JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 20.100.185.192

20.100.185.192 was found in our database!

This IP was reported 108 times. Confidence of Abuse is 100%: ?

100%

ISP	Microsoft Corporation
Usage Type	Data Center/Web Hosting/Transit
ASN	AS8075
Domain Name	microsoft.com
Country	🇳🇴 Norway
City	Oslo, Oslo

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 20.100.185.192

Whois 20.100.185.192

IP Abuse Reports for 20.100.185.192:

This IP address has been reported a total of 108 times from 102 distinct sources. 20.100.185.192 was first reported on June 26th 2026, and the most recent report was 1 minute ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇩🇪 maxpower	2026-06-26 11:13:57 (1 minute ago)	(aggressive_scanner) REGOLA 9 - Aggressive Web Scanner 20.100.185.192 (NO/Norway/-): 1 in the last 3 ... show more (aggressive_scanner) REGOLA 9 - Aggressive Web Scanner 20.100.185.192 (NO/Norway/-): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: 20.100.185.192 - - [26/Jun/2026:13:13:53 +0200] "GET /wp-content/plugins/hellopress/wp_filemanager.php HTTP/1.1" 404 355 "-" "-" "-" host=pegasoadv.it show less	Port Scan
🇩🇪 Interceptor_HQ	2026-06-26 11:12:27 (2 minutes ago)	request_uri: /wp-content/plugins/hellopress/wp_filemanager.php -- automatic report --	Brute-Force Hacking
Anonymous	2026-06-26 11:00:12 (15 minutes ago)	IP banned by Fail2Ban in jail nginx-abusive-ips	Web App Attack Brute-Force Bad Web Bot
Anonymous	2026-06-26 10:58:50 (16 minutes ago)	20.100.185.192 - lightshot.sliver85.eu - [26/Jun/2026:12:58:44 +0200] "GET /wp-content/plugins/hello ... show more 20.100.185.192 - lightshot.sliver85.eu - [26/Jun/2026:12:58:44 +0200] "GET /wp-content/plugins/hellopress/wp_filemanager.php HTTP/1.1" 444 "-" 20.100.185.192 - lightshot.sliver85.eu - [26/Jun/2026:12:58:46 +0200] "GET /wp-content/plugins/hellopress/wp_filemanager.php HTTP/1.1" 444 "-" 20.100.185.192 - lightshot.sliver85.eu - [26/Jun/2026:12:58:49 +0200] "GET /wp-content/plugins/hellopress/wp_filemanager.php HTTP/1.1" 444 "-" ... show less	Brute-Force Web App Attack
🇬🇷 setupgr	2026-06-26 10:52:51 (22 minutes ago)	(mod_security) mod_security (id:1000001) triggered by 20.100.185.192 (NO/Norway/Oslo/Oslo/-/[AS8075 ... show more (mod_security) mod_security (id:1000001) triggered by 20.100.185.192 (NO/Norway/Oslo/Oslo/-/[AS8075 Microsoft Corporation]): 1 in the last 86400 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: [Fri Jun 26 13:52:47.268950 2026] [security2:error] [pid 890284:tid 890432] [client 20.100.185.192:34269] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/wp-content/plugins/hellopress/wp_filemanager.php" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec/modsec2.user.conf"] [line "103"] [id "1000001"] [msg "Bad file blocked: /wp-content/plugins/hellopress/wp_filemanager.php"] [severity "CRITICAL"] [tag "security"] [hostname "gyrosplace.gr"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "aj5Z_7hNSFlv5_DWCr5m2AAAAVg"] show less	Port Scan
🇺🇸 Epimetheus	2026-06-26 10:44:13 (31 minutes ago)	Unauthorized access attempts: [GET] /x2x.php [GET] /zxcs.php [GET] /wp-link-spm.php [GET] /ppp.php ... show more Unauthorized access attempts: [GET] /x2x.php [GET] /zxcs.php [GET] /wp-link-spm.php [GET] /ppp.php [GET] /wp-content/plugins/hellopress/wp_filemanager.php UA: Unknown show less	Web App Attack
