JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 20.206.91.199

20.206.91.199 was found in our database!

This IP was reported 169 times. Confidence of Abuse is 100%: ?

100%

ISP	Microsoft Corporation
Usage Type	Data Center/Web Hosting/Transit
ASN	AS8075
Domain Name	microsoft.com
Country	🇧🇷 Brazil
City	Campinas, Sao Paulo

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 20.206.91.199

Whois 20.206.91.199

IP Abuse Reports for 20.206.91.199:

This IP address has been reported a total of 169 times from 146 distinct sources. 20.206.91.199 was first reported on July 17th 2026, and the most recent report was 1 hour ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇭🇺 NyaljBe	2026-07-19 05:52:00 (1 hour ago)	20.206.91.199 - - [18/Jul/2026:00:17:30 +0200] "GET /gm.php HTTP/1.1" 404 153 "-" "-" 20.206.91.199 ... show more 20.206.91.199 - - [18/Jul/2026:00:17:30 +0200] "GET /gm.php HTTP/1.1" 404 153 "-" "-" 20.206.91.199 - - [18/Jul/2026:00:17:30 +0200] "GET /link.php HTTP/1.1" 404 153 "-" "-" 20.206.91.199 - - [18/Jul/2026:00:17:29 +0200] "GET /lala.php HTTP/1.1" 404 153 "-" "-" 20.206.91.199 - - [18/Jul/2026:00:17:29 +0200] "GET /aa.php HTTP/1.1" 404 153 "-" "-" 20.206.91.199 - - [18/Jul/2026:00:17:29 +0200] "GET /export.php HTTP/1.1" 404 153 "-" "-" 20.206.91.199 - - [18/Jul/2026:00:17:29 +0200] "GET /amp.php HTTP/1.1" 404 153 "-" "-" 20.206.91.199 - - [18/Jul/2026:00:17:28 +0200] "GET /a7.php HTTP/1.1" 404 153 "-" "-" 20.206.91.199 - - [18/Jul/2026:00:17:28 +0200] "GET /tfm.php HTTP/1.1" 404 153 "-" "-" 20.206.91.199 - - [18/Jul/2026:00:17:28 +0200] "GET /inege.php HTTP/1.1" 404 153 "-" "-" 20.206.91.199 - - [18/Jul/2026:00:17:28 +0200] "GET /browse.php HTTP/1.1" 404 153 "-" "-" 20.206.91.199 - - [18/Jul/2026:00:17:27 +0200] "GET /ak.php HTTP/1.1" 404 153 "-" "-" show less	Web App Attack
🇧🇷 Peregrine	2026-07-19 03:14:11 (4 hours ago)	Fail2Ban ct101 Jail: tomcat-honeypot \| Evidence: 20.206.91.199 172.69.138.190 - - [17/Jul/2026:20:39 ... show more Fail2Ban ct101 Jail: tomcat-honeypot \| Evidence: 20.206.91.199 172.69.138.190 - - [17/Jul/2026:20:39:21 -0300] "GET /wp-content/plugins/hellopress/wp_filemanager.php HTTP/1.1" 404 18193 show less	Bad Web Bot
🇫🇷 alpha	2026-07-19 02:42:20 (4 hours ago)	Automated honeypot: scanner probed decoy URL on cdn.aldorand.fr (honeypot decoy)	Bad Web Bot Web App Attack
🇩🇪 tvipper.com	2026-07-19 01:00:42 (6 hours ago)	Auto reported by IDS	Brute-Force
🇳🇱 oisecnet	2026-07-18 21:01:42 (10 hours ago)	Automated report: Unauthorized vulnerability scanning detected on 2026-07-18. 286 requests from this ... show more Automated report: Unauthorized vulnerability scanning detected on 2026-07-18. 286 requests from this IP. show less	Brute-Force Web App Attack SSH
Anonymous	2026-07-18 18:04:33 (13 hours ago)	Blocked by FortiWeb WAF ML threat detection. ML probability: 99%, Country: BR, Attack patterns: Word ... show more Blocked by FortiWeb WAF ML threat detection. ML probability: 99%, Country: BR, Attack patterns: WordPress scanning, Malicious User-Agent show less	Bad Web Bot Web App Attack
🇳🇱 JCB	2026-07-18 12:55:00 (18 hours ago)	20.206.91.199 - - [18/Jul/2026:01:00:31 +0300] "GET /this_is_a_new_hello_world.php HTTP/1.1" 404 456 ... show more 20.206.91.199 - - [18/Jul/2026:01:00:31 +0300] "GET /this_is_a_new_hello_world.php HTTP/1.1" 404 456 "-" "-" 20.206.91.199 - - [18/Jul/2026:01:00:31 +0300] "GET /wp-includes/fonts/data.php HTTP/1.1" 404 456 "-" "-" ... show less	Web App Attack
Anonymous	2026-07-18 08:23:11 (22 hours ago)	"GET /wp-content/plugins/hellopress/wp_filemanager.php HTTP/1.1"	Hacking Web App Attack
