JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 20.104.99.15

20.104.99.15 was found in our database!

This IP was reported 254 times. Confidence of Abuse is 100%: ?

100%

ISP	Microsoft Corporation
Usage Type	Data Center/Web Hosting/Transit
ASN	AS8075
Domain Name	microsoft.com
Country	🇨🇦 Canada
City	Toronto, Ontario

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 20.104.99.15

Whois 20.104.99.15

IP Abuse Reports for 20.104.99.15:

This IP address has been reported a total of 254 times from 221 distinct sources. 20.104.99.15 was first reported on May 31st 2026, and the most recent report was 1 day ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇺🇸 mw	2026-06-01 00:00:37 (3 days ago)	GET /wp-admin/maint/index.php HTTP/1.1	Web App Attack
🇷🇴 andreighitan	2026-06-01 00:00:00 (3 days ago)	Coordinated Azure webshell scanning campaign against 84.46.253.134. Active May-Jun 2026. ZAC Bayern ... show more Coordinated Azure webshell scanning campaign against 84.46.253.134. Active May-Jun 2026. ZAC Bayern ref BY0257-500359-26/8. show less	Brute-Force
🇩🇪 AetherFox	2026-05-31 23:54:22 (3 days ago)	AetherFox VoidGuard detected: [Sun May 31 23:54:20.709692 2026] [authz_core:error] [pid 2516581:tid ... show more AetherFox VoidGuard detected: [Sun May 31 23:54:20.709692 2026] [authz_core:error] [pid 2516581:tid 2516609] [client 20.104.99.15:43995] AH01630: client denied by server configuration: proxy:http://[MASKED]/wp-content/plugins/hellopress/wp_filemanager.php [Sun May 31 23:54:20.709763 2026] [authz_core:error] [pid 2516581:tid 2516609] [client 20.104.99.15:43995] AH01630: client denied by server configuration: /var/www/html/ERRORpages/403.html [Sun May 31 23:54:20.807609 2026] [authz_core:error] [pid 2516581:tid 2516617] [client 20.104.99.15:43995] AH01630: client denied by server configuration: proxy:http://[MASKED]/x.php [Sun May 31 23:54:20.807684 2026] [authz_core:error] [pid 2516581:tid 2516617] [client 20.104.99.15:43995] AH01630: client denied by server configuration: /var/www/html/ERRORpages/403.html [Sun May 31 23:54:20.953356 2026] [authz_core:error] [pid 2516581:tid 2516618] [client 20.104.99.15:43995] AH01630: client denied by server configuration: pr ... show less	Bad Web Bot Web App Attack
🇫🇮 kumiko	2026-05-31 23:46:36 (3 days ago)	[2026-06-01 02:46:35] Probing for exploits [1 requests] "GET //wp-includes/css/dist/ HTTP/1.1" 301	Brute-Force Bad Web Bot Web App Attack
🇩🇪 webanyone	2026-05-31 23:45:20 (3 days ago)	Apache web server attack detected by Fail2Ban in plesk-apache jail	Web App Attack
🇩🇪 4server	2026-05-31 23:41:27 (3 days ago)	[MonJun0101:41:21.0992752026][security2:error][pid1886649:tid1886772][client20.104.99.15:0]ModSecuri ... show more [MonJun0101:41:21.0992752026][security2:error][pid1886649:tid1886772][client20.104.99.15:0]ModSecurity:Accessdeniedwithcode403\(phase2\).Patternmatch\"modules/mod_simplefileuploadv1\\\\\\\\.3\"atREQUEST_URI.[file\"/etc/apache2/conf.d/modsec_rules/99_asl_jitp.conf\"][line\"640\"][id\"390746\"][rev\"1\"][msg\"Atomicorp.comWAFRules-VirtualJustInTimePatch:KnownVulnerableJoomlaSimpleFileUploadv1.3Accessblocked\"][hostname\"autodiscover.areatbroker.ch\"][uri\"/modules/mod_simplefileuploadv1.3/elements/filemanager.php\"][unique_id\"ahzHIW_zVvyAi7XgiuI8rgAAAMw\"] show less	Port Scan Brute-Force Web App Attack
