JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 20.200.222.86

20.200.222.86 was found in our database!

This IP was reported 215 times. Confidence of Abuse is 100%: ?

100%

ISP	Microsoft Corporation
Usage Type	Data Center/Web Hosting/Transit
ASN	AS8075
Domain Name	microsoft.com
Country	🇰🇷 Korea (the Republic of)
City	Seoul, Seoul

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 20.200.222.86

Whois 20.200.222.86

IP Abuse Reports for 20.200.222.86:

This IP address has been reported a total of 215 times from 175 distinct sources. 20.200.222.86 was first reported on July 8th 2026, and the most recent report was 4 minutes ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇺🇸 Epimetheus	2026-07-08 16:38:22 (4 minutes ago)	Unauthorized access attempts: [GET] /an.php [GET] /sf.php [GET] /wp-content/uploads/index.php [GET] ... show more Unauthorized access attempts: [GET] /an.php [GET] /sf.php [GET] /wp-content/uploads/index.php [GET] /wp-includes/SimplePie/admin.php [GET] /cgi-bin/index.php [GET] /item.php [GET] /wp-content/themes/admin.php [GET] /wp-includes/pomo/ [GET] /wp-admin/css/colors/coffee/index.php [GET] /222.php [GET] /ms-edit.php [GET] /wp-config-sample.php [GET] /zxz.php [GET] /wp-includes/ [GET] /wp-includes/ID3/ [GET] /aa.php [GET] /wp-admin/images/admin.php UA: Unknown show less	Web App Attack
🇵🇱 Niko's Stuff	2026-07-08 16:30:43 (11 minutes ago)	Triggered crowdsecurity/http-admin-interface-probing. More information at: https://app.crowdsec.net/ ... show more Triggered crowdsecurity/http-admin-interface-probing. More information at: https://app.crowdsec.net/cti/20.200.222.86 show less	Web App Attack Hacking
🇺🇸 antlac1	2026-07-08 16:29:17 (13 minutes ago)	crowdsecurity/http-wordpress-scan	Brute-Force Web App Attack
🇬🇷 setupgr	2026-07-08 16:26:27 (16 minutes ago)	(PERMBLOCK) 20.200.222.86 (KR/South Korea/Seoul/Yongsan-dong/-/[AS8075 MICROSOFT-CORP-MSN-AS-BLOCK]) ... show more (PERMBLOCK) 20.200.222.86 (KR/South Korea/Seoul/Yongsan-dong/-/[AS8075 MICROSOFT-CORP-MSN-AS-BLOCK]) has had more than 4 temp blocks in the last 86400 secs; Ports: *; Direction: inout; Trigger: LF_PERMBLOCK_COUNT; Logs: N/A show less	Port Scan
🇩🇪 KiekerJan	2026-07-08 16:24:11 (18 minutes ago)	20.200.222.86 - - [08/Jul/2026:18:24:08 +0200] "GET /wp-content/plugins/hellopress/wp_filemanager.ph ... show more 20.200.222.86 - - [08/Jul/2026:18:24:08 +0200] "GET /wp-content/plugins/hellopress/wp_filemanager.php HTTP/1.1" 301 162 "-" "-" 20.200.222.86 - - [08/Jul/2026:18:24:10 +0200] "GET /wp-content/plugins/hellopress/wp_filemanager.php HTTP/1.1" 404 146 "-" "-" ... show less	Web App Attack
🇧🇬 HighWay	2026-07-08 16:22:03 (20 minutes ago)	20.200.222.86 - - [08/Jul/2026:16:22:00 +0000] "GET /wp-content/plugins/hellopress/wp_filemanager.ph ... show more 20.200.222.86 - - [08/Jul/2026:16:22:00 +0000] "GET /wp-content/plugins/hellopress/wp_filemanager.php HTTP/1.1" 404 4685 "-" "-" 20.200.222.86 - - [08/Jul/2026:16:22:00 +0000] "GET /this_is_a_new_hello_world.php HTTP/1.1" 404 696 "-" "-" 20.200.222.86 - - [08/Jul/2026:16:22:01 +0000] "GET /admin.php HTTP/1.1" 404 4684 "-" "-" 20.200.222.86 - - [08/Jul/2026:16:22:01 +0000] "GET /public/css.php HTTP/1.1" 404 696 "-" "-" 20.200.222.86 - - [08/Jul/2026:16:22:02 +0000] "GET /classwithtostring.php HTTP/1.1" 404 696 "-" "-" ... show less	Port Scan Bad Web Bot
