JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 20.205.109.237

20.205.109.237 was found in our database!

This IP was reported 132 times. Confidence of Abuse is 100%: ?

100%

ISP	Microsoft Corporation
Usage Type	Data Center/Web Hosting/Transit
ASN	AS8075
Domain Name	microsoft.com
Country	🇭🇰 Hong Kong
City	Hong Kong

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 20.205.109.237

Whois 20.205.109.237

IP Abuse Reports for 20.205.109.237:

This IP address has been reported a total of 132 times from 115 distinct sources. 20.205.109.237 was first reported on July 9th 2026, and the most recent report was 2 hours ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇬🇧 openstrike.co.uk	2026-07-10 05:13:44 (2 hours ago)	367 attacks on PHP URLs: GET /rh.php HTTP/1.1	Web App Attack
🇺🇸 H24	2026-07-10 00:26:02 (7 hours ago)	/wp-content/uploads/index.php /function/function.php /wk/index.php /inputs.php /404.php /defaults.ph ... show more /wp-content/uploads/index.php /function/function.php /wk/index.php /inputs.php /404.php /defaults.php /adminfuns.php /sf.php /goods.php /autoload_classmap.php show less	Web App Attack
🇮🇩 zam	2026-07-10 00:25:35 (7 hours ago)	20.205.109.237 - - [10/Jul/2026:00:25:30 +0000] "GET /buy.php HTTP/1.1" 301 282	Web App Attack
🇵🇱 strefapi_com	2026-07-09 23:59:25 (7 hours ago)	Brute-force, web ...	Hacking Brute-Force Web App Attack
Anonymous	2026-07-09 23:55:51 (7 hours ago)	[Fri Jul 10 01:55:46.192115 2026] [proxy_fcgi:error] [pid 3218:tid 3251] [client 20.205.109.237:1150 ... show more [Fri Jul 10 01:55:46.192115 2026] [proxy_fcgi:error] [pid 3218:tid 3251] [client 20.205.109.237:11509] AH01071: Got error 'Primary script unknown' [Fri Jul 10 01:55:49.189284 2026] [proxy_fcgi:error] [pid 3218:tid 3257] [client 20.205.109.237:11509] AH01071: Got error 'Primary script unknown' [Fri Jul 10 01:55:49.751249 2026] [proxy_fcgi:error] [pid 3218:tid 3247] [client 20.205.109.237:11509] AH01071: Got error 'Primary script unknown' [Fri Jul 10 01:55:50.271608 2026] [proxy_fcgi:error] [pid 3218:tid 3255] [client 20.205.109.237:11509] AH01071: Got error 'Primary script unknown' [Fri Jul 10 01:55:51.095466 2026] [proxy_fcgi:error] [pid 3218:tid 3246] [client 20.205.109.237:11509] AH01071: Got error 'Primary script unknown' ... show less	Brute-Force Web App Attack
Anonymous	2026-07-09 23:47:41 (7 hours ago)	[Fri Jul 10 01:42:34.542929 2026] [:error] [pid 2626834:tid 2626834] [client 20.205.109.237:64610] M ... show more [Fri Jul 10 01:42:34.542929 2026] [:error] [pid 2626834:tid 2626834] [client 20.205.109.237:64610] ModSecurity: Warning. Matched "Operator `PmFromFile' with parameter `restricted-files.data' against variable `REQUEST_FILENAME' (Value: `/wp-config-sample.php' ) [file "/usr/local/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "131"] [id "930130"] [rev ""] [msg "Restricted File Access Attempt"] [data "Matched Data: wp-config- found within REQUEST_FILENAME: /wp-config-sample.php"] [severity "2"] [ver "OWASP_CRS/4.29.0-dev"] [maturity "0"] [accuracy "0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/ATTACK-LFI"] [tag "capec/1000/255/153/126"] [uri "/wp-config-sample.php"] [unique_id "178364055410.477606"] [ref "o1,10v4,21t:utf8toUnicode,t:urlDecodeUni,t:normalizePathWin"] [Fri Jul 10 01:47:41.456988 2026] [:error] [pid 2626834:tid 2626834 ... show less	Web App Attack
