JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 20.127.125.129

20.127.125.129 was found in our database!

This IP was reported 821 times. Confidence of Abuse is 100%: ?

100%

ISP	Microsoft Corporation
Usage Type	Data Center/Web Hosting/Transit
ASN	AS8075
Domain Name	microsoft.com
Country	🇺🇸 United States of America
City	Washington, Virginia

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 20.127.125.129

Whois 20.127.125.129

IP Abuse Reports for 20.127.125.129:

This IP address has been reported a total of 821 times from 586 distinct sources. 20.127.125.129 was first reported on July 17th 2026, and the most recent report was 1 hour ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇺🇸 kuroneko_omu	2026-07-19 16:51:02 (1 hour ago)	[autoreport] Probably Web App attack (eg. wp, phpmyadmin, ...)	Hacking Brute-Force Web App Attack
Anonymous	2026-07-19 16:06:20 (2 hours ago)	Blocked by FortiWeb WAF ML threat detection. ML probability: 99%, Country: US, Attack patterns: Word ... show more Blocked by FortiWeb WAF ML threat detection. ML probability: 99%, Country: US, Attack patterns: WordPress scanning, Webshell probing, Malicious User-Agent show less	Bad Web Bot Web App Attack
🇺🇸 jmraupe	2026-07-19 15:05:00 (3 hours ago)	Brute Force looking for installed scripts/apps	DDoS Attack Brute-Force Hacking
Anonymous	2026-07-19 10:18:00 (7 hours ago)	Bad behavior, 800+ reports. Looking for install scripts and other exploitable files. AS8075 scriptki ... show more Bad behavior, 800+ reports. Looking for install scripts and other exploitable files. AS8075 scriptkiddy / malicious Ai show less	Bad Web Bot Exploited Host Web App Attack Hacking
Anonymous	2026-07-19 10:14:09 (7 hours ago)	Bulk report from WAF Auto-Blocker Dashboard	Brute-Force SSH
🇳🇱 JCB	2026-07-19 08:11:00 (9 hours ago)	20.127.125.129 - - [18/Jul/2026:20:15:26 +0300] "GET /assets/images/about.php HTTP/1.1" 404 196 "-" ... show more 20.127.125.129 - - [18/Jul/2026:20:15:26 +0300] "GET /assets/images/about.php HTTP/1.1" 404 196 "-" "-" 20.127.125.129 - - [18/Jul/2026:20:15:26 +0300] "GET /wp-content/uploads/json.php HTTP/1.1" 404 196 "-" "-" ... show less	Web App Attack Hacking
🇺🇸 Som1ght3n	2026-07-19 07:55:10 (10 hours ago)	Attempted to access a known backdoor file (`/shell.php`) on a web server.	Hacking
🇫🇷 Donovan	2026-07-19 07:54:47 (10 hours ago)	Web scan/exploit blocked by fail2ban on commitshift.fr - jail: npm-http - 10 attempt(s)	Web App Attack
🇩🇪 hchristo	2026-07-19 07:52:03 (10 hours ago)	[Sun Jul 19 09:51:57.836110 2026] [proxy_fcgi:error] [pid 10615:tid 10683] [client 20.127.125.129:55 ... show more [Sun Jul 19 09:51:57.836110 2026] [proxy_fcgi:error] [pid 10615:tid 10683] [client 20.127.125.129:55277] AH01071: Got error 'Primary script unknown' [Sun Jul 19 09:51:58.476483 2026] [proxy_fcgi:error] [pid 10615:tid 10699] [client 20.127.125.129:55277] AH01071: Got error 'Primary script unknown' [Sun Jul 19 09:52:01.553128 2026] [proxy_fcgi:error] [pid 10615:tid 10694] [client 20.127.125.129:55277] AH01071: Got error 'Primary script unknown' [Sun Jul 19 09:52:01.750146 2026] [proxy_fcgi:error] [pid 10615:tid 10692] [client 20.127.125.129:55277] AH01071: Got error 'Primary script unknown' [Sun Jul 19 09:52:03.158205 2026] [proxy_fcgi:error] [pid 10615:tid 10706] [client 20.127.125.129:55277] AH01071: Got error 'Primary script unknown' ... show less	Brute-Force
