JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 20.205.37.240

20.205.37.240 was found in our database!

This IP was reported 92 times. Confidence of Abuse is 100%: ?

100%

ISP	Microsoft Corporation
Usage Type	Data Center/Web Hosting/Transit
ASN	AS8075
Domain Name	microsoft.com
Country	🇭🇰 Hong Kong
City	Hong Kong

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 20.205.37.240

Whois 20.205.37.240

IP Abuse Reports for 20.205.37.240:

This IP address has been reported a total of 92 times from 77 distinct sources. 20.205.37.240 was first reported on June 30th 2026, and the most recent report was 14 hours ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇪🇸 Gem	2026-07-03 22:17:48 (14 hours ago)	Unauthorized web scan.	Web App Attack
🇫🇷 tecnicorioja	2026-07-01 22:01:01 (2 days ago)	wp-login attack [01/Jul/2026:08:47:30	Brute-Force Web App Attack
Anonymous	2026-07-01 12:00:08 (3 days ago)	\| [Dangerous/Hong Kong] Aggressive IP 20.205.37.240 (~30 hits). Type: DoS Defender- Web server 400 e ... show more \| [Dangerous/Hong Kong] Aggressive IP 20.205.37.240 (~30 hits). Type: DoS Defender- Web server 400 error code show less	Web App Attack Hacking SQL Injection
🇺🇸 TPI-Abuse	2026-07-01 07:57:25 (3 days ago)	(mod_security) mod_security (id:240335) triggered by 20.205.37.240 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:240335) triggered by 20.205.37.240 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jul 01 03:57:19.403394 2026] [security2:error] [pid 12150:tid 12150] [client 20.205.37.240:7247] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 20.205.37.240 (+1 hits since last alert)\|splashstation.org\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "splashstation.org"] [uri "/xmlrpc.php"] [unique_id "akTIX7Je4Kbn2YV0iaGBWgAAACs"] show less	Brute-Force Bad Web Bot Web App Attack
🇷🇴 INTEQ	2026-07-01 07:53:00 (3 days ago)	Web attack from 20.205.37.240	Web App Attack
🇺🇸 TPI-Abuse	2026-07-01 06:57:54 (3 days ago)	(mod_security) mod_security (id:240335) triggered by 20.205.37.240 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:240335) triggered by 20.205.37.240 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jul 01 02:57:49.472012 2026] [security2:error] [pid 8093:tid 8093] [client 20.205.37.240:7179] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 20.205.37.240 (+1 hits since last alert)\|spacebooger.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "spacebooger.com"] [uri "/xmlrpc.php"] [unique_id "akS6bRT_jST6Z1cQ2w_AEAAAAAg"] show less	Brute-Force Bad Web Bot Web App Attack
🇩🇪 lenz	2026-07-01 06:48:03 (3 days ago)	Jul 1 08:48:00 hosting wordpress(grupa-ddd.pl)[6431]: XML-RPC authentication failure for admin from ... show more Jul 1 08:48:00 hosting wordpress(grupa-ddd.pl)[6431]: XML-RPC authentication failure for admin from 20.205.37.240 Jul 1 08:48:00 hosting wordpress(grupa-ddd.pl)[11820]: XML-RPC authentication failure for admin from 20.205.37.240 Jul 1 08:48:01 hosting wordpress(grupa-ddd.pl)[11564]: XML-RPC authentication failure for admin from 20.205.37.240 Jul 1 08:48:02 hosting wordpress(grupa-ddd.pl)[1200]: XML-RPC authentication failure for admin from 20.205.37.240 Jul 1 08:48:03 hosting wordpress(grupa-ddd.pl)[1203]: XML-RPC authentication failure for admin from 20.205.37.240 ... show less	Brute-Force Web App Attack
