JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

20.204.27.64

Recent Activity

Abuse confidence score ?

100% Critical

35 reports

33 reporters · latest 8 hours ago

ISP	Microsoft Corporation
Usage Type	Data Center/Web Hosting/Transit
ASN	AS8075
Domain Name	microsoft.com
Country	🇮🇳 India
City	Pune, Maharashtra

ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report Whois

Reports Activity

Example preview

Report Categories (Last 60 Days)

Example preview

Top Reporter Countries (Last 60 Days)

Example preview

Account required for the enhanced features Log in Sign up

IP Abuse Reports for 20.204.27.64

Export CSV

This IP address has been reported a total of 35 times from 33 distinct sources. 20.204.27.64 was first reported on October 22nd 2026, and the most recent report was 8 hours ago. In the last 60 days, the top reporter locations were: Netherlands with 9 reports; United States of America with 5 reports; Germany with 4 reports. The most common categories in these recent reports were: Web App Attack 28 times; Brute-Force 13 times; Hacking 8 times; Bad Web Bot 8 times; SSH 3 times; Other 13 times.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇬🇧 KTSTechnology	2026-10-26 06:23:11 (8 hours ago)	Web vulnerability scanning detected by our ISP firewall	Web App Attack
🇳🇱 Site.eu	2026-10-26 02:17:47 (12 hours ago)	Excessive 404/403 errors	Brute-Force
🇺🇸 iwle	2026-10-25 08:47:50 (1 day ago)	[Sun Oct 25 04:47:47.973900 2026] [:error] [pid 4017618:tid 4017679] [client 20.204.27.64:0] [client ... show more [Sun Oct 25 04:47:47.973900 2026] [:error] [pid 4017618:tid 4017679] [client 20.204.27.64:0] [client 20.204.27.64] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/activated_rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.5"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "ufscards.com"] [uri "/%2f%2eenv"] [unique_id "at3CM2kKHaN_YeoPlcGMBgAAAAE"] [Sun Oct 25 04:47:47.984627 2026] [:error] [pid 4018090:tid 4018126] [client 20.204.27.64:0] [client 20.204.27.64] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/activated_rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125 ... show less	Web App Attack Brute-Force
🇮🇹 VHosting	2026-10-25 03:20:03 (1 day ago)	Detected WordPress attack from different servers	Brute-Force Web App Attack
🇮🇱 spd.co.il	2026-10-25 03:03:18 (1 day ago)	Web application attack detected	Hacking Web App Attack
🇹🇷 hostopya.com	2026-10-25 02:39:07 (1 day ago)	[plesk-apache] 6 failed attempt(s). Log: [Sun Oct 25 05:39:04.156447 2026] [access_compat:error] [pi ... show more [plesk-apache] 6 failed attempt(s). Log: [Sun Oct 25 05:39:04.156447 2026] [access_compat:error] [pid 3627248] [client 20.204.27.64:0] AH01797: client denied by server configuration: /var/www/vhosts/cetinlergroup.com/httpdocs/.env\|[Sun Oct 25 05:39:04.168091 2026] [access_compat:error] [pid 3615271] [client 20.204.27.64:0] AH01797: client denied by server configuration: /var/www/vhosts/cetinlergroup.com/httpdocs/.env\|[Sun Oct 25 05:39:04.175993 2026] [access_compat:error] [pid 3389883] [client 20.204.27.64:0] AH01797: