JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 20.101.191.66

20.101.191.66 was found in our database!

This IP was reported 402 times. Confidence of Abuse is 14%: ?

14%

ISP	Microsoft Corporation
Usage Type	Data Center/Web Hosting/Transit
ASN	AS8075
Domain Name	microsoft.com
Country	🇳🇱 Netherlands
City	Amsterdam, North Holland

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 20.101.191.66

Whois 20.101.191.66

IP Abuse Reports for 20.101.191.66:

This IP address has been reported a total of 402 times from 139 distinct sources. 20.101.191.66 was first reported on February 25th 2026, and the most recent report was 3 days ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇩🇪 4server	2026-09-27 13:46:33 (3 days ago)	[SunSep2715:46:30.3883092026][security2:error][pid3717026:tid3717063][client20.101.191.66:0]ModSecur ... show more [SunSep2715:46:30.3883092026][security2:error][pid3717026:tid3717063][client20.101.191.66:0]ModSecurity:Accessdeniedwithcode403$phase2$.Patternmatch\"$\?:\\\\\\\\\$\(\?:\\\\\\\\\(\(\?:\\\\\\\\\(.\\\\\\\\\$\\|.\\)\\\\\\\\\)\\|\\\\\\\\{.\\\\\\\\\}\)\\|[\<\>]\\\\\\\\$.\\\\\\\\\$\)\"atARGS:0.[file\"/etc/apache2/conf.d/modsec_rules/10_asl_rules.conf\"][line\"396\"][id\"393655\"][rev\"17\"][msg\"Atomicorp.comWAFRules:PossibleRemoteCommandExecution:UnixShellExpressionFound\"][data\"MatchedData:\${encodeuricomponent$string\(res$\)}307\`}\)_chunks:\$q2_formdata:{get:\$1:constructor:constructor}}}foundwithinARGS:0:{then:\$1:__proto__:thenstatus:resolved_modelreason:-1value:{then:\$b1337}_response:{_prefix:varres=$function\(${var_r=typeofrequire\!==undefined\?require:$process.mainmodule\?process.mainmodule.require.bind\(process.mainmodule$:$typeofglobalthis.require\!==undefined\?globalthis.require:null$\)returnvuln_check_success_69420}\)throwobject.assign\(newerror\(next_redirect...\"][tag\"attack-rce show less	Port Scan Brute-Force Web App Attack
🇫🇷 masterguru	2026-09-17 00:23:55 (1 week ago)	(modsec_5080) ModSec 5080: Infrastructure subdomain probe from 20.101.191.66 (NL/The Netherlands/-): ... show more (modsec_5080) ModSec 5080: Infrastructure subdomain probe from 20.101.191.66 (NL/The Netherlands/-): 2 in the last 3600 secs (0-196) show less	Hacking
🇮🇳 evicky2002	2026-04-29 17:37:15 (5 months ago)	Confirmed malicious by STILWaters CTI (score≥85)	Hacking Brute-Force SSH
🇫🇷 tecnicorioja	2026-04-10 14:00:47 (5 months ago)	Failed password for invalid user Apr 10 12:29:01 port 54977	Brute-Force SSH
🇩🇪 nicosqc	2026-04-10 12:14:27 (5 months ago)	Invalid user centos from 20.101.191.66 port 54977	Brute-Force SSH
🇩🇪 nicosqc	2026-04-10 12:10:21 (5 months ago)	Invalid user centos from 20.101.191.66 port 54856	Brute-Force SSH
🇩🇪 formality	2026-04-10 12:01:23 (5 months ago)	Invalid user webmaster from 20.101.191.66 port 54852	Brute-Force SSH
🇩🇪 formality	2026-04-10 11:50:38 (5 months ago)	Invalid user webmaster from 20.101.191.66 port 54978	Brute-Force SSH
