JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 20.226.22.37

20.226.22.37 was found in our database!

This IP was reported 172 times. Confidence of Abuse is 100%: ?

100%

ISP	Microsoft Corporation
Usage Type	Data Center/Web Hosting/Transit
ASN	AS8075
Domain Name	microsoft.com
Country	🇧🇷 Brazil
City	Campinas, Sao Paulo

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 20.226.22.37

Whois 20.226.22.37

IP Abuse Reports for 20.226.22.37:

This IP address has been reported a total of 172 times from 131 distinct sources. 20.226.22.37 was first reported on July 5th 2026, and the most recent report was 42 minutes ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇬🇷 setupgr	2026-07-06 22:42:48 (42 minutes ago)	(mod_security) mod_security (id:1000001) triggered by 20.226.22.37 (BR/Brazil/SÃ£o Paulo/Campinas/-/ ... show more (mod_security) mod_security (id:1000001) triggered by 20.226.22.37 (BR/Brazil/SÃ£o Paulo/Campinas/-/[AS8075 MICROSOFT-CORP-MSN-AS-BLOCK]): 1 in the last 86400 secs (CF_ENABLE); Ports: *; Direction: inout; Trigger: LF_MODSEC; Logs: [Tue Jul 07 01:42:43.743398 2026] [security2:error] [pid 273881:tid 273883] [remote 20.226.22.37:0] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/about.php" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec/modsec2.user.conf"] [line "103"] [id "1000001"] [msg "Bad file blocked: /about.php"] [severity "CRITICAL"] [tag "security"] [hostname "www.endoscope.center"] [uri "/about.php"] [unique_id "akwvY4wZLbS-z5ny5qJytgAAUAE"] show less	Port Scan
🇫🇷 SpaceHost-Server	2026-07-06 22:29:24 (56 minutes ago)		Brute-Force Web App Attack
🇩🇪 TrackerSB	2026-07-06 22:13:52 (1 hour ago)	20.226.22.37 - "-" [07/Jul/2026:00:13:46 +0200] "GET /wp-admin/ HTTP/1.1" 301 169 "-" "Mozilla/5.0 ( ... show more 20.226.22.37 - "-" [07/Jul/2026:00:13:46 +0200] "GET /wp-admin/ HTTP/1.1" 301 169 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" "20.226.22.37" 20.226.22.37 - "-" [07/Jul/2026:00:13:51 +0200] "GET /wp-admin/wp.php HTTP/1.1" 301 169 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" "20.226.22.37" ... show less	Web App Attack
🇺🇸 deskpass.com	2026-07-06 22:06:12 (1 hour ago)	GET /file.php	Web App Attack
Anonymous	2026-07-06 22:05:02 (1 hour ago)	Unknown PHP script access detected by Fail2Ban	Web App Attack
Anonymous	2026-07-06 21:36:53 (1 hour ago)	20.226.22.37 - - [06/Jul/2026:23:36:48 +0200] "GET /admin.php HTTP/1.1" 404 60628 "-" "Mozilla/5.0 ( ... show more 20.226.22.37 - - [06/Jul/2026:23:36:48 +0200] "GET /admin.php HTTP/1.1" 404 60628 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.226.22.37 - - [06/Jul/2026:23:36:49 +0200] "GET /admin.php HTTP/1.1" 404 13971 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.226.22.37 - - [06/Jul/2026:23:36:49 +0200] "GET /about.php HTTP/1.1" 404 60628 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.226.22.37 - - [06/Jul/2026:23:36:49 +0200] "GET /about.php HTTP/1.1" 404 13971 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.226.22.37 - - [06/Jul/2026:23:36:50 +0200] "GET /cgi-bin/ HTTP/1.1" 403 446 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20. ... show less	Bad Web Bot Web App Attack
Anonymous	2026-07-06 21:31:32 (1 hour ago)	[Mon Jul 06 23:31:30.836941 2026] [php:error] [pid 4019361] [client 20.226.22.37:1128] script '/var/ ... show more [Mon Jul 06 23:31:30.836941 2026] [php:error] [pid 4019361] [client 20.226.22.37:1128] script '/var/www/thisisdochdetroit.com/public_html/admin.php' not found or unable to stat [Mon Jul 06 23:31:31.032600 2026] [php:error] [pid 4019361] [client 20.226.22.37:1128] script '/var/www/thisisdochdetroit.com/public_html/about.php' not found or unable to stat [Mon Jul 06 23:31:31.032600 2026] [php:error] [pid 4019361] [client 20.226.22.37:1128] script '/var/www/thisisdochdetroit.com/public_html/about.php' not found or unable to stat [Mon Jul 06 23:31:31.618447 2026] [php:error] [pid 4019361] [client 20.226.22.37:1128] script '/var/www/thisisdochdetroit.com/public_html/adminfuns.php' not found or unable to stat ... show less	Bad Web Bot