🇩🇪 TrackerSB	2026-07-08 16:20:49 (21 minutes ago)	20.200.222.86 - "-" [08/Jul/2026:18:20:48 +0200] "GET /wp-admin/css/colors/ocean/ HTTP/1.1" 301 169 ... show more 20.200.222.86 - "-" [08/Jul/2026:18:20:48 +0200] "GET /wp-admin/css/colors/ocean/ HTTP/1.1" 301 169 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" "20.200.222.86" 20.200.222.86 - "-" [08/Jul/2026:18:20:48 +0200] "GET /wp-includes/block-bindings/ HTTP/1.1" 301 169 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" "20.200.222.86" ... show less	Web App Attack
🇺🇸 ambor	2026-07-08 16:18:56 (23 minutes ago)	Attack type: wordpress_attack_attempt \| Target: /wp-content/plugins/hellopress/wp_filemanager.php \| ... show more Attack type: wordpress_attack_attempt \| Target: /wp-content/plugins/hellopress/wp_filemanager.php \| Country: KR show less	Web App Attack Brute-Force
Anonymous	2026-07-08 16:12:55 (29 minutes ago)	Fail2Ban nginx-botsearch on Security-Instance. Persistent malicious activity detected. Evidence: /va ... show more Fail2Ban nginx-botsearch on Security-Instance. Persistent malicious activity detected. Evidence: /var/log/nginx/access.log:20.200.222.86 - - [08/Jul/2026:18:12:53 +0200] "GET /an.php HTTP/1.1" 404 47 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" "-" /var/log/nginx/access.log:20.200.222.86 - - [08/Jul/2026:18:12:54 +0200] "GET /wp-admin/images/ HTTP/1.1" 404 187 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" "-" /var/log/nginx/access.log:20.200.222.86 - - [08/Jul/2026:18:12:54 +0200] "GET /404.php HTTP/1.1" 404 47 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" "-" /var/log/nginx/a show less	Bad Web Bot
🇬🇧 Apache	2026-07-08 16:10:15 (32 minutes ago)	(mod_security) mod_security (id:20000010) triggered by 20.200.222.86 (KR/South Korea/-): 5 in the la ... show more (mod_security) mod_security (id:20000010) triggered by 20.200.222.86 (KR/South Korea/-): 5 in the last 300 secs show less	Brute-Force Web App Attack
Anonymous	2026-07-08 16:05:04 (37 minutes ago)	PHP file probing detected by Fail2Ban	Web App Attack
🇺🇸 mashamal	2026-07-08 16:03:42 (38 minutes ago)	Vulnerability Probe ...	Web App Attack
🇳🇱 CryptoYakari	2026-07-08 15:55:44 (46 minutes ago)	20.200.222.86 - - [08/Jul/2026:18:55:39 +0300] "GET /wp-content/plugins/hellopress/wp_filemanager.ph ... show more 20.200.222.86 - - [08/Jul/2026:18:55:39 +0300] "GET /wp-content/plugins/hellopress/wp_filemanager.php HTTP/1.0" 404 8027 "-" "-" 20.200.222.86 - - [08/Jul/2026:18:55:39 +0300] "GET /this_is_a_new_hello_world.php HTTP/1.0" 404 8023 "-" "-" 20.200.222.86 - - [08/Jul/2026:18:55:40 +0300] "GET /admin.php HTTP/1.0" 404 8032 "-" "-" 20.200.222.86 - - [08/Jul/2026:18:55:40 +0300] "GET /public/css.php HTTP/1.0" 404 8030 "-" "-" 20.200.222.86 - - [08/Jul/2026:18:55:41 +0300] "GET /classwithtostring.php HTTP/1.0" 404 8022 "-" "-" ... show less	Web Spam Blog Spam Web App Attack Bad Web Bot
🇺🇸 interbiznw.com	2026-07-08 15:54:05 (48 minutes ago)	malicious-web-requests-vulnerability-scanning	Hacking Brute-Force Exploited Host Web App Attack
🇮🇹 Inartis	2026-07-08 15:52:49 (49 minutes ago)	20.200.222.86 - - [08/Jul/2026:17:52:48 +0200] "GET /admin.php HTTP/1.1" 302 397 "-" "-" ...	Brute-Force Bad Web Bot Web App Attack

Showing 1 to 15 of 215 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇩🇪 172.253.1.209

🇩🇪 69.5.169.46

🇳🇱 45.87.41.212

🇨🇦 4.204.225.112

🇺🇸 143.20.253.153

🇷🇴 92.118.39.77

🇺🇸 47.143.208.202

🇺🇸 47.88.31.236

🇸🇬 47.82.14.50

🇺🇸 18.190.15.50

🇺🇸 3.218.158.98

🇷🇴 2.57.121.112

🇺🇸 2607:f8b0:4002:c00::121

🇳🇱 192.253.248.23

🇺🇸 165.154.163.173

🇨🇳 106.75.233.179

🇵🇰 59.103.217.61

🇷🇴 2.57.122.238

🇵🇱 145.239.85.111

🇨🇳 111.2.177.108