JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 20.220.189.161

20.220.189.161 was found in our database!

This IP was reported 224 times. Confidence of Abuse is 100%: ?

100%

ISP	Microsoft Corporation
Usage Type	Data Center/Web Hosting/Transit
ASN	AS8075
Domain Name	microsoft.com
Country	🇨🇦 Canada
City	Toronto, Ontario

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 20.220.189.161

Whois 20.220.189.161

IP Abuse Reports for 20.220.189.161:

This IP address has been reported a total of 224 times from 165 distinct sources. 20.220.189.161 was first reported on August 21st 2026, and the most recent report was 1 hour ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇵🇱 Budyn	2026-08-22 14:51:53 (1 hour ago)	Automated threat detected by Budyn Honeypot Sinkhole. Attack type: CRITICAL: ModSecurity WAF Exploit ... show more Automated threat detected by Budyn Honeypot Sinkhole. Attack type: CRITICAL: ModSecurity WAF Exploit Block. Malicious scanner triggered a security trap targeting emulated vulnerabilities. Evidence: HOST: budyn.ovh \| URI: /.well-known/ \| UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 \| BODY: [Empty / GET Request] show less	Hacking Web App Attack
🇩🇪 Nevermind	2026-08-22 14:50:22 (1 hour ago)	20.220.189.161 - - [22/Aug/2026:16:50:21 +0200] "GET /cah.php HTTP/1.1" 404 5463 "-" "Mozilla/5.0 (W ... show more 20.220.189.161 - - [22/Aug/2026:16:50:21 +0200] "GET /cah.php HTTP/1.1" 404 5463 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.220.189.161 - - [22/Aug/2026:16:50:21 +0200] "GET /files/index.php HTTP/1.1" 404 6291 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.220.189.161 - - [22/Aug/2026:16:50:21 +0200] "GET /wp-includes/block-supports/ HTTP/1.1" 404 6291 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.220.189.161 - - [22/Aug/2026:16:50:21 +0200] "GET /images/images/about.php HTTP/1.1" 404 6291 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" ... show less	Web App Attack
Anonymous	2026-08-22 14:14:33 (1 hour ago)	(caddyscan) Scanner path probe from 20.220.189.161 (CA/Canada/-): 5 in the last 3600 secs; Ports: ; ... show more (caddyscan) Scanner path probe from 20.220.189.161 (CA/Canada/-): 5 in the last 3600 secs; Ports: ; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: [REDACTED] 200 2627 20.220.189.161 - - [22/Aug/2026:14:14:29 +0000] "GET /wp-admin/css/colors/index.php HTTP/1.1" [REDACTED] 200 2627 20.220.189.161 - - [22/Aug/2026:14:14:29 +0000] "GET /wp-admin/network/index.php HTTP/1.1" [REDACTED] 200 2627 20.220.189.161 - - [22/Aug/2026:14:14:30 +0000] "GET /wp-admin/css/colors/midnight/ HTTP/1.1" [REDACTED] 200 2627 20.220.189.161 - - [22/Aug/2026:14:14:30 +0000] "GET /wp-admin/css/ HTTP/1.1" [REDACTED] 200 2627 20.220.189.161 - - [22/Aug/2026:14:14:30 +0000] "GET /wp-login.php HTTP/1.1" show less	Port Scan
🇬🇧 Andrew	2026-08-22 14:14:05 (1 hour ago)	20.220.189.161 - - [22/Aug/2026:15:14:03 +0100] "GET /cah.php HTTP/1.1" 404 20273 "-" "Mozilla/5.0 ( ... show more 20.220.189.161 - - [22/Aug/2026:15:14:03 +0100] "GET /cah.php HTTP/1.1" 404 20273 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.220.189.161 - - [22/Aug/2026:15:14:03 +0100] "GET /files/index.php HTTP/1.1" 404 18365 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.220.189.161 - - [22/Aug/2026:15:14:03 +0100] "GET /images/images/about.php HTTP/1.1" 404 18373 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.220.189.161 - - [22/Aug/2026:15:14:04 +0100] "GET /wp-content/index.php HTTP/1.1" 404 18370 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.220.189.161 - - [22/Aug/2026:15:14:04 +0100] "GET /wp-admin/css/colors/index.php HTTP/1.1" 404 18379 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/ ... show less	Hacking Web App Attack
🇸🇬 fazar	2026-08-22 13:32:18 (2 hours ago)	wp-login-scan: 3 attempts from 20.220.189.161 on node: sgp01	Exploited Host Web App Attack
