This IP address has been reported a total of
135
times from
115 distinct
sources.
20.220.149.193 was first reported on
, and the most recent report was
.
Recent Reports:
We have received reports of abusive activity from this IP address within the last week. It is
potentially still actively engaged in abusive activities.
[AUTORAVALT][[15/06/2026 - 20:25:17 -03:00 UTC]
Attack from [Microsoft Corporation]
[20.220.149.193] ...
show more[AUTORAVALT][[15/06/2026 - 20:25:17 -03:00 UTC]
Attack from [Microsoft Corporation]
[20.220.149.193] Action: BLocKed
Hacking... Unauthorized attempts to access the server.
Web App Attack -> Attempts to probe for or exploit installed web applications such as a CMS like WordPress/Drupal, e-commerce solutions, forum software, phpMyAdmin and various other software]
...
show less
Multi abuses [2]: Scanning for installed WordPress and vulnerabilities, Unauthorized connection atte ...
show moreMulti abuses [2]: Scanning for installed WordPress and vulnerabilities, Unauthorized connection attempt / Port scanning (x2)
20.220.149.193 [15/Jun/2026:23:11:48] "GET /wp-content/plugins/hellopress/wp_filemanager.php HTTP/1.1"
20.220.149.193 [15/Jun/2026:23:11:49] "GET /this_is_a_new_hello_world.php HTTP/1.1"
20.220.149.193 [15/Jun/2026:23:11:49] "GET /jj.php HTTP/1.1"
show less
Port Scan
Web App Attack
Anonymous
[15-Jun-2026 19:02:46 America/New_York] Page Not Found: wp_filemanager.php [20.220.149.193]
[15-Jun- ...
show more[15-Jun-2026 19:02:46 America/New_York] Page Not Found: wp_filemanager.php [20.220.149.193]
[15-Jun-2026 19:02:46 America/New_York] Page Not Found: this_is_a_new_hello_world.php [20.220.149.193]
...
show less
(localhost/crowdsec) crowdsecurity/http-wordpress-scan by ip 20.220.149.193 (CA/8075) : 4h ban on Ip ...
show more(localhost/crowdsec) crowdsecurity/http-wordpress-scan by ip 20.220.149.193 (CA/8075) : 4h ban on Ip 20.220.149.193
show less
[TueJun1600:04:26.6933492026][security2:error][pid1023768:tid1024371][client20.220.149.193:0]ModSecu ...
show more[TueJun1600:04:26.6933492026][security2:error][pid1023768:tid1024371][client20.220.149.193:0]ModSecurity:Accessdeniedwithcode403\(phase2\).Patternmatch\"\(filemanager\|wp-file-manager\|elfinder\)\"atREQUEST_URI.[file\"/etc/apache2/conf.d/modsec_custom_rules.conf\"][line\"443\"][id\"980500\"][msg\"WordPressfilemanagerexploitattempt\"][hostname\"autodiscover.gsdsagl.ch\"][uri\"/wp-content/plugins/hellopress/wp_filemanager.php\"][unique_id\"ajB26pc3EGdRrEm5W4_3zgAAAII\"]
show less
(aggressive_scanner) REGOLA 9 - Aggressive Web Scanner 20.220.149.193 (CA/Canada/-): 1 in the last 3 ...
show more(aggressive_scanner) REGOLA 9 - Aggressive Web Scanner 20.220.149.193 (CA/Canada/-): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: 20.220.149.193 - - [16/Jun/2026:00:02:57 +0200] "GET /wp-content/plugins/hellopress/wp_filemanager.php HTTP/1.1" 404 15319 "-" "-" "-" host=lucadipa.com
show less
Port Scan
Showing 1 to
15
of 135 reports
Think this IP has been falsely reported? You may request to have the associated
reports reviewed and removed.
Request Takedown 🚩