client denied by server configuration: /var/www/vhosts/cetinlergroup.com/httpdocs/.env\|[Sun Oct 25 05:39:04.239609 2026] [access_compat:error] [pid 3389777] [client 20.204.27.64:0] AH01797: client denied by server configuration: /var/www/vhosts/cetinlergroup.com/httpdocs/;.env\|[Sun Oct 25 05:39:06.898058 2026] [access_compat:error] [pid 3389880] [client 20.204.27.64:0] AH01797: client denied by server configuration: /var/www/vhosts/cetinlergroup.com/httpdocs/.env show less	Brute-Force Web App Attack
Anonymous	2026-10-25 00:41:43 (1 day ago)	(mod_security) mod_security triggered on hostname [redacted] 20.204.27.64 (IN/India/-)	SQL Injection
🇳🇱 homeshowdomain.nl	2026-10-24 21:59:09 (1 day ago)	Auto-ban: 417 malicious requests on 2026-10-23 (e.g., env/backup probes, brute-force, or error burst ... show more Auto-ban: 417 malicious requests on 2026-10-23 (e.g., env/backup probes, brute-force, or error bursts). show less	Web App Attack SSH Hacking
🇦🇺 Proxay Fox	2026-10-24 12:56:13 (2 days ago)	20.204.27.64 - - [24/Oct/2026:22:56:00 +1000] "GET /.env HTTP/2.0" 403 146 "-" "curl/8.6.0" "20.204. ... show more 20.204.27.64 - - [24/Oct/2026:22:56:00 +1000] "GET /.env HTTP/2.0" 403 146 "-" "curl/8.6.0" "20.204.27.64" 195 562 TLSv1.3/TLS_AES_256_GCM_SHA384 . 1141cd7e82d6c9bf50610eef297faf58afdaba8ca1c7ee344b7be8b6aa48ddd4 20.204.27.64 - - [24/Oct/2026:22:56:00 +1000] "GET /%252eenv HTTP/2.0" 403 146 "-" "curl/8.6.0" "20.204.27.64" 39 562 TLSv1.3/TLS_AES_256_GCM_SHA384 . 1141cd7e82d6c9bf50610eef297faf58afdaba8ca1c7ee344b7be8b6aa48ddd4 20.204.27.64 - - [24/Oct/2026:22:56:00 +1000] "GET /.env/ HTTP/2.0" 403 146 "-" "curl/8.6.0" "20.204.27.64" 36 562 TLSv1.3/TLS_AES_256_GCM_SHA384 . 1141cd7e82d6c9bf50610eef297faf58afdaba8ca1c7ee344b7be8b6aa48ddd4 20.204.27.64 - - [24/Oct/2026:22:56:00 +1000] "GET /%2eenv HTTP/2.0" 403 146 "-" "curl/8.6.0" "20.204.27.64" 36 562 TLSv1.3/TLS_AES_256_GCM_SHA384 . 1141cd7e82d6c9bf50610eef297faf58afdaba8ca1c7ee344b7be8b6aa48ddd4 20.204.27.64 - - [24/Oct/2026:22:56:01 +1000] "GET /..;/.env HTTP/2.0" 403 146 "-" "curl/8.6.0" "20.204.27.64" 39 562 TLSv1.3/TLS_AES_256_GC ... show less	Brute-Force Web App Attack
🇳🇱 ConsulHosting	2026-10-24 06:29:39 (2 days ago)	Excessive failed CAPTCHA attempts (CAPTCHA DoS)	Web App Attack
🇬🇧 openstrike.co.uk	2026-10-24 05:14:30 (2 days ago)	806 attacks on config grabbing URLs (type 2), VC URLs, auth-protected URLs, env grabbing URLs, passw ... show more 806 attacks on config grabbing URLs (type 2), VC URLs, auth-protected URLs, env grabbing URLs, password/key grabbing URLs, too many concurrent requests, site downloads, PHP URLs, config grabbing URLs: GET /config/secrets.yml HTTP/1.1 GET /old/.git/config HTTP/1.1 GET /admin/config HTTP/1.1 GET /cms/.env HTTP/1.1 GET /.vscode/sftp.json HTTP/1.1 GET /netlify.toml HTTP/1.1 GET /dump.tar.gz HTTP/1.1 GET /phpmyadmin/ HTTP/1.1 GET /.htaccess HTTP/1.1 show less	Hacking Brute-Force Bad Web Bot Web App Attack
