JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 20.2.202.138

20.2.202.138 was found in our database!

This IP was reported 42 times. Confidence of Abuse is 0%: ?

ISP	Microsoft Corporation
Usage Type	Data Center/Web Hosting/Transit
ASN	AS8075
Domain Name	microsoft.com
Country	🇭🇰 Hong Kong
City	Hong Kong

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 20.2.202.138

Whois 20.2.202.138

IP Abuse Reports for 20.2.202.138:

This IP address has been reported a total of 42 times from 40 distinct sources. 20.2.202.138 was first reported on May 16th 2026, and the most recent report was 1 month ago.

Old Reports: The most recent abuse report for this IP address is from 1 month ago . It is possible that this IP is no longer involved in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇮🇳 evicky2002	2026-07-08 06:29:13 (1 month ago)	Confirmed malicious by STILWaters CTI platform (score=100, sources=1)	Hacking Brute-Force SSH
🇨🇭 YF	2026-05-17 23:36:35 (3 months ago)	Pays blacklisté (HK)	Brute-Force Web App Attack
🇬🇧 openstrike.co.uk	2026-05-16 05:14:52 (3 months ago)	40 attacks on PHP URLs: GET /wp-content/plugins/index.php HTTP/1.1	Web App Attack
Anonymous	2026-05-16 04:44:17 (3 months ago)	Banned by Fail2Ban on server	Web App Attack
🇨🇦 polycoda	2026-05-16 04:36:41 (3 months ago)	AutoBlock: 🎯 Vulnerability Scanner (Non Decay-Based) - 📊 Admin Panel Scanning (Decay-Based) - ❌ Exce ... show more AutoBlock: 🎯 Vulnerability Scanner (Non Decay-Based) - 📊 Admin Panel Scanning (Decay-Based) - ❌ Excessive 40X Errors (Decay-Based) show less	Hacking Bad Web Bot Web App Attack
🇩🇪 R.G.	2026-05-16 04:27:42 (3 months ago)	(ScanningForFiles) Scanning for files triggerd 20.2.202.138 (HK/Hong Kong/-): 10 in the last 900 sec ... show more (ScanningForFiles) Scanning for files triggerd 20.2.202.138 (HK/Hong Kong/-): 10 in the last 900 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: show less	Web App Attack
Anonymous	2026-05-16 04:20:31 (3 months ago)	(caddyscan) Scanner path probe from 20.2.202.138 (HK/Hong Kong/-): 5 in the last 3600 secs; Ports: * ... show more (caddyscan) Scanner path probe from 20.2.202.138 (HK/Hong Kong/-): 5 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: [REDACTED] 200 2627 20.2.202.138 - - [16/May/2026:04:16:58 +0000] "GET /wp-admin/user.php HTTP/1.1" [REDACTED] 200 2627 20.2.202.138 - - [16/May/2026:04:16:58 +0000] "GET /wp-login.php HTTP/1.1" [REDACTED] 200 2627 20.2.202.138 - - [16/May/2026:04:17:00 +0000] "GET /xmlrpc.php HTTP/1.1" [REDACTED] 200 2627 20.2.202.138 - - [16/May/2026:04:17:03 +0000] "GET /wp-admin/css/colors/ectoplasm/ HTTP/1.1" [REDACTED] 200 2627 20.2.202.138 - - [16/May/2026:04:20:27 +0000] "GET /wp-admin/user.php HTTP/1.1" show less	Port Scan
🇩🇪 FeG Deutschland	2026-05-16 04:13:20 (3 months ago)	Looking for CMS/PHP/SQL vulnerablilities/excessive crawling - 124	Exploited Host Web App Attack
🇦🇺 rubixstudios	2026-05-16 04:09:02 (3 months ago)	Excessive HTTP requests consistent with automated attack behaviour detected by Imunify360	DDoS Attack Brute-Force Web App Attack
🇩🇪 iNetWorker	2026-05-16 04:05:50 (3 months ago)	trolling for resource vulnerabilities	Web App Attack
🇨🇦 1gz	2026-05-16 04:04:02 (3 months ago)	Triggered Cloudflare WAF (firewallCustom) from HK. Action taken: BLOCK Protocol: HTTP/1.1 (GET metho ... show more Triggered Cloudflare WAF (firewallCustom) from HK. Action taken: BLOCK Protocol: HTTP/1.1 (GET method) Endpoint: /wp-content/plugins/WordPressCore/ UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 This report was generated by: https://github.com/sefinek/Cloudflare-WAF-To-AbuseIPDB show less	Bad Web Bot
🇫🇷 Baking333	2026-05-16 04:01:58 (3 months ago)	[redacted] 20.2.202.138 - - [16/May/2026:05:01:53 +0100] "GET /wp-content/uploads/[redacted] HTTP/1. ... show more [redacted] 20.2.202.138 - - [16/May/2026:05:01:53 +0100] "GET /wp-content/uploads/[redacted] HTTP/1.1" 302 1554 0/90155 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" [redacted] 20.2.202.138 - - [16/May/2026:05:01:57 +0100] "GET /wp-admin/[redacted] HTTP/1.1" 302 1554 0/155943 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" show less	Bad Web Bot Web App Attack
🇫🇷 sthoyer.de	2026-05-16 04:00:17 (3 months ago)	20.2.202.138 - - [16/May/2026:06:00:15 +0200] "GET /inputs.php HTTP/1.1" 302 495 "-" "Mozilla/5.0 (W ... show more 20.2.202.138 - - [16/May/2026:06:00:15 +0200] "GET /inputs.php HTTP/1.1" 302 495 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.2.202.138 - - [16/May/2026:06:00:15 +0200] "GET /ioxi-o.php HTTP/1.1" 302 495 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.2.202.138 - - [16/May/2026:06:00:15 +0200] "GET /function/function.php HTTP/1.1" 302 495 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" ... show less	Web App Attack
🇩🇪 stinpriza	2026-05-16 03:49:58 (3 months ago)	Web App Attack	Web App Attack
🇨🇭 4server	2026-05-16 03:45:13 (3 months ago)	[SatMay1605:45:09.0725962026][security2:error][pid306947:tid306972][client20.2.202.138:0]ModSecurity ... show more [SatMay1605:45:09.0725962026][security2:error][pid306947:tid306972][client20.2.202.138:0]ModSecurity:Accessdeniedwithcode403\(phase1\).Stringmatch\"/xmlrpc.php\"atREQUEST_URI.[file\"/etc/apache2/conf.d/modsec_custom_rules.conf\"][line\"367\"][id\"960024\"][msg\"XML-RPCdisabled\"][hostname\"cpcontacts.mio-ip.ch\"][uri\"/xmlrpc.php\"][unique_id\"agfoRUajmNz3piKe6EelxgAAARc\"] show less	Hacking Web App Attack

Showing 1 to 15 of 42 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇺🇦 195.39.242.162

🇮🇳 98.70.48.241

🇺🇸 47.251.77.20

🇳🇱 193.29.139.161

🇪🇪 138.124.100.1

🇭🇰 124.244.119.114

🇨🇳 111.85.248.81

🇷🇴 92.118.39.49

🇬🇧 89.241.13.228

🇺🇸 216.122.38.231

🇺🇸 203.168.148.42

🇦🇺 202.62.129.18

🇰🇷 183.96.163.213

🇳🇱 45.148.10.157

🇳🇱 195.178.110.30

🇨🇳 180.165.18.144

🇺🇸 162.241.239.202

🇸🇬 161.118.212.147

🇮🇳 122.187.116.110

🇰🇷 114.30.180.58