JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 20.222.20.4

20.222.20.4 was found in our database!

This IP was reported 147 times. Confidence of Abuse is 100%: ?

100%

ISP	Microsoft Corporation
Usage Type	Data Center/Web Hosting/Transit
ASN	AS8075
Domain Name	microsoft.com
Country	🇯🇵 Japan
City	Tokyo, Tokyo

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 20.222.20.4

Whois 20.222.20.4

IP Abuse Reports for 20.222.20.4:

This IP address has been reported a total of 147 times from 113 distinct sources. 20.222.20.4 was first reported on July 2nd 2026, and the most recent report was 1 day ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇨🇭 Origon	2026-07-07 04:29:27 (1 day ago)	recidive - IP: 20.222.20.4 - 2026-07-02 19:36:51,704 fail2ban.actions [1829761]: NOTICE [plesk-apac ... show more recidive - IP: 20.222.20.4 - 2026-07-02 19:36:51,704 fail2ban.actions [1829761]: NOTICE [plesk-apache] Ban 20.222.20.4 2026-07-02 22:11:55,288 fail2ban.actions [1829761]: NOTICE [plesk-apache] Ban 20.222.20.4 2026-07-03 00:30:50,399 fail2ban.actions [1829761]: NOTICE [plesk-apache] Ban 20.222.20.4 show less	Web App Attack
🇫🇷 SpaceHost-Server	2026-07-03 22:29:40 (4 days ago)		Brute-Force Web App Attack
Anonymous	2026-07-03 19:04:21 (4 days ago)	Blocked by FortiWeb WAF ML threat detection. ML probability: 99%, Country: JP, Attack patterns: Word ... show more Blocked by FortiWeb WAF ML threat detection. ML probability: 99%, Country: JP, Attack patterns: WordPress scanning, Webshell probing show less	Bad Web Bot Web App Attack
🇸🇪 adaml1324	2026-07-03 06:09:18 (5 days ago)	Web application exploit probing From server logs: 2026-07-03 02:48:05 [domain] GET /wp-content/up ... show more Web application exploit probing From server logs: 2026-07-03 02:48:05 [domain] GET /wp-content/uploads/ HTTP/1.1 [444 Blockerad] UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 2026-07-03 02:48:06 [domain] GET /wp-content/uploads/ HTTP/1.1 [444 Blockerad] UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 2026-07-03 02:48:06 [domain] GET /wp-content/uploads/ HTTP/1.1 [444 Blockerad] show less	Web App Attack
🇬🇧 openstrike.co.uk	2026-07-03 05:16:21 (5 days ago)	1560 attacks on PHP URLs, ACME URLs: GET /gifclass.php HTTP/1.1 GET /.well-known/acme-challenge/make ... show more 1560 attacks on PHP URLs, ACME URLs: GET /gifclass.php HTTP/1.1 GET /.well-known/acme-challenge/makeasmtp.php HTTP/1.1 show less	Web App Attack
🇪🇸 librebit	2026-07-03 04:42:42 (5 days ago)	Bad guys doing bad things, bad crawling	Bad Web Bot
🇧🇪 taivas.nl	2026-07-03 04:32:48 (5 days ago)	Many_bad_calls	Web App Attack
🇵🇱 Jacqb	2026-07-03 02:20:26 (5 days ago)	Adres potencjalnie niebezpieczny	Brute-Force Web App Attack Bad Web Bot
