JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 20.12.204.106

20.12.204.106 was found in our database!

This IP was reported 448 times. Confidence of Abuse is 100%: ?

100%

ISP	Microsoft Corporation
Usage Type	Data Center/Web Hosting/Transit
ASN	AS8075
Domain Name	microsoft.com
Country	🇺🇸 United States of America
City	Des Moines, Iowa

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 20.12.204.106

Whois 20.12.204.106

IP Abuse Reports for 20.12.204.106:

This IP address has been reported a total of 448 times from 182 distinct sources. 20.12.204.106 was first reported on April 18th 2026, and the most recent report was 2 weeks ago.

Old Reports: The most recent abuse report for this IP address is from 2 weeks ago . It is possible that this IP is no longer involved in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
Anonymous	2026-05-03 23:47:19 (1 month ago)	(wp-php-upload-includes) Block attempt to access .php in uploads wordpress uploads or well-known 20. ... show more (wp-php-upload-includes) Block attempt to access .php in uploads wordpress uploads or well-known 20.12.204.106 (US/United States/-) show less	Brute-Force
🇩🇪 big-cloud.nl	2026-05-03 23:43:31 (1 month ago)	Try to access /xmlrpc.php	Web App Attack
🇦🇹 penguin-solutions.at	2026-05-03 23:25:06 (1 month ago)	Excessive 403/404 errors ...	Brute-Force Web App Attack
🇩🇪 macrob	2026-05-03 22:08:37 (1 month ago)	2026/05/03 22:08:33 [error] 3914565#3914565: 198370648 access forbidden by rule, client: 20.12.204. ... show more 2026/05/03 22:08:33 [error] 3914565#3914565: 198370648 access forbidden by rule, client: 20.12.204.106, server: infinsa.com, request: "GET /wp-content/themes/admin.php HTTP/2.0", host: "infinsa.com" 2026/05/03 22:08:35 [error] 3914566#3914566: 198370689 access forbidden by rule, client: 20.12.204.106, server: infinsa.com, request: "GET /wp-content/admin.php HTTP/2.0", host: "infinsa.com" 2026/05/03 22:08:35 [error] 3914565#3914565: 198370666 access forbidden by rule, client: 20.12.204.106, server: infinsa.com, request: "GET /wp-includes/assets/index.php HTTP/2.0", host: "infinsa.com" ... show less	Web App Attack
🇳🇱 Site.eu	2026-05-03 19:06:50 (1 month ago)	Excessive multi-domain requests	Brute-Force
🇩🇪 BlueWire Hosting	2026-05-03 18:40:45 (1 month ago)	Probing websites for vulnerabilities	Web App Attack SQL Injection
🇩🇪 4server	2026-05-03 18:30:36 (1 month ago)	[SunMay0320:30:32.3931092026][security2:error][pid3376701:tid3376780][client20.12.204.106:0]ModSecur ... show more [SunMay0320:30:32.3931092026][security2:error][pid3376701:tid3376780][client20.12.204.106:0]ModSecurity:Accessdeniedwithcode403$phase2$.Patternmatch\"\^/wp-content/$uploads\\|cache\\|backup\\|backups\\|upgrade\\|ai1wm-backups$/.\*\\\\\\\\.ph$p[0-9]\?\\|tml\\|ar$\$\"atREQUEST_URI.[file\"/etc/apache2/conf.d/modsec_custom_rules.conf\"][line\"317\"][id\"990070\"][msg\"PHPexecutionblockedinstoragedirectory\"][hostname\"respiratrentino.it\"][uri\"/wp-content/upgrade/index.php\"][unique_id\"afeUSFaKPwReOflkQTU0GAAAAJI\"] show less	Port Scan Brute-Force Web App Attack
