00:44:04Z ruleId: 6b2d48d0415e4adb9f099d85f54d1de6. show less	Hacking SQL Injection Web App Attack
🇫🇷 Baking333	2026-10-25 00:40:40 (10 minutes ago)	[redacted] 20.53.239.152 - - [25/Oct/2026:01:40:35 +0100] "GET /wp-content/uploads/[redacted] HTTP/1 ... show more [redacted] 20.53.239.152 - - [25/Oct/2026:01:40:35 +0100] "GET /wp-content/uploads/[redacted] HTTP/1.1" 302 1554 0/53485 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" [redacted] 20.53.239.152 - - [25/Oct/2026:01:40:38 +0100] "GET /wp-admin/user/[redacted] HTTP/1.1" 302 1554 0/54675 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" show less	Bad Web Bot Web App Attack
🇧🇾 lns.bz	2026-10-25 00:32:47 (18 minutes ago)	Too many 404 requests [BY]	Web App Attack
🇺🇸 helios.live	2026-10-25 00:18:33 (32 minutes ago)	2026/10/25 00:18:32 [error] 746447#746447: 1997041 FastCGI sent in stderr: "Primary script unknown" ... show more 2026/10/25 00:18:32 [error] 746447#746447: 1997041 FastCGI sent in stderr: "Primary script unknown" while reading response header from upstream, client: 20.53.239.152, server: kocerroxy.com, request: "GET /wk/index.php HTTP/1.1", upstream: "fastcgi://unix:/var/run/php/php8.4-fpm-betakocerroxycom.sock:", host: "kocerroxy.com" 20.53.239.152 - - [25/Oct/2026:00:18:32 +0000] "GET /wk/index.php HTTP/1.1" 404 47 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 2026/10/25 00:18:32 [error] 746447#746447: *1997041 FastCGI sent in stderr: "Primary script unknown" while reading response header from upstream, client: 20.53.239.152, server: kocerroxy.com, request: "GET /inputs.php HTTP/1.1", upstream: "fastcgi://unix:/var/run/php/php8.4-fpm-betakocerroxycom.sock:", host: "kocerroxy.com" 20.53.239.152 - - [25/Oct/2026:00:18:32 +0000] "GET /inputs.php HTTP/1.1" 404 47 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.3 ... show less	Web App Attack
Anonymous	2026-10-25 00:07:08 (43 minutes ago)	20.53.239.152 - - [25/Oct/2026:02:06:50 +0200] "GET /inputs.php HTTP/1.1" 404 29565 20.53.239.152 - ... show more 20.53.239.152 - - [25/Oct/2026:02:06:50 +0200] "GET /inputs.php HTTP/1.1" 404 29565 20.53.239.152 - - [25/Oct/2026:02:06:52 +0200] "GET /ioxi-o.php HTTP/1.1" 404 29565 20.53.239.152 - - [25/Oct/2026:02:06:53 +0200] "GET /function/function.php HTTP/1.1" 404 29565 20.53.239.152 - - [25/Oct/2026:02:06:55 +0200] "GET /rip.php HTTP/1.1" 404 29565 20.53.239.152 - - [25/Oct/2026:02:06:56 +0200] "GET /admin.php HTTP/1.1" 404 29565 20.53.239.152 - - [25/Oct/2026:02:06:59 +0200] "GET /cache.php HTTP/1.1" 404 29565 20.53.239.152 - - [25/Oct/2026:02:07:00 +0200] "GET /themes.php HTTP/1.1" 404 29565 20.53.239.152 - - [25/Oct/2026:02:07:02 +0200] "GET /an.php HTTP/1.1" 404 29565 20.53.239.152 - - [25/Oct/2026:02:07:03 +0200] "GET /index/function.php HTTP/1.1" 404 29565 20.53.239.152 - - [25/Oct/2026:02:07:04 +0200] "GET /randkeyword.PhP7 HTTP/1.1" 404 30203 ... show less	Web Spam Web App Attack
Anonymous	2026-10-24 23:55:35 (55 minutes ago)	Fail2Ban nginx-botsearch on Security-Instance. Persistent malicious activity detected. Evidence: /va ... show more Fail2Ban nginx-botsearch on Security-Instance. Persistent malicious activity detected. Evidence: /var/log/nginx/access.log:20.53.239.152 - - [25/Oct/2026:01:55:34 +0200] "GET /.well-known/ HTTP/1.1" 404 187 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" "-" /var/log/nginx/access.log:20.53.239.152 - - [25/Oct/2026:01:55:34 +0200] "GET /info.php HTTP/1.1" 404 47 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" "-" /var/log/nginx/access.log:20.53.239.152 - - [25/Oct/2026:01:55:35 +0200] "GET /cgi-bin/ HTTP/1.1" 404 187 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" "-" /var/log/nginx/a show less	Bad Web Bot
🇮🇹 VHosting	2026-10-24 23:55:05 (55 minutes ago)	Detected WordPress attack from different servers	Brute-Force Web App Attack
🇹🇷 oalver	2026-10-24 23:55:01 (55 minutes ago)	Detected by SiberKapan threat intelligence platform (siberkapan.org). Attack types: nginx_404_flood, ... show more Detected by SiberKapan threat intelligence platform (siberkapan.org). Attack types: nginx_404_flood, nginx_path_signature. Sources: nginx. Details: 404_flood: 10 requests to /an.php (HTTP 404) within 60s; path_signature: request to /wp-admin/user/index.php (HTTP 404). First seen: 2026-10-24. Risk score: 45/100. show less	Web App Attack