🇺🇸 H24	2026-06-26 10:38:21 (36 minutes ago)	/db.php /2P.update.php /auu.php /wax.php /root.php /wgvsn.php /link.php /class.php /Q3.php /7.php	Web App Attack
Anonymous	2026-06-26 10:37:58 (37 minutes ago)	This IP was detected by CrowdSec triggering crowdsecurity/http-probing	Web App Attack Hacking
🇫🇷 Quarks Solutions	2026-06-26 10:35:05 (40 minutes ago)	crowdsecurity/http-probing	Web App Attack Hacking
🇺🇸 agenciahypelab.com.br	2026-06-26 10:33:16 (42 minutes ago)	WordPress login brute-force detectado e bloqueado pelo CSF/LFD. Trigger: LF_TRIGGER	Brute-Force SSH
🇱🇻 garmtech.com	2026-06-26 10:28:37 (46 minutes ago)	Attempted access to sensitive endpoint (/wp-content/plugins/hellopress/wp_filemanager.php) detected. ... show more Attempted access to sensitive endpoint (/wp-content/plugins/hellopress/wp_filemanager.php) detected. Automated scan or unauthorized probing. show less	Web App Attack
🇩🇪 8legz.net	2026-06-26 10:27:11 (48 minutes ago)	[Fri Jun 26 11:27:10.742470 2026] [php:error] [pid 1584371] [client 20.100.185.192:10164] script '/v ... show more [Fri Jun 26 11:27:10.742470 2026] [php:error] [pid 1584371] [client 20.100.185.192:10164] script '/var/www/html/this_is_a_new_hello_world.php' not found or unable to stat [Fri Jun 26 11:27:10.800492 2026] [php:error] [pid 1584371] [client 20.100.185.192:10164] script '/var/www/html/7.php' not found or unable to stat [Fri Jun 26 11:27:10.851003 2026] [php:error] [pid 1584371] [client 20.100.185.192:10164] script '/var/www/html/faze.php' not found or unable to stat ... show less	Brute-Force
🇩🇪 AetherFox	2026-06-26 10:27:04 (48 minutes ago)	AetherFox VoidGuard detected: [Fri Jun 26 10:27:03.152302 2026] [authz_core:error] [pid 2311654:tid ... show more AetherFox VoidGuard detected: [Fri Jun 26 10:27:03.152302 2026] [authz_core:error] [pid 2311654:tid 2311689] [client 20.100.185.192:39804] AH01630: client denied by server configuration: proxy:https://[MASKED]/wp-content/plugins/hellopress/wp_filemanager.php [Fri Jun 26 10:27:03.235807 2026] [authz_core:error] [pid 2311654:tid 2311687] [client 20.100.185.192:39804] AH01630: client denied by server configuration: proxy:https://[MASKED]/this_is_a_new_hello_world.php [Fri Jun 26 10:27:03.318036 2026] [authz_core:error] [pid 2311654:tid 2311696] [client 20.100.185.192:39804] AH01630: client denied by server configuration: proxy:https://[MASKED]/ingfo.php [Fri Jun 26 10:27:03.534673 2026] [authz_core:error] [pid 2311654:tid 2311691] [client 20.100.185.192:39804] AH01630: client denied by server configuration: proxy:https://[MASKED]/ops.php [Fri Jun 26 10:27:03.600336 2026] [authz_core:error] [pid 2311654:tid 2311695] [client 20.100.185.192:39804] AH01630: cli ... show less	Bad Web Bot Web App Attack
🇬🇧 SilverZippo	2026-06-26 10:24:43 (50 minutes ago)	Web App Attack	Web App Attack
🇫🇷 Lunix	2026-06-26 10:20:21 (54 minutes ago)		Brute-Force Web App Attack

Showing 1 to 15 of 108 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇸🇪 104.23.221.104

🇸🇬 43.160.215.203

🇮🇩 202.162.198.29

🇷🇺 193.232.240.50

🇮🇳 103.162.210.157

🇫🇷 91.231.89.215

🇰🇿 88.151.179.2

🇩🇪 69.5.169.178

🇺🇸 50.2.64.88

🇬🇧 35.203.211.97

🇧🇪 34.38.51.34

🇲🇽 187.190.35.163

🇩🇪 185.242.3.195

🇪🇨 177.234.244.81

🇺🇸 172.67.132.63

🇳🇱 171.22.183.41

🇨🇳 117.50.211.146

🇨🇳 101.96.220.237

🇺🇸 4.150.201.26

🇭🇰 2.59.152.29