Anonymous	2026-07-09 23:41:59 (7 hours ago)	(caddyscan) Scanner path probe from 20.205.109.237 (HK/Hong Kong/-): 5 in the last 3600 secs; Ports: ... show more (caddyscan) Scanner path probe from 20.205.109.237 (HK/Hong Kong/-): 5 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: [REDACTED] 200 2627 20.205.109.237 - - [09/Jul/2026:23:34:51 +0000] "GET /xmlrpc.php HTTP/1.1" [REDACTED] 200 2627 20.205.109.237 - - [09/Jul/2026:23:38:39 +0000] "GET /wp-admin/css/colors/blue/index.php HTTP/1.1" [REDACTED] 200 2627 20.205.109.237 - - [09/Jul/2026:23:38:44 +0000] "GET /wp-admin/js/index.php HTTP/1.1" [REDACTED] 200 2627 20.205.109.237 - - [09/Jul/2026:23:41:19 +0000] "GET /xmlrpc.php HTTP/1.1" [REDACTED] 200 2627 20.205.109.237 - - [09/Jul/2026:23:41:57 +0000] "GET /xmlrpc.php HTTP/1.1" show less	Port Scan
🇫🇮 Christopher Hughes	2026-07-09 23:26:55 (8 hours ago)	[Fri Jul 10 00:26:52.551039 2026] [proxy_fcgi:error] [pid 1651986:tid 139822391883328] [client 20.20 ... show more [Fri Jul 10 00:26:52.551039 2026] [proxy_fcgi:error] [pid 1651986:tid 139822391883328] [client 20.205.109.237:30416] AH01071: Got error 'Primary script unknown' [Fri Jul 10 00:26:52.821271 2026] [proxy_fcgi:error] [pid 1651986:tid 139822341527104] [client 20.205.109.237:30416] AH01071: Got error 'Primary script unknown' [Fri Jul 10 00:26:53.366251 2026] [proxy_fcgi:error] [pid 1651986:tid 139822784255552] [client 20.205.109.237:30416] AH01071: Got error 'Primary script unknown' [Fri Jul 10 00:26:54.413750 2026] [proxy_fcgi:error] [pid 1651986:tid 139822742292032] [client 20.205.109.237:30416] AH01071: Got error 'Primary script unknown' [Fri Jul 10 00:26:55.082923 2026] [proxy_fcgi:error] [pid 1651986:tid 139821720794688] [client 20.205.109.237:30416] AH01071: Got error 'Primary script unknown' ... show less	Web App Attack
🇮🇩 Burayot	2026-07-09 23:05:31 (8 hours ago)	LF_MODSEC: (mod_security) mod_security (id:1000001) triggered by 20.205.109.237 (HK/Hong Kong/-): 1 ... show more LF_MODSEC: (mod_security) mod_security (id:1000001) triggered by 20.205.109.237 (HK/Hong Kong/-): 1 in the last 3600 secs show less	Web App Attack
🇬🇧 Yosi	2026-07-09 23:05:26 (8 hours ago)	RdpGuard detected brute-force attempt on HTTP	Brute-Force
Anonymous	2026-07-09 23:04:45 (8 hours ago)	Banned by Fail2Ban on server	Web App Attack
🇩🇪 sojan	2026-07-09 23:04:04 (8 hours ago)	20.205.109.237 - - [10/Jul/2026:01:04:02 +0200] "GET /wp-content/plugins/hellopress/wp_filemanager.p ... show more 20.205.109.237 - - [10/Jul/2026:01:04:02 +0200] "GET /wp-content/plugins/hellopress/wp_filemanager.php HTTP/1.1" 404 8838 "-" "-" 20.205.109.237 - - [10/Jul/2026:01:04:03 +0200] "GET /this_is_a_new_hello_world.php HTTP/1.1" 404 8838 "-" "-" 20.205.109.237 - - [10/Jul/2026:01:04:03 +0200] "GET /100.php HTTP/1.1" 404 8838 "-" "-" ... show less	Web App Attack
🇩🇪 Dennis	2026-07-09 22:51:41 (8 hours ago)	20.205.109.237 has been banned for triggering http-probing (11 events over 3.172314736s).	Brute-Force Web App Attack
🇬🇧 pinguin	2026-07-09 22:50:46 (8 hours ago)	Triggered Cloudflare WAF (firewallManaged) from HK. Action taken: LOG Protocol: HTTP/1.1 (GET method ... show more Triggered Cloudflare WAF (firewallManaged) from HK. Action taken: LOG Protocol: HTTP/1.1 (GET method) Endpoint: /wp-content/plugins/hellopress/wp_filemanager.php UA: Empty string This report was generated by: https://github.com/sefinek/Cloudflare-WAF-To-AbuseIPDB show less	Bad Web Bot
🇫🇷 SpaceHost-Server	2026-07-09 22:28:16 (9 hours ago)		Brute-Force Web App Attack

Showing 1 to 15 of 132 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇵🇾 168.90.177.192

🇺🇸 66.132.172.236

🇺🇸 47.251.163.248

🇬🇧 37.10.113.216

🇬🇧 31.14.254.52

🇬🇧 31.14.254.36

🇬🇧 31.14.254.9

🇭🇰 199.45.154.177

🇳🇱 185.136.15.10

🇰🇷 175.207.61.193

🇺🇸 172.202.118.16

🇫🇷 91.196.152.103

🇺🇸 66.132.195.88

🇩🇪 45.135.141.8

🇨🇦 20.116.34.103

🇨🇳 14.103.115.159

🇺🇸 162.216.149.49

🇳🇱 146.103.115.115

🇨🇳 115.190.127.7

🇩🇪 69.5.169.25