🇮🇳 evicky2002	2026-07-18 06:00:00 (1 day ago)	Confirmed malicious by STILWaters CTI platform (score=100, sources=1)	Hacking Brute-Force SSH
🇭🇺 DumaNet	2026-07-18 05:14:00 (1 day ago)	Web app attack attempts, scanning for vulnerability. Date: 2026 Jul 18. 00:06:44 Source IP: 20.206 ... show more Web app attack attempts, scanning for vulnerability. Date: 2026 Jul 18. 00:06:44 Source IP: 20.206.91.199 Portion of the log(s): 20.206.91.199 - [18/Jul/2026:00:06:44 +0200] "GET /public/wp-ws68.php HTTP/1.1" 404 153 "-" "-" 20.206.91.199 - [18/Jul/2026:00:06:44 +0200] "GET /green1.php HTTP/1.1" 404 153 "-" "-" 20.206.91.199 - [18/Jul/2026:00:06:44 +0200] "GET /edit.php HTTP/1.1" 404 153 "-" "-" 20.206.91.199 - [18/Jul/2026:00:06:44 +0200] "GET /click.php HTTP/1.1" 404 153 "-" "-" 20.206.91.199 - [18/Jul/2026:00:06:43 +0200] "GET /wp-head.php HTTP/1.1" 404 153 "-" "-" 20.206.91.199 - [18/Jul/2026:00:06:43 +0200] "GET /wp-blog.php HTTP/1.1" 404 153 "-" "-" 20.206.91.199 - [18/Jul/2026:00:06:43 +0200] "GET /66.php HTTP/1.1" 404 153 "-" "-" 20.206.91.199 - [18/Jul/2026:00:06:43 +0200] "GET /file5.php HTTP/1.1" 404 153 "-" "-" 20.206.91.199 - [18/Jul/2026:00:06:43 +0200] "GET /sump1.php HTTP/1.1" 404 153 "-" "-" 20.206.91.199 - [18/Jul/2026:00:06:42 +0200] "GET /wp-blink.php HTTP/1.1" 404 153 "-" show less	Web App Attack
🇭🇺 DumaNet	2026-07-18 04:49:00 (1 day ago)	WordPress (CMS) attack attempts. Date: 2026 Jul 17. 23:55:07 Source IP: 20.206.91.199 Portion o ... show more WordPress (CMS) attack attempts. Date: 2026 Jul 17. 23:55:07 Source IP: 20.206.91.199 Portion of the log(s): 20.206.91.199 - [17/Jul/2026:23:55:07 +0200] "GET /wp-includes/spl-autoload-compat-restful.php HTTP/1.1" 404 153 "-" "-" 20.206.91.199 - [17/Jul/2026:23:55:07 +0200] "GET /wp-includes/spl-autoload-compat-restful.php HTTP/1.1" 404 153 "-" "-" 20.206.91.199 - [17/Jul/2026:23:55:07 +0200] "GET /wp-includes/class.wp-styles-dns.php HTTP/1.1" 404 153 "-" "-" 20.206.91.199 - [17/Jul/2026:23:55:06 +0200] "GET /wp-content/uploads/5drd24.php HTTP/1.1" 404 153 "-" "-" 20.206.91.199 - [17/Jul/2026:23:55:06 +0200] "GET /uploads/bigdump.php HTTP/1.1" 404 153 "-" "-" 20.206.91.199 - [17/Jul/2026:23:55:05 +0200] "GET /wp-includes/class-wp-xmlrpc-server-time.php HTTP/1.1" 404 153 "-" "-" 20.206.91.199 - [17/Jul/2026:23:55:05 +0200] "GET /cache-compat-constructor.php HTTP/1.1" 404 153 "-" "-" 20.206.91.199 - [17/Jul/2026:23:55:05 +0200] "GET /wp-includes/class-wp-hook-add.php HTTP/1.1" 404 153 "-" "-" show less	Web App Attack Hacking
🇲🇽 octageeks.com	2026-07-18 04:21:00 (1 day ago)	Wordpress malicious attack:[octascan]	Web App Attack
🇺🇸 Mehmet_The_Script_Kiddie	2026-07-18 03:18:59 (1 day ago)	CloudFlare WAF REPORT: /wp-slss.php	Bad Web Bot Web App Attack
🇩🇪 auridh	2026-07-18 01:42:59 (1 day ago)	Ip 20.206.91.199 performed 'crowdsecurity/http-wordpress-scan' (4 events over 2.202776744s) at 2026- ... show more Ip 20.206.91.199 performed 'crowdsecurity/http-wordpress-scan' (4 events over 2.202776744s) at 2026-07-17 22:16:01.882898251 +0000 UTC show less	Web App Attack
🇬🇧 thetomtaylor.co.uk	2026-07-18 01:08:02 (1 day ago)	Fail2Ban - [WEB]Custom exploit pattern detected on customexploits ... [ice01,ice02,wa01,wa02]	Hacking Brute-Force Bad Web Bot Web App Attack

Showing 1 to 15 of 169 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇺🇦 178.159.213.128

🇫🇷 91.196.152.196

🇮🇷 5.239.156.123

🇧🇷 200.199.32.174

🇷🇴 193.46.255.86

🇺🇸 173.255.223.89

🇨🇳 124.225.4.88

🇩🇪 109.91.4.177

🇺🇸 74.82.47.13

🇩🇪 69.5.169.195

🇸🇬 2a04:4e40:1700:0:2bf:3270:510d:45fd

🇦🇴 193.163.125.42

🇲🇾 183.171.7.171

🇮🇳 182.76.43.24

🇺🇸 162.216.149.125

🇳🇱 160.119.71.92

🇺🇸 147.185.132.13

🇺🇸 143.110.224.55

🇨🇳 119.53.253.2

🇯🇵 118.153.249.185