JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 20.127.18.0

20.127.18.0 was found in our database!

This IP was reported 658 times. Confidence of Abuse is 100%: ?

100%

ISP	Microsoft Corporation
Usage Type	Data Center/Web Hosting/Transit
ASN	AS8075
Domain Name	microsoft.com
Country	🇺🇸 United States of America
City	Washington, Virginia

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 20.127.18.0

Whois 20.127.18.0

IP Abuse Reports for 20.127.18.0:

This IP address has been reported a total of 658 times from 480 distinct sources. 20.127.18.0 was first reported on July 19th 2026, and the most recent report was 54 minutes ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇫🇷 ACE-INFORMATIQUE.NC	2026-07-20 19:00:05 (54 minutes ago)	Bad Web Bot + Web App Attack blocked by Fail2ban	Bad Web Bot Web App Attack
Anonymous	2026-07-20 17:02:48 (2 hours ago)	Blocked by FortiWeb WAF ML threat detection. ML probability: 99%, Country: US, Attack patterns: Word ... show more Blocked by FortiWeb WAF ML threat detection. ML probability: 99%, Country: US, Attack patterns: WordPress scanning, Malicious User-Agent show less	Bad Web Bot Web App Attack
🇺🇸 EvilTurkey	2026-07-20 16:55:44 (2 hours ago)	Web app attack against financial institution website.	Web App Attack Hacking
Anonymous	2026-07-20 16:42:00 (3 hours ago)	Scriptkiddy at MS. 50 plus reports for malicious behavior. AS8075 Permaban	Web App Attack Hacking
🇺🇸 drewking	2026-07-20 15:56:45 (3 hours ago)	67 malicious / suspicious requests. Ports: 403 /php.php, 403 /edit.php, 403 /ftde.php, 403 /sump.php ... show more 67 malicious / suspicious requests. Ports: 403 /php.php, 403 /edit.php, 403 /ftde.php, 403 /sump.php, 403 /wp-content/plugins/hellopress/wp_filemanager.php. show less	Web App Attack Hacking
🇫🇷 geot	2026-07-20 10:30:55 (9 hours ago)	WordPress scanning bot	Hacking Bad Web Bot Web App Attack
🇫🇷 IRISIO	2026-07-20 09:37:28 (10 hours ago)	scans/SQL injection/spam posts : 52 queries	Web App Attack SQL Injection
🇳🇱 JCB	2026-07-20 08:23:00 (11 hours ago)	20.127.18.0 - - [20/Jul/2026:08:19:18 +0300] "GET /wp-content/plugins/hellopress/wp_filemanager.php ... show more 20.127.18.0 - - [20/Jul/2026:08:19:18 +0300] "GET /wp-content/plugins/hellopress/wp_filemanager.php HTTP/1.1" 404 236 "-" "-" 20.127.18.0 - - [20/Jul/2026:08:19:33 +0300] "GET /ops.php HTTP/1.1" 404 236 "-" "-" ... show less	Brute-Force Web App Attack Hacking
🇳🇱 middelkoopcc	2026-07-20 08:15:06 (11 hours ago)	2026-07-20 10:09:04 [client 20.127.18.0:16950] AH01071: Got error 'Primary script unknown' && 2026-0 ... show more 2026-07-20 10:09:04 [client 20.127.18.0:16950] AH01071: Got error 'Primary script unknown' && 2026-07-20 10:09:04 [client 20.127.18.0:16950] AH01071: Got error 'Primary script unknown' && 2026-07-20 10:09:04 [client 20.127.18.0:16950] AH01071: Got error 'Primary script unknown' && 62 more within 20 minutes show less	Web App Attack
🇫🇷 guillaume illien	2026-07-20 08:13:15 (11 hours ago)	20.127.18.0 - - [20/Jul/2026:08:13:12 +0000] "GET /wp-content/plugins/hellopress/wp_filemanager.php ... show more 20.127.18.0 - - [20/Jul/2026:08:13:12 +0000] "GET /wp-content/plugins/hellopress/wp_filemanager.php HTTP/1.1" 301 178 "-" "-" 20.127.18.0 - - [20/Jul/2026:08:13:13 +0000] "GET /this_is_a_new_hello_world.php HTTP/1.1" 301 178 "-" "-" 20.127.18.0 - - [20/Jul/2026:08:13:13 +0000] "GET /ops.php HTTP/1.1" 301 178 "-" "-" 20.127.18.0 - - [20/Jul/2026:08:13:13 +0000] "GET /sump.php HTTP/1.1" 301 178 "-" "-" 20.127.18.0 - - [20/Jul/2026:08:13:14 +0000] "GET /echkm.php HTTP/1.1" 301 178 "-" "-" 20.127.18.0 - - [20/Jul/2026:08:13:14 +0000] "GET /pbck.php HTTP/1.1" 301 178 "-" "-" 20.127.18.0 - - [20/Jul/2026:08:13:14 +0000] "GET /xyn.php HTTP/1.1" 301 178 "-" "-" ... show less	Hacking Brute-Force Web App Attack SSH