🇨🇭 Mario Bretscher	2026-05-31 23:38:18 (3 days ago)	[Mon Jun 01 01:38:16.992890 2026] [php:error] [pid 1893643] [client 20.104.99.15:57589] script '/var ... show more [Mon Jun 01 01:38:16.992890 2026] [php:error] [pid 1893643] [client 20.104.99.15:57589] script '/var/www/html/x.php' not found or unable to stat [Mon Jun 01 01:38:17.104959 2026] [php:error] [pid 1893643] [client 20.104.99.15:57589] script '/var/www/html/wss.php' not found or unable to stat [Mon Jun 01 01:38:17.210285 2026] [php:error] [pid 1893643] [client 20.104.99.15:57589] script '/var/www/html/ultra.php' not found or unable to stat ... show less	Web App Attack
🇫🇮 kumiko	2026-05-31 23:26:30 (3 days ago)	[2026-06-01 02:26:29] Apache auth failure: brute force attempt, file probing	Brute-Force Bad Web Bot
🇧🇷 Halux	2026-05-31 23:26:02 (3 days ago)	20.104.99.15 Probing protected path or service	Web App Attack
🇫🇮 NoaQT	2026-05-31 23:21:14 (3 days ago)	2026-05-31T23:21:12.636230+00:00 ingress-1 haproxy[18251]: 20.104.99.15:10229 [31/May/2026:23:21:12. ... show more 2026-05-31T23:21:12.636230+00:00 ingress-1 haproxy[18251]: 20.104.99.15:10229 [31/May/2026:23:21:12.635] https_in https_in/<NOSRV> 0/-1/-1/-1/0 429 225 - - PR-- 97/96/0/0/0 0/0 "GET /hellcut.php HTTP/1.1" 2026-05-31T23:21:12.772223+00:00 ingress-1 haproxy[18251]: 20.104.99.15:10229 [31/May/2026:23:21:12.772] https_in https_in/<NOSRV> 0/-1/-1/-1/0 429 225 - - PR-- 97/96/0/0/0 0/0 "GET /tdd.php HTTP/1.1" 2026-05-31T23:21:12.904294+00:00 ingress-1 haproxy[18251]: 20.104.99.15:10229 [31/May/2026:23:21:12.904] https_in https_in/<NOSRV> 0/-1/-1/-1/0 429 225 - - PR-- 97/96/0/0/0 0/0 "GET /wander.php HTTP/1.1" 2026-05-31T23:21:13.036278+00:00 ingress-1 haproxy[18251]: 20.104.99.15:10229 [31/May/2026:23:21:13.036] https_in https_in/<NOSRV> 0/-1/-1/-1/0 429 225 - - PR-- 97/96/0/0/0 0/0 "GET /ha.php HTTP/1.1" 2026-05-31T23:21:13.174429+00:00 ingress-1 haproxy[18251]: 20.104.99.15:10229 [31/May/2026:23:21:13.174] https_in https_in/<NOSRV> 0/-1/-1/-1/0 429 225 - - PR-- 97/96/0/0/0 0/0 "GET /155.php ... show less	DDoS Attack
🇦🇺 Anytech	2026-05-31 23:19:01 (3 days ago)	Blocked by Conn-Monitor: Web scanning activity	Hacking Web App Attack
🇺🇸 CollideTech	2026-05-31 23:18:11 (3 days ago)	probing for vulnerabilities	Web App Attack
🇦🇺 artful	2026-05-31 23:16:00 (3 days ago)	Excessive errors in recent hours	Web App Attack
🇩🇪 LRob.fr	2026-05-31 23:00:04 (3 days ago)	Repeated attacks detected by Fail2Ban in recidive jail	Hacking
🇨🇿 ptlab	2026-05-31 22:45:15 (3 days ago)	Detected wp_admin attack from WP-host.	Hacking Web App Attack

Showing 46 to 60 of 254 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇧🇪 198.235.24.199

🇦🇸 198.52.29.77

🇦🇪 198.38.94.14

🇸🇬 194.5.82.103

🇬🇧 193.163.125.44

🇳🇱 192.42.116.58

🇺🇸 172.172.30.79

🇭🇰 101.32.208.155

🇷🇺 87.226.190.225

🇫🇷 86.247.28.221

🇺🇸 65.49.1.208

🇺🇸 47.88.29.50

🇸🇬 45.82.78.100

🇬🇧 45.82.76.126

🇩🇪 43.228.157.8

🇧🇷 187.87.237.121

🇳🇱 165.22.197.84

🇺🇸 162.216.149.176

🇺🇸 159.89.38.103

🇸🇬 152.42.219.134