🇩🇪 AetherFox	2026-07-06 21:15:52 (2 hours ago)	AetherFox VoidGuard detected: [Mon Jul 06 21:15:51.500747 2026] [authz_core:error] [pid 3849872:tid ... show more AetherFox VoidGuard detected: [Mon Jul 06 21:15:51.500747 2026] [authz_core:error] [pid 3849872:tid 3849925] [client 20.226.22.37:5322] AH01630: client denied by server configuration: proxy:https://hq.draconigen.net.dedivirt4209.your-server.de/admin.php [Mon Jul 06 21:15:51.500977 2026] [authz_core:error] [pid 3849872:tid 3849925] [client 20.226.22.37:5322] AH01630: client denied by server configuration: /var/www/html/ERRORpages/403.html [Mon Jul 06 21:15:51.697284 2026] [authz_core:error] [pid 3849872:tid 3849885] [client 20.226.22.37:5322] AH01630: client denied by server configuration: proxy:https://hq.draconigen.net.dedivirt4209.your-server.de/about.php [Mon Jul 06 21:15:51.697545 2026] [authz_core:error] [pid 3849872:tid 3849885] [client 20.226.22.37:5322] AH01630: client denied by server configuration: /var/www/html/ERRORpages/403.html [Mon Jul 06 21:15:51.893853 2026] [authz_core:error] [pid 3849872:tid 3849922] [client 20.226.22.37:5322] AH01630: client deni ... show less	Bad Web Bot Web App Attack
🇺🇸 Epimetheus	2026-07-06 21:00:06 (2 hours ago)	Unauthorized access attempts: [GET] /wp-content/plugins/plugin/index.php [GET] /wp-content/themes/i ... show more Unauthorized access attempts: [GET] /wp-content/plugins/plugin/index.php [GET] /wp-content/themes/index.php [GET] /inputs.php [GET] /edit.php [GET] /wp-content/uploads/ [GET] /wp-admin/ [GET] /lite.php [GET] /.well-known/logs233/index.php UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 show less	Web App Attack
🇳🇱 CryptoYakari	2026-07-06 20:44:58 (2 hours ago)	20.226.22.37 - - [06/Jul/2026:23:44:53 +0300] "GET /admin.php HTTP/1.0" 404 531 "-" "Mozilla/5.0 (Wi ... show more 20.226.22.37 - - [06/Jul/2026:23:44:53 +0300] "GET /admin.php HTTP/1.0" 404 531 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.226.22.37 - - [06/Jul/2026:23:44:53 +0300] "GET /about.php HTTP/1.0" 404 531 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.226.22.37 - - [06/Jul/2026:23:44:53 +0300] "GET /cgi-bin/ HTTP/1.0" 404 3515 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.226.22.37 - - [06/Jul/2026:23:44:53 +0300] "GET /wp-content/themes/ HTTP/1.0" 404 3515 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.226.22.37 - - [06/Jul/2026:23:44:53 +0300] "GET /adminfuns.php HTTP/1.0" 404 531 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537. ... show less	Web Spam Blog Spam Web App Attack Bad Web Bot
🇺🇸 WellSpring	2026-07-06 20:09:11 (3 hours ago)	wordpress scan on 920.today/wp-content/themes/pridmag/il.php — WellSpr.ing/NetSentinel civic-AI secu ... show more wordpress scan on 920.today/wp-content/themes/pridmag/il.php — WellSpr.ing/NetSentinel civic-AI security layer show less	Bad Web Bot Web App Attack
Anonymous	2026-07-06 20:01:13 (3 hours ago)	20.226.22.37 - - [06/Jul/2026:22:00:14 +0200] "GET /inputs.php HTTP/1.1" 404 41071 "-" "Mozilla/5.0 ... show more 20.226.22.37 - - [06/Jul/2026:22:00:14 +0200] "GET /inputs.php HTTP/1.1" 404 41071 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.226.22.37 - - [06/Jul/2026:22:00:17 +0200] "GET /admin.php HTTP/1.1" 404 41069 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.226.22.37 - - [06/Jul/2026:22:00:19 +0200] "GET /goods.php HTTP/1.1" 404 41068 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.226.22.37 - - [06/Jul/2026:22:00:22 +0200] "GET /file.php HTTP/1.1" 404 41068 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.226.22.37 - - [06/Jul/2026:22:00:24 +0200] "GET /adminfuns.php HTTP/1.1" 404 41071 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537. ... show less	Web App Attack
Anonymous	2026-07-06 19:59:03 (3 hours ago)	Cyber.Irish SIEM auto-block: Web - Sensitive File Access Attempt (Live)	Web App Attack
🇦🇹 penguin-solutions.at	2026-07-06 19:55:37 (3 hours ago)	Excessive 403/404 errors ...	Brute-Force Web App Attack
Anonymous	2026-07-06 19:39:24 (3 hours ago)	SPARSDE WEBEXPLOIT 20.226.22.37 (20.226.22.37)	Web App Attack

Showing 1 to 15 of 172 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇳🇱 195.178.110.137

🇺🇸 147.78.180.135

🇱🇹 77.90.185.20

🇳🇱 45.148.10.152

🇧🇷 205.210.31.209

🇧🇷 179.48.33.145

🇺🇸 150.107.38.168

🇻🇳 103.154.62.14

🇫🇷 85.217.140.4

🇫🇷 85.217.140.1

🇺🇸 71.6.134.229

🇩🇪 47.245.139.141

🇳🇱 45.198.224.245

🇺🇸 40.119.40.152

🇺🇸 2607:f8b0:4023:1006::124

🇰🇷 162.158.139.20

🇰🇷 162.158.138.100

🇫🇷 147.135.191.99

🇿🇲 102.212.183.19

🇹🇷 45.147.46.223