JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 20.213.146.9

20.213.146.9 was found in our database!

This IP was reported 809 times. Confidence of Abuse is 100%: ?

100%

ISP	Microsoft Corporation
Usage Type	Data Center/Web Hosting/Transit
ASN	AS8075
Domain Name	microsoft.com
Country	🇦🇺 Australia
City	Sydney, New South Wales

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 20.213.146.9

Whois 20.213.146.9

IP Abuse Reports for 20.213.146.9:

This IP address has been reported a total of 809 times from 433 distinct sources. 20.213.146.9 was first reported on October 13th 2026, and the most recent report was 8 hours ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇧🇷 Peregrine	2026-10-22 03:18:10 (8 hours ago)	Fail2Ban Jail:IU tomcat-honeypot \| Evidence: 20.213.146.9 104.22.127.108 - - [20/Oct/2026:13:45:53 - ... show more Fail2Ban Jail:IU tomcat-honeypot \| Evidence: 20.213.146.9 104.22.127.108 - - [20/Oct/2026:13:45:53 -0300] "GET /wp-content/plugins/hellopress/wp_filemanager.php HTTP/1.1" 404 - show less	Bad Web Bot
🇫🇮 KTSTechnology	2026-10-21 16:54:39 (19 hours ago)	Web vulnerability scanning detected by our ISP firewall	Web App Attack
🇩🇪 hchristo	2026-10-21 16:15:05 (19 hours ago)	[Wed Oct 21 18:15:01.572339 2026] [proxy_fcgi:error] [pid 43364:tid 43466] [client 20.213.146.9:2691 ... show more [Wed Oct 21 18:15:01.572339 2026] [proxy_fcgi:error] [pid 43364:tid 43466] [client 20.213.146.9:2691] AH01071: Got error 'Primary script unknown' [Wed Oct 21 18:15:02.144358 2026] [proxy_fcgi:error] [pid 43364:tid 43443] [client 20.213.146.9:2691] AH01071: Got error 'Primary script unknown' [Wed Oct 21 18:15:02.718571 2026] [proxy_fcgi:error] [pid 43364:tid 43444] [client 20.213.146.9:2691] AH01071: Got error 'Primary script unknown' [Wed Oct 21 18:15:03.292961 2026] [proxy_fcgi:error] [pid 43364:tid 43450] [client 20.213.146.9:2691] AH01071: Got error 'Primary script unknown' [Wed Oct 21 18:15:03.867088 2026] [proxy_fcgi:error] [pid 43364:tid 43424] [client 20.213.146.9:2691] AH01071: Got error 'Primary script unknown' ... show less	Brute-Force
🇷🇴 clauss	2026-10-21 16:09:18 (20 hours ago)	20.213.146.9 - - [21/Oct/2026:19:09:17 +0300] "GET /.well-known/info.php HTTP/2.0" 404 47260 "-" "-" ... show more 20.213.146.9 - - [21/Oct/2026:19:09:17 +0300] "GET /.well-known/info.php HTTP/2.0" 404 47260 "-" "-" ... show less	Web App Attack
🇳🇱 e.fierstra	2026-10-21 15:45:12 (20 hours ago)	excessive HTTP 404 errors	Bad Web Bot
🇧🇷 Host One	2026-10-21 15:04:25 (21 hours ago)	Web vulnerability scanning: automated requests without User-Agent. Blocked by firewall on 6 differen ... show more Web vulnerability scanning: automated requests without User-Agent. Blocked by firewall on 6 different hosting servers. Protocol TCP, port 80, 443 (HTTP/HTTPS). Requested paths: /133.php, /BDKR28WP.php, /ebkid.php, /txets.php, /radio.php. Automated report. show less	Bad Web Bot Web App Attack
🇺🇸 ArturShelby	2026-10-21 14:34:46 (21 hours ago)	Suspicious file access: /.well-known/info.php	Web App Attack
🇩🇪 Hans Wurst	2026-10-21 14:14:59 (21 hours ago)	Many 404-Error: Suspicion of URL-Fuzzing/Bot-Scan.	Web App Attack
🇳🇱 Site.eu	2026-10-21 13:21:41 (22 hours ago)	Excessive multi-domain requests	Brute-Force