🇩🇪 macrob	2026-05-03 18:11:01 (1 month ago)	2026/05/03 18:10:58 [error] 3914566#3914566: 198029245 access forbidden by rule, client: 20.12.204. ... show more 2026/05/03 18:10:58 [error] 3914566#3914566: 198029245 access forbidden by rule, client: 20.12.204.106, server: infinsa.com, request: "GET /wp-content/themes/admin.php HTTP/2.0", host: "www.infinsa.com" 2026/05/03 18:10:59 [error] 3914566#3914566: 198029243 access forbidden by rule, client: 20.12.204.106, server: infinsa.com, request: "GET /wp-content/admin.php HTTP/2.0", host: "www.infinsa.com" 2026/05/03 18:10:59 [error] 3914562#3914562: 198029316 access forbidden by rule, client: 20.12.204.106, server: infinsa.com, request: "GET /wp-includes/assets/index.php HTTP/2.0", host: "www.infinsa.com" ... show less	Web App Attack
Anonymous	2026-05-03 17:53:08 (1 month ago)	[Drupal AbuseIPDB module] Request path is blacklisted. /wp-content/themes/admin.php	Web App Attack
Anonymous	2026-05-03 17:47:06 (1 month ago)	20.12.204.106 - - [03/May/2026:17:47:06 +0000] "GET /admin/function.php HTTP/2.0" 404 1005 "-" "Moz ... show more 20.12.204.106 - - [03/May/2026:17:47:06 +0000] "GET /admin/function.php HTTP/2.0" 404 1005 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" "20.12.204.106" "-" ... show less	Web App Attack
🇪🇸 el-brujo	2026-05-03 17:26:01 (1 month ago)	Cloudflare WAF: Request Path: /xmlrpc.php Request Query: Host: whk.elhacker.net userAgent: Mozilla/ ... show more Cloudflare WAF: Request Path: /xmlrpc.php Request Query: Host: whk.elhacker.net userAgent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Action: managed_challenge Source: firewallManaged ASN Description: Microsoft Corporation Country: US Method: GET Timestamp: 2026-05-03T17:26:01Z ruleId: 5de7edfa648c4d6891dc3e7f84534ffa. Report generated by Cloudflare-WAF-to-AbuseIPDB (https://github.com/MHG-LAB/Cloudflare-WAF-to-AbuseIPDB). show less	Hacking SQL Injection Web App Attack
Anonymous	2026-05-03 17:09:46 (1 month ago)	Aggressive web scan	Web App Attack
🇱🇻 garmtech.com	2026-05-03 17:05:44 (1 month ago)	Attempted access to sensitive endpoint (/wp-content/themes/admin.php) detected. Automated scan or un ... show more Attempted access to sensitive endpoint (/wp-content/themes/admin.php) detected. Automated scan or unauthorized probing. show less	Web App Attack
🇱🇻 garmtech.com	2026-05-03 13:24:11 (1 month ago)	Attempted access to sensitive endpoint (/wp-admin/maint/index.php) detected. Automated scan or unaut ... show more Attempted access to sensitive endpoint (/wp-admin/maint/index.php) detected. Automated scan or unauthorized probing. show less	Web App Attack
🇺🇸 ipblock.com	2026-05-03 10:42:00 (1 month ago)	IPBlock protected site ID [4055-d][s=06]. Exploit request, vulnerability scanner.	Hacking Bad Web Bot Web App Attack

Showing 91 to 105 of 448 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇨🇳 180.153.236.69

🇫🇮 135.181.182.250

🇳🇱 204.76.203.10

🇲🇺 197.225.146.23

🇮🇳 183.87.215.181

🇬🇧 148.252.140.74

🇨🇦 85.217.149.49

🇺🇸 65.49.1.125

🇺🇸 64.62.156.76

🇩🇪 213.209.159.56

🇨🇷 201.203.101.30

🇨🇳 117.174.69.97

🇧🇩 45.64.165.213

🇨🇳 39.78.139.61

🇬🇧 35.203.211.105

🇺🇸 206.81.7.82

🇺🇸 205.209.118.37

🇮🇳 202.53.94.246

🇺🇸 172.236.228.224

🇺🇸 172.104.11.4