🇺🇸 Victor López	2026-10-23 22:09:26 (2 days ago)	2026/10/23 17:09:25 [error] 470902#470902: 433723 limiting requests, excess: 50.600 by zone "genera ... show more 2026/10/23 17:09:25 [error] 470902#470902: 433723 limiting requests, excess: 50.600 by zone "general", client: 20.204.27.64, server: babystudio4d.com, request: "GET /.env.gemini HTTP/2.0", host: "babystudio4d.com" 2026/10/23 17:09:25 [error] 470902#470902: 433733 limiting requests, excess: 50.600 by zone "general", client: 20.204.27.64, server: babystudio4d.com, request: "GET /.env.private HTTP/2.0", host: "babystudio4d.com" 2026/10/23 17:09:25 [error] 470902#470902: 433734 limiting requests, excess: 50.600 by zone "general", client: 20.204.27.64, server: babystudio4d.com, request: "GET /.env.firebase HTTP/2.0", host: "babystudio4d.com" 2026/10/23 17:09:25 [error] 470902#470902: 433723 limiting requests, excess: 50.500 by zone "general", client: 20.204.27.64, server: babystudio4d.com, request: "GET /.env.json HTTP/2.0", host: "babystudio4d.com" 2026/10/23 17:09:25 [error] 470902#470902: 433733 limiting requests, excess: 50.500 by zone "general", client: 20.204.27.64, server: babys ... show less	DDoS Attack Web App Attack
Anonymous	2026-10-23 21:14:20 (2 days ago)	Aggressive web scan	Web App Attack
🇺🇸 TPI-Abuse	2026-10-23 16:33:02 (2 days ago)	(mod_security) mod_security (id:210492) triggered by 20.204.27.64 (-): 1 in the last 300 secs; Ports ... show more (mod_security) mod_security (id:210492) triggered by 20.204.27.64 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 23 12:32:55.561497 2026] [security2:error] [pid 13030:tid 13030] [client 20.204.27.64:0] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "hondabvi.com"] [uri "/.env"] [unique_id "atuMN_qt2pHZub_Md8aHZgAAAAc"] show less	Brute-Force Bad Web Bot Web App Attack
🇳🇱 rroethof	2026-10-23 15:39:07 (2 days ago)	(XMLRPC) WP XMLRPC Attack 20.204.27.64 (IN/India/-): 6 in the last 3600 secs; Ports: ; Direction: 1 ... show more (XMLRPC) WP XMLRPC Attack 20.204.27.64 (IN/India/-): 6 in the last 3600 secs; Ports: ; Direction: 1; Trigger: LF_CUSTOMTRIGGER; Logs: 20.204.27.64 - - [23/Oct/2026:17:39:01 +0200] "POST /xmlrpc.php HTTP/2.0" 403 128 "-" "curl/8.6.0" 20.204.27.64 - - [23/Oct/2026:17:39:01 +0200] "POST /xmlrpc.php HTTP/2.0" 403 72 "-" "curl/8.6.0" 20.204.27.64 - - [23/Oct/2026:17:39:01 +0200] "POST /xmlrpc.php HTTP/2.0" 403 72 "-" "curl/8.6.0" 20.204.27.64 - - [23/Oct/2026:17:39:01 +0200] "POST /xmlrpc.php HTTP/2.0" 403 72 "-" "curl/8.6.0" 20.204.27.64 - - [23/Oct/2026:17:39:02 +0200] "POST /xmlrpc.php HTTP/2.0" 403 95 "-" "curl/8.6.0" 20.204.27.64 - - [23/Oct/2026:17:39:02 +0200] "POST /xmlrpc.php HTTP/2.0" 403 72 "-" "curl/8.6.0" show less	Spoofing Brute-Force Bad Web Bot Web App Attack SSH

Showing 1 to 15 of 35 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇲🇰 185.233.210.34

🇳🇱 161.35.144.17

🇭🇰 118.193.39.103

🇮🇳 45.248.66.108

🇵🇱 213.156.101.206

🇺🇸 192.9.228.120

🇳🇱 165.232.95.10

🇨🇳 117.187.180.251

🇷🇺 95.188.91.101

🇳🇱 77.239.124.79

🇰🇷 211.198.128.204

🇵🇱 195.88.180.180

🇸🇾 193.43.149.119

🇧🇷 177.124.14.85

🇺🇸 174.138.46.93

🇨🇦 148.113.130.55

🇨🇳 119.115.224.43

🇨🇳 119.96.159.237

🇫🇷 91.231.89.174

🇫🇷 91.231.89.104