Anonymous	2026-10-21 13:20:36 (22 hours ago)	fail2ban jail apache-scanner: 20.213.146.9 - - [14/Oct/2026:01:19:25 -0700] "GET /BDKR28WP.php HTTP/ ... show more fail2ban jail apache-scanner: 20.213.146.9 - - [14/Oct/2026:01:19:25 -0700] "GET /BDKR28WP.php HTTP/1.1" 403 447 "-" "-" 20.213.146.9 - - [14/Oct/2026:01:19:25 -0700] "GET /z60.php?p= HTTP/1.1" 403 447 "-" "-" 20.213.146.9 - - [14/Oct/2026:01:19:25 -0700] "GET /ebkid.php HTTP/1.1" 403 447 "-" "-" 20.213.146.9 - - [14/Oct/2026:01:19:25 -0700] "GET /133.php HTTP/1.1" 403 447 "-" "-" 20.213.146.9 - - [14/Oct/2026:01:19:25 -0700] "GET /cae.php HTTP/1.1" 403 447 "-" "-" 20.213.146.9 - - [14/Oct/2026:01:19:25 -0700] "GET /txets.php HTTP/1.1" 403 447 "-" "-" 20.213.146.9 - - [14/Oct/2026:01:19:26 -0700] "GET /177.php HTTP/1.1" 403 447 "-" "-" 20.213.146.9 - - [14/Oct/2026:01:19:26 -0700] "GET /ccc.php HTTP/1.1" 403 447 "-" "-" 20.213.146.9 - - [14/Oct/2026:01:19:26 -0700] "GET /0.php HTTP/1.1" 403 447 "-" "-" 20.213.146.9 - - [14/Oct/2026:01:19:26 -0700] "GET /opsh.php HTTP/1.1" 403 447 "-" "-" show less	Web App Attack Port Scan
🇺🇸 EvilTurkey	2026-10-21 12:22:00 (23 hours ago)	Web app attack against financial institution website.	Web App Attack Hacking
🇭🇺 kranem	2026-10-21 12:00:34 (1 day ago)	Triggered Cloudflare WAF from AU. Action taken: BLOCK ASN: 8075 (Microsoft Corporation) Protocol: HT ... show more Triggered Cloudflare WAF from AU. Action taken: BLOCK ASN: 8075 (Microsoft Corporation) Protocol: HTTP/1.1 (GET method) Endpoint: /wp-content/plugins/hellopress/wp_filemanager.php Timestamp: 2026-10-21T10:41:54Z User-Agent: empty show less	Bad Web Bot
🇩🇪 ghostwarriors	2026-10-21 11:21:18 (1 day ago)	Webpage scraping	Brute-Force Bad Web Bot Web App Attack
🇦🇺 2000cn.com.au	2026-10-21 08:49:42 (1 day ago)	This IP was detected by CrowdSec triggering crowdsecurity/http-wordpress-scan	Web App Attack Hacking
Anonymous	2026-10-21 08:45:16 (1 day ago)	20.213.146.9 - - [21/Oct/2026:10:44:45 +0200] "GET /wp-content/plugins/hellopress/wp_filemanager.php ... show more 20.213.146.9 - - [21/Oct/2026:10:44:45 +0200] "GET /wp-content/plugins/hellopress/wp_filemanager.php HTTP/1.1" 404 481 "-" "-" 20.213.146.9 - - [21/Oct/2026:10:44:46 +0200] "GET /this_is_a_new_hello_world.php HTTP/1.1" 404 481 "-" "-" 20.213.146.9 - - [21/Oct/2026:10:44:46 +0200] "GET /3PJcpMFsD8B.php HTTP/1.1" 404 481 "-" "-" 20.213.146.9 - - [21/Oct/2026:10:44:46 +0200] "GET /z70.php HTTP/1.1" 404 481 "-" "-" 20.213.146.9 - - [21/Oct/2026:10:44:47 +0200] "GET /1.php?p= HTTP/1.1" 404 481 "-" "-" 20.213.146.9 - - [21/Oct/2026:10:44:47 +0200] "GET /radio.php HTTP/1.1" 404 481 "-" "-" 20.213.146.9 - - [21/Oct/2026:10:44:47 +0200] "GET /BDKR28WP.php HTTP/1.1" 404 481 "-" "-" 20.213.146.9 - - [21/Oct/2026:10:44:47 +0200] "GET /z60.php?p= HTTP/1.1" 404 481 "-" "-" 20.213.146.9 - - [21/Oct/2026:10:44:48 +0200] "GET /ebkid.php HTTP/1.1" 404 481 "-" "-" 20.213.146.9 - - [21/Oct/2026:10:44:48 +0200] "GET /133.php HTTP/1.1" 404 481 "-" "-" 20.213.146.9 - - [21/Oct/2026:10:44:48 +0200] "GET /cae. ... show less	DDoS Attack

Showing 1 to 15 of 809 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇸🇬 193.37.32.86

🇺🇸 165.227.90.57

🇺🇸 147.185.132.167

🇫🇮 128.1.198.78

🇨🇳 121.199.5.102

🇰🇷 61.72.55.130

🇮🇪 54.220.7.188

🇫🇷 51.75.247.232

🇨🇳 47.95.196.41

🇳🇱 45.156.128.76

🇩🇪 213.209.159.208

🇲🇾 202.165.26.170

🇷🇴 193.32.162.167

🇺🇸 174.67.188.60

🇧🇷 168.181.222.97

🇻🇳 152.32.249.95

🇦🇪 92.97.227.164

🇫🇷 85.217.140.8

🇩🇪 69.5.169.137

🇨🇦 45.198.224.45