Anonymous	2026-07-01 06:29:28 (3 days ago)	20.205.37.240 - - [30/Jun/2026:18:01:07 -0300] "GET /wp-content/plugins/fix/up.php HTTP/2.0" 301 162 ... show more 20.205.37.240 - - [30/Jun/2026:18:01:07 -0300] "GET /wp-content/plugins/fix/up.php HTTP/2.0" 301 162 "-" "Mozilla/5.0" 20.205.37.240 - - [30/Jun/2026:18:01:08 -0300] "GET /wp-content/plugins/fix/up.php HTTP/2.0" 404 814 "https://blogmania.com.br/wp-content/plugins/fix/up.php" "Mozilla/5.0" 20.205.37.240 - - [01/Jul/2026:03:29:28 -0300] "GET //wp-content/plugins/fix/up.php HTTP/1.1" 301 162 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.102 Safari/537.36" ... show less	Port Scan
🇺🇸 TPI-Abuse	2026-07-01 06:09:17 (3 days ago)	(mod_security) mod_security (id:240335) triggered by 20.205.37.240 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:240335) triggered by 20.205.37.240 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jul 01 02:09:12.299477 2026] [security2:error] [pid 8772:tid 8772] [client 20.205.37.240:7302] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 20.205.37.240 (+1 hits since last alert)\|grexicon.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "grexicon.com"] [uri "/xmlrpc.php"] [unique_id "akSvCFpaN9W8qLf1KZWZEwAAAAI"] show less	Brute-Force Bad Web Bot Web App Attack
🇫🇷 solution.it	2026-07-01 05:35:55 (3 days ago)	[Wed Jul 01 07:35:55.010359 2026] [php7:error] [pid 46827:tid 46827] [client 20.205.37.240:7172] scr ... show more [Wed Jul 01 07:35:55.010359 2026] [php7:error] [pid 46827:tid 46827] [client 20.205.37.240:7172] script '/var/www/html/blog.solution.it/wp-login.php' not found or unable to stat show less	Web App Attack
🇩🇪 london2038.com	2026-07-01 05:18:37 (3 days ago)	Probing for exploits 20.205.37.240 - - [01/Jul/2026:03:36:01 +0200] "GET /wp-content/plugins/fix/up. ... show more Probing for exploits 20.205.37.240 - - [01/Jul/2026:03:36:01 +0200] "GET /wp-content/plugins/fix/up.php HTTP/1.1" 301 169 "-" "Mozilla/5.0" 20.205.37.240 - - [01/Jul/2026:07:18:33 +0200] "GET //wp-content/plugins/fix/up.php HTTP/1.1" 301 169 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.102 Safari/537.36" show less	Hacking Web App Attack
🇩🇪 FeG Deutschland	2026-07-01 05:00:22 (3 days ago)	Looking for CMS/PHP/SQL vulnerablilities/excessive crawling - 127	Exploited Host Web App Attack
🇺🇸 TPI-Abuse	2026-07-01 04:50:44 (3 days ago)	(mod_security) mod_security (id:240335) triggered by 20.205.37.240 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:240335) triggered by 20.205.37.240 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jul 01 00:50:39.478245 2026] [security2:error] [pid 12991:tid 12991] [client 20.205.37.240:7179] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 20.205.37.240 (+1 hits since last alert)\|gracebaptisthartsville.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "gracebaptisthartsville.com"] [uri "/xmlrpc.php"] [unique_id "akScn4sA7gG5utzAPJEZMwAAAAk"] show less	Brute-Force Bad Web Bot Web App Attack
🇩🇪 netclix.gr	2026-07-01 04:36:48 (3 days ago)	(wordpress) Failed wordpress login from 20.205.37.240 (HK/Hong Kong/-): (CF_ENABLE)	Brute-Force
🇲🇽 octageeks.com	2026-07-01 04:24:04 (3 days ago)	Wordpress malicious attack:[octascan]	Web App Attack

Showing 1 to 15 of 92 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇩🇪 213.209.159.227

🇳🇱 192.42.116.63

🇺🇸 147.185.132.139

🇹🇼 45.43.37.254

🇩🇪 213.209.159.226

🇭🇰 172.253.5.28

🇺🇸 162.216.150.175

🇮🇩 121.101.131.70

🇻🇳 103.166.182.186

🇧🇩 103.139.144.57

🇿🇲 102.23.122.235

🇫🇷 91.231.89.69

🇩🇪 69.5.169.140

🇺🇸 54.235.172.96

🇮🇳 45.123.110.70

🇺🇸 44.141.4.51

🇸🇪 44.5.220.27

🇧🇷 2804:c2c:cf05:a421:8d3d:84b8:d39f:c092

🇦🇷 190.172.29.153

🇺🇸 162.216.149.45