🇵🇱 Bonn333	2026-10-24 23:51:52 (58 minutes ago)	CrowdSec: scanning for vulnerable or sensitive paths. Scenario=crowdsecurity/http-probing; events=11 ... show more CrowdSec: scanning for vulnerable or sensitive paths. Scenario=crowdsecurity/http-probing; events=11; window=2026-10-24T23:51:47.608616853Z .. 2026-10-24T23:51:50.78085462Z. Tried: GET /wk/index.php \| GET /inputs.php \| GET /ioxi-o.php \| GET /function/function.php \| GET /rip.php \| GET /admin.php \| GET /wp-content/uploads/index.php \| GET /cache.php \| GET /themes.php \| GET /an.php (+1 more). Automated report, no manual review. show less	Web App Attack Bad Web Bot
🇮🇹 madaello	2026-10-24 23:50:37 (1 hour ago)	20.53.239.152 - - [25/Oct/2026:01:50:36 +0200] "GET /wk/index.php HTTP/1.1" 404 556 "-" "Mozilla/5.0 ... show more 20.53.239.152 - - [25/Oct/2026:01:50:36 +0200] "GET /wk/index.php HTTP/1.1" 404 556 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.53.239.152 - - [25/Oct/2026:01:50:36 +0200] "GET /inputs.php HTTP/1.1" 404 267 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.53.239.152 - - [25/Oct/2026:01:50:37 +0200] "GET /ioxi-o.php HTTP/1.1" 404 267 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.53.239.152 - - [25/Oct/2026:01:50:37 +0200] "GET /function/function.php HTTP/1.1" 404 556 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.53.239.152 - - [25/Oct/2026:01:50:37 +0200] "GET /rip.php HTTP/1.1" 404 267 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safar ... show less	Port Scan
🇬🇧 Mendip_Defender	2026-10-24 23:45:02 (1 hour ago)	20.53.239.152 - - [25/Oct/2026:00:45:01 +0100] "GET /wk/index.php HTTP/1.1" 404 6476 "-" "Mozilla/5. ... show more 20.53.239.152 - - [25/Oct/2026:00:45:01 +0100] "GET /wk/index.php HTTP/1.1" 404 6476 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.53.239.152 - - [25/Oct/2026:00:45:01 +0100] "GET /inputs.php HTTP/1.1" 404 5550 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.53.239.152 - - [25/Oct/2026:00:45:01 +0100] "GET /ioxi-o.php HTTP/1.1" 404 5550 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" ... show less	Hacking Web App Attack
🇺🇸 ipblock.com	2026-10-24 23:42:00 (1 hour ago)	IPBlock protected site ID [4055-d][s=03]. Exploit request, vulnerability scanner.	Hacking Bad Web Bot Web App Attack
🇫🇷 regishoussin	2026-10-24 23:35:22 (1 hour ago)	Automated web scanning detected by Wazuh (rule 100180): repeated 400/404 errors from mass probing of ... show more Automated web scanning detected by Wazuh (rule 100180): repeated 400/404 errors from mass probing of admin/backdoor paths (e.g. wp-login.php, known CMS shell filenames) on an Apache web server, on 2026-10-24 23:35 UTC. show less	Bad Web Bot Web App Attack
🇵🇱 alianet	2026-10-24 23:31:16 (1 hour ago)	[Sat Oct 24 23:31:10.653334 2026] [proxy_fcgi:error] [pid 778300:tid 778347] [client 20.53.239.152:1 ... show more [Sat Oct 24 23:31:10.653334 2026] [proxy_fcgi:error] [pid 778300:tid 778347] [client 20.53.239.152:11830] AH01071: Got error 'Primary script unknown' [Sat Oct 24 23:31:10.959754 2026] [proxy_fcgi:error] [pid 778300:tid 778350] [client 20.53.239.152:11830] AH01071: Got error 'Primary script unknown' [Sat Oct 24 23:31:11.573079 2026] [proxy_fcgi:error] [pid 778300:tid 778330] [client 20.53.239.152:11830] AH01071: Got error 'Primary script unknown' [Sat Oct 24 23:31:11.879726 2026] [proxy_fcgi:error] [pid 778300:tid 778336] [client 20.53.239.152:11830] AH01071: Got error 'Primary script unknown' [Sat Oct 24 23:31:12.492196 2026] [proxy_fcgi:error] [pid 778300:tid 778343] [client 20.53.239.152:11830] AH01071: Got error 'Primary script unknown' [Sat Oct 24 23:31:12.798767 2026] [proxy_fcgi:error] [pid 778300:tid 778349] [client 20.53.239.152:11830] AH01071: Got error 'Primary script unknown' [Sat Oct 24 23:31:13.105407 2026] [proxy_fcgi:error] [pid 778300:tid 778334] [client 20.53.239.152:1 ... show less	Port Scan Web App Attack
🇫🇷 ✨	2026-10-24 23:21:20 (1 hour ago)	Rule : Security IP in black list	Port Scan Hacking Brute-Force

Showing 1 to 15 of 548 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇱🇹 212.192.23.11

🇻🇪 190.103.29.212

🇫🇮 185.89.43.18

🇧🇷 177.91.40.7

🇺🇸 172.185.21.193

🇮🇳 168.144.81.184

🇳🇱 167.172.42.106

🇺🇸 159.65.216.50

🇧🇴 131.0.196.129

🇨🇳 125.124.226.217

🇨🇳 112.46.213.191

🇫🇷 95.128.43.164

🇧🇬 79.124.60.218

🇪🇸 68.221.29.70

🇺🇸 68.10.53.64

🇩🇪 47.245.140.136

🇳🇱 45.148.10.151

🇸🇬 45.78.230.231

🇲🇾 42.191.98.239

🇨🇳 39.96.179.114