🇳🇱 Alboweb B.V.	2026-04-10 11:11:24 (5 months ago)	SSH abuse or brute-force attack detected by Fail2Ban in ssh jail	Brute-Force SSH
Anonymous	2026-04-10 11:10:13 (5 months ago)	2026-04-10T11:58:42.242207+01:00 lXXX.com sshd[2861112]: pam_unix(sshd:auth): authentication failure ... show more 2026-04-10T11:58:42.242207+01:00 lXXX.com sshd[2861112]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=20.101.191.66 2026-04-10T11:58:44.253974+01:00 lXXX.com sshd[2861112]: Failed password for invalid user centos from 20.101.191.66 port 54849 ssh2 2026-04-10T12:10:13.150365+01:00 lXXX.com sshd[2862718]: Invalid user centos from 20.101.191.66 port 54850 ... show less	Brute-Force SSH
🇩🇪 rd1742	2026-04-10 11:10:01 (5 months ago)	2026-04-10 11:10:00,881 quad proftpd[1444136] 2a03:4000:3e:312:360a:466c:8ea1:45b9 (20.101.191.66[20 ... show more 2026-04-10 11:10:00,881 quad proftpd[1444136] 2a03:4000:3e:312:360a:466c:8ea1:45b9 (20.101.191.66[20.101.191.66]): USER centos: no such user found from 20.101.191.66 [20.101.191.66] to 2.56.97.107:22 show less	Brute-Force Exploited Host SSH
🇩🇪 mcb-it.de	2026-04-10 11:10:01 (5 months ago)	Apr 10 13:09:38 mcb-it sshd[2918437]: pam_unix(sshd:auth): authentication failure; logname= uid=0 eu ... show more Apr 10 13:09:38 mcb-it sshd[2918437]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=20.101.191.66 Apr 10 13:09:40 mcb-it sshd[2918437]: Failed password for invalid user centos from 20.101.191.66 port 54850 ssh2 Apr 10 13:09:41 mcb-it sshd[2918437]: error: PAM: Authentication failure for illegal user centos from 20.101.191.66 Apr 10 13:09:41 mcb-it sshd[2918437]: Failed keyboard-interactive/pam for invalid user centos from 20.101.191.66 port 54850 ssh2 Apr 10 13:09:41 mcb-it sshd[2918437]: Connection closed by invalid user centos 20.101.191.66 port 54850 [preauth] ... show less	Brute-Force SSH
🇺🇸 drewf.ink	2026-04-10 11:09:58 (5 months ago)	[11:09] Attempted SSH login on port 22 with credentials centos:fa	Brute-Force SSH
🇫🇷 inpec.fr	2026-04-10 11:07:30 (5 months ago)	$f2bV_matches	Brute-Force
Anonymous	2026-04-10 11:04:30 (5 months ago)	Apr 10 11:04:28 scw-6657dc sshd[28491]: pam_unix(sshd:auth): authentication failure; logname= uid=0 ... show more Apr 10 11:04:28 scw-6657dc sshd[28491]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=20.101.191.66 Apr 10 11:04:28 scw-6657dc sshd[28491]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=20.101.191.66 Apr 10 11:04:30 scw-6657dc sshd[28491]: Failed password for invalid user centos from 20.101.191.66 port 54852 ssh2 ... show less	Brute-Force SSH

Showing 1 to 15 of 402 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇬🇧 2a06:4884:d000::fa

🇺🇸 194.180.233.246

🇧🇷 191.5.36.216

🇺🇸 173.46.91.236

🇧🇷 138.36.105.14

🇧🇪 74.125.225.140

🇺🇸 48.217.66.25

🇳🇱 45.148.10.152

🇵🇱 45.138.12.7

🇺🇸 192.236.223.56

🇨🇳 120.48.80.70

🇧🇩 103.171.69.189

🇸🇬 47.79.13.79

🇰🇷 220.123.33.105

🇵🇭 136.158.60.162

🇱🇹 77.90.185.5

🇰🇷 20.214.151.17

🇩🇪 195.227.245.104

🇦🇿 188.253.209.142

🇨🇴 181.234.163.98