🇳🇱 CryptoYakari	2026-07-03 02:20:16 (5 days ago)	20.222.20.4 - - [03/Jul/2026:05:20:08 +0300] "GET /adminfuns.php HTTP/1.0" 404 531 "-" "Mozilla/5.0 ... show more 20.222.20.4 - - [03/Jul/2026:05:20:08 +0300] "GET /adminfuns.php HTTP/1.0" 404 531 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.222.20.4 - - [03/Jul/2026:05:20:09 +0300] "GET /file.php HTTP/1.0" 404 531 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.222.20.4 - - [03/Jul/2026:05:20:09 +0300] "GET /admin.php HTTP/1.0" 404 531 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.222.20.4 - - [03/Jul/2026:05:20:09 +0300] "GET /wp-admin/css/colors/ocean/ HTTP/1.0" 404 3515 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.222.20.4 - - [03/Jul/2026:05:20:09 +0300] "GET /wk/index.php HTTP/1.0" 404 3515 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safar ... show less	Web Spam Blog Spam Web App Attack Bad Web Bot
🇫🇷 mrcrassi	2026-07-03 02:19:59 (5 days ago)	Triggered Cloudflare WAF (botFight) from JP. Action taken: MANAGED_CHALLENGE Protocol: HTTP/1.1 (GET ... show more Triggered Cloudflare WAF (botFight) from JP. Action taken: MANAGED_CHALLENGE Protocol: HTTP/1.1 (GET method) Endpoint: /wp-includes/Text/about.php UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 This report was generated by: https://github.com/sefinek/Cloudflare-WAF-To-AbuseIPDB show less	Bad Web Bot
🇬🇷 setupgr	2026-07-03 02:08:44 (5 days ago)	(mod_security) mod_security (id:1000001) triggered by 20.222.20.4 (JP/Japan/Tokyo/Shibuya City/-/[AS ... show more (mod_security) mod_security (id:1000001) triggered by 20.222.20.4 (JP/Japan/Tokyo/Shibuya City/-/[AS8075 MICROSOFT-CORP-MSN-AS-BLOCK]): 1 in the last 86400 secs (CF_ENABLE); Ports: *; Direction: inout; Trigger: LF_MODSEC; Logs: [Fri Jul 03 05:08:43.737184 2026] [security2:error] [pid 3764019:tid 3764152] [client 20.222.20.4:20306] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/about.php" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec/modsec2.user.conf"] [line "103"] [id "1000001"] [msg "Bad file blocked: /about.php"] [severity "CRITICAL"] [tag "security"] [hostname "ftiaxtomonosou.gr"] [uri "/about.php"] [unique_id "akcZq24255gyOCZer8NjgAAAAwY"] show less	Port Scan
🇩🇪 Viveronese	2026-07-03 02:00:52 (5 days ago)	HTTP vulnerability scanning	Web App Attack
🇦🇺 paulshipley.com.au	2026-07-03 01:51:11 (5 days ago)	dlcarterauthor.com:443 20.222.20.4 - - [03/Jul/2026:11:51:10 +1000] "GET /adminfuns.php HTTP/1.1" 40 ... show more dlcarterauthor.com:443 20.222.20.4 - - [03/Jul/2026:11:51:10 +1000] "GET /adminfuns.php HTTP/1.1" 404 71968 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" ... show less	Web App Attack
🇳🇱 i-turnradio.nl	2026-07-03 01:37:28 (5 days ago)	2026-07-03 @ 03:37:28 (CET) ~ Blocked for trying to access: /adminfuns.php	Web App Attack
Anonymous	2026-07-03 01:24:35 (5 days ago)	[Drupal AbuseIPDB module] Request path is blacklisted. /wp-includes/block-bindings/	Web App Attack

Showing 1 to 15 of 147 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇬🇧 185.230.223.222

🇨🇳 101.96.195.62

🇮🇱 95.35.26.164

🇳🇱 45.148.10.119

🇺🇸 2600:3c01::2000:f8ff:fe5a:3b87

🇧🇬 91.191.209.118

🇷🇺 85.239.60.30

🇦🇱 79.106.33.65

🇺🇸 66.132.186.207

🇺🇸 44.38.14.154

🇭🇰 199.45.154.188

🇹🇷 195.142.246.201

🇧🇴 190.129.122.12

🇧🇷 179.133.73.6

🇨🇦 143.198.36.142

🇨🇳 115.231.78.11

🇺🇸 66.132.186.218

🇺🇸 50.6.250.45

🇳🇱 45.148.10.151

🇺🇸 44.243.71.228