🇫🇮 Christopher Hughes	2026-07-20 08:11:34 (11 hours ago)	[Mon Jul 20 09:01:27.072518 2026] [proxy_fcgi:error] [pid 1978372:tid 139825839580736] [client 20.12 ... show more [Mon Jul 20 09:01:27.072518 2026] [proxy_fcgi:error] [pid 1978372:tid 139825839580736] [client 20.127.18.0:11077] AH01071: Got error 'Primary script unknown' [Mon Jul 20 09:01:27.184084 2026] [proxy_fcgi:error] [pid 1978372:tid 139825990583872] [client 20.127.18.0:11077] AH01071: Got error 'Primary script unknown' [Mon Jul 20 09:11:34.101962 2026] [proxy_fcgi:error] [pid 1978372:tid 139826535847488] [client 20.127.18.0:11130] AH01071: Got error 'Primary script unknown' [Mon Jul 20 09:11:34.213705 2026] [proxy_fcgi:error] [pid 1978372:tid 139825965405760] [client 20.127.18.0:11130] AH01071: Got error 'Primary script unknown' [Mon Jul 20 09:11:34.333580 2026] [proxy_fcgi:error] [pid 1978372:tid 139826519062080] [client 20.127.18.0:11130] AH01071: Got error 'Primary script unknown' ... show less	Web App Attack
🇩🇪 Melle	2026-07-20 08:08:00 (11 hours ago)	Blocked by CrowdSec \| Scenario: crowdsecurity/http-probing \| 20.127.18.0 triggered 11 events \| Detec ... show more Blocked by CrowdSec \| Scenario: crowdsecurity/http-probing \| 20.127.18.0 triggered 11 events \| Detected: 2026-07-20T08:07:58.006751027Z show less	Web App Attack Hacking
🇫🇮 Daniel Baer	2026-07-20 08:00:03 (11 hours ago)	CrowdSec local HTTP alert scenario: crowdsecurity/http-probing alert_id: 1428 events: 11 created_at: ... show more CrowdSec local HTTP alert scenario: crowdsecurity/http-probing alert_id: 1428 events: 11 created_at: 2026-07-20T07:59:50Z message: Ip 20.127.18.0 performed 'crowdsecurity/http-probing' (11 events over 2.199816096s) at 2026-07-20 07:59:49.763791327 +0000 UTC target_uri: ["/zxcs.php","/FX.php","/911.php","/qterm.php","/7.php","/mac.php","/ah25.php","/k2.php","/term.php","/fffm.php","/xyn.php"] method: ["GET"] status: ["404"] user_agent: ["-"] show less	Bad Web Bot Web App Attack
🇭🇺 wickedip	2026-07-20 08:00:00 (11 hours ago)	Multiple WAF violations. (Scanning for credential files, nonexistent PHP files, other hacker files, ... show more Multiple WAF violations. (Scanning for credential files, nonexistent PHP files, other hacker files, using fake and/or empty UserAgent values.) show less	Brute-Force Exploited Host Web App Attack Hacking
Anonymous	2026-07-20 07:59:13 (11 hours ago)	20.127.18.0 - - [20/Jul/2026:09:59:12 +0200] "GET /wp-content/plugins/hellopress/wp_filemanager.php ... show more 20.127.18.0 - - [20/Jul/2026:09:59:12 +0200] "GET /wp-content/plugins/hellopress/wp_filemanager.php HTTP/1.1" 301 162 "-" "-" ... show less	Brute-Force Web App Attack

Showing 1 to 15 of 658 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇹🇼 198.235.24.55

🇲🇺 197.225.146.23

🇧🇷 187.62.87.27

🇳🇱 178.16.54.95

🇺🇸 165.22.9.106

🇫🇷 152.228.220.135

🇺🇸 107.10.140.193

🇮🇳 103.194.243.199

🇸🇬 47.84.191.55

🇧🇾 46.56.61.59

🇳🇱 45.148.10.141

🇿🇦 41.76.214.143

🇺🇸 209.38.131.131

🇧🇪 198.235.24.170

🇳🇱 195.178.110.217

🇲🇴 182.93.7.194

🇫🇮 147.185.133.177

🇱🇰 112.134.238.229

🇻🇳 58.187.212.61

🇸🇪 37.46.190.251