Anonymous	2026-07-19 07:47:56 (10 hours ago)	20.127.125.129 - - [19/Jul/2026:07:47:54 +0000] "GET /cgi-bin/upfile.php HTTP/1.1" 404 146 "-" "-" " ... show more 20.127.125.129 - - [19/Jul/2026:07:47:54 +0000] "GET /cgi-bin/upfile.php HTTP/1.1" 404 146 "-" "-" "-" 20.127.125.129 - - [19/Jul/2026:07:47:55 +0000] "GET /wp-login.php HTTP/1.1" 404 146 "-" "-" "-" ... show less	Port Scan Hacking Bad Web Bot
🇫🇮 mnazibo	2026-07-19 07:45:06 (10 hours ago)	Date: Jul 19 10:10:57 2026 EAT \| Reported IP: 20.127.125.129 mod_security \| id: 930130 949110 \| US/u ... show more Date: Jul 19 10:10:57 2026 EAT \| Reported IP: 20.127.125.129 mod_security \| id: 930130 949110 \| US/usernameab.my_domain/- \| Connections: 1 \| Blocked: Permanent Block: [LF_MODSEC] \| Logs: ; Restricted File Access Attempt; Inbound Anomaly Score Exceeded (Total Score: 5); Restricted File Access Attempt; Inbound Anomaly Score Exceeded (Total Score: 5) show less	SQL Injection Brute-Force Bad Web Bot
Anonymous	2026-07-19 07:35:26 (10 hours ago)	[19/Jul/2026:07:35:25 +0000] host=voyager.lovelyrender.app server=voyager.lovelyrender.app ip=20.127 ... show more [19/Jul/2026:07:35:25 +0000] host=voyager.lovelyrender.app server=voyager.lovelyrender.app ip=20.127.125.129 method=GET req=/shell.php uri=/shell.php status=404 bytes=27 rt=0.001 urt=0.001 ref="-" ua="-" ... show less	Web App Attack Bad Web Bot
Anonymous	2026-07-19 07:32:02 (10 hours ago)	20.127.125.129 - - [19/Jul/2026:07:31:57 +0000] "GET /wp-content/plugins/hellopress/wp_filemanager.p ... show more 20.127.125.129 - - [19/Jul/2026:07:31:57 +0000] "GET /wp-content/plugins/hellopress/wp_filemanager.php HTTP/1.1" 302 630 "-" "-" 20.127.125.129 - - [19/Jul/2026:07:32:00 +0000] "GET /wp-content/plugins/hellopress/wp_filemanager.php HTTP/1.1" 404 31060 "-" "-" 20.127.125.129 - - [19/Jul/2026:07:32:01 +0000] "GET /wp-admin/images/wp-login.php HTTP/1.1" 302 590 "-" "-" 20.127.125.129 - - [19/Jul/2026:07:32:01 +0000] "GET /wp-admin/images/wp-login.php HTTP/1.1" 404 27756 "-" "-" 20.127.125.129 - - [ ... show less	Web App Attack
🇬🇧 Blake	2026-07-19 07:30:14 (10 hours ago)	20.127.125.129 "-" "-" - [19/Jul/2026:07:30:13 +0000] "GET /wp-content/plugins/hellopress/wp_fileman ... show more 20.127.125.129 "-" "-" - [19/Jul/2026:07:30:13 +0000] "GET /wp-content/plugins/hellopress/wp_filemanager.php HTTP/1.1" 404 "-" ATTACK ... show less	Web App Attack
🇫🇷 Stylottica	2026-07-19 07:27:34 (10 hours ago)	PrestaShop Security Module: suspicious probe path detected (/admin/)	Web App Attack

Showing 1 to 15 of 821 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇮🇳 103.168.19.193

🇺🇸 34.169.214.247

🇨🇳 111.42.175.101

🇺🇸 47.251.78.116

🇦🇷 45.238.105.149

🇺🇸 2602:80d:1008::6b

🇨🇴 186.87.82.140

🇺🇸 172.202.30.177

🇮🇹 151.33.87.179

🇳🇱 107.189.27.179

🇮🇷 94.184.17.134

🇻🇳 27.79.6.202

🇧🇷 20.206.89.130

🇮🇳 116.74.204.218

🇨🇳 115.46.88.68

🇮🇳 103.21.55.206

🇧🇬 78.128.114.58

🇫🇷 75.119.157.55

🇺🇸 62.146.225.52

🇮🇳 27.123.113.10