🇩🇪 TheDjRider	2026-08-22 13:29:25 (2 hours ago)	CrowdSec detected Web application reconnaissance. Scenario: crowdsecurity/http-probing. Automatic ba ... show more CrowdSec detected Web application reconnaissance. Scenario: crowdsecurity/http-probing. Automatic ban triggered. Detection time (UTC): 2026-08-22T13:29:15.962364177Z. Context: http_status=404, http_status=403 show less	Web App Attack
🇩🇪 macrob	2026-08-22 13:20:53 (2 hours ago)	2026/08/22 13:20:51 [error] 3074754#3074754: 508116719 access forbidden by rule, client: 20.220.189 ... show more 2026/08/22 13:20:51 [error] 3074754#3074754: 508116719 access forbidden by rule, client: 20.220.189.161, server: binixo.ph, request: "GET /wp-includes/block-supports/ HTTP/1.1", host: "binixo.ph" 2026/08/22 13:20:52 [error] 3074754#3074754: 508116719 access forbidden by rule, client: 20.220.189.161, server: binixo.ph, request: "GET /wp-includes/images/ HTTP/1.1", host: "binixo.ph" 2026/08/22 13:20:52 [error] 3074754#3074754: 508116719 access forbidden by rule, client: 20.220.189.161, server: binixo.ph, request: "GET /wp-content/index.php HTTP/1.1", host: "binixo.ph" ... show less	Web App Attack
🇺🇸 ipblock.com	2026-08-22 12:46:00 (3 hours ago)	Exploit request, vulnerability scanner.	Hacking Bad Web Bot Web App Attack
🇩🇪 netclix.gr	2026-08-22 12:34:40 (3 hours ago)	(PERMBLOCK) 20.220.189.161 (CA/Canada/-) has had more than 2 temp blocks in the last 604800 secs; Po ... show more (PERMBLOCK) 20.220.189.161 (CA/Canada/-) has had more than 2 temp blocks in the last 604800 secs; Ports: *; Direction: inout; Trigger: LF_PERMBLOCK_COUNT; Logs: show less	Port Scan
🇺🇸 antlac1	2026-08-22 12:04:37 (4 hours ago)	crowdsecurity/http-wordpress-scan	Brute-Force Web App Attack
🇭🇺 DumaNet	2026-08-22 10:53:00 (5 hours ago)	WordPress (CMS) attack attempts. Date: 2026 Aug 22. 10:51:49 Source IP: 20.220.189.161 Portion ... show more WordPress (CMS) attack attempts. Date: 2026 Aug 22. 10:51:49 Source IP: 20.220.189.161 Portion of the log(s): 20.220.189.161 - [22/Aug/2026:10:51:49 +0200] "GET /admin.php HTTP/1.1" 404 555 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.220.189.161 - [22/Aug/2026:10:51:49 +0200] "GET /up.php HTTP/1.1" 404 555 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.220.189.161 - [22/Aug/2026:10:51:49 +0200] "GET /lock360.php HTTP/1.1" 404 555 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.220.189.161 - [22/Aug/2026:10:51:49 +0200] "GET /wp-admin/network/index.php HTTP/1.1" 404 555 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.220.189.161 - [22/Aug/2026:10:51:49 +0200] "GET /classwithtostring.php HTTP/1.1" 404 show less	Web App Attack Hacking
🇩🇪 usc-IPDB	2026-08-22 10:48:25 (5 hours ago)	20.220.189.161 - - [22/Aug/2026:12:48:24 +0200] "GET /cah.php HTTP/1.1" 404 181 "-" "Mozilla/5.0 (Wi ... show more 20.220.189.161 - - [22/Aug/2026:12:48:24 +0200] "GET /cah.php HTTP/1.1" 404 181 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.220.189.161 - - [22/Aug/2026:12:48:24 +0200] "GET /files/index.php HTTP/1.1" 404 181 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.220.189.161 - - [22/Aug/2026:12:48:24 +0200] "GET /wp-includes/block-supports/ HTTP/1.1" 403 180 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" ... show less	Port Scan
🇳🇱 CryptoYakari	2026-08-22 10:40:36 (5 hours ago)	2026-08-22 13:40:18,758 fail2ban.actions [928]: NOTICE [nginx-baduris] Ban 20.220.189.161 20 ... show more 2026-08-22 13:40:18,758 fail2ban.actions [928]: NOTICE [nginx-baduris] Ban 20.220.189.161 2026-08-22 13:40:19,197 fail2ban.actions [928]: NOTICE [nginx-404] Ban 20.220.189.161 ... show less	Hacking
🇩🇪 Interceptor_HQ	2026-08-22 10:22:51 (5 hours ago)	request_uri: /cah.php -- automatic report --	Brute-Force Hacking
🇵🇱 strefapi_com	2026-08-22 10:08:06 (5 hours ago)	Brute-force, web ...	Hacking Brute-Force Web App Attack

Showing 1 to 15 of 224 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇩🇪 213.209.159.210

🇧🇷 187.51.84.86

🇧🇬 79.124.58.90

🇲🇽 187.189.164.27

🇨🇴 185.240.215.110

🇺🇸 172.202.118.40

🇫🇷 172.68.151.68

🇩🇪 167.94.145.29

🇺🇸 147.185.132.162

🇨🇳 121.18.148.10

🇨🇦 66.49.213.33

🇮🇳 223.185.21.20

🇨🇭 212.243.68.166

🇪🇸 212.227.248.58

🇫🇷 185.177.72.17

🇧🇷 179.183.114.175

🇧🇩 103.60.204.198

🇷🇺 95.165.25.233

🇷🇴 92.118.39.209

🇬🇧 89.116.78.207