JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

20.25.145.66

Recent Activity

Abuse Confidence Score

100% Critical

759 reports

580 reporters · latest 3 minutes ago

ISP: Microsoft Corporation
Usage Type: Data Center/Web Hosting/Transit
ASN: AS8075
Domain Name: microsoft.com
Country: 🇺🇸 United States of America
City: Phoenix, Arizona

ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report Whois

Example preview

Account required for the enhanced features Log in Sign up

Abuse Reports

Export reports CSV

Total reports

759 from 580 distinct reporters

First reported

November 10th 2026

Most recent report

3 minutes ago

Last 60 days

Top reporter locations 🇩🇪 Germany 173 🇺🇸 United States of America 151 🇫🇷 France 91

Most common categories Web App Attack 588 Bad Web Bot 190 Hacking 178 Brute-Force 171 Port Scan 61

Recent reports We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇳🇴 Abuse Buster	2026-11-11 15:57:53 UTC · (3 minutes ago)	20.25.145.66 - [11/Nov/2026:15:12:55 +0100] "GET /wp-content/plugins/hellopress/wp_filemanager.php HTTP/2.0" 404 36 "-" "-" Connecting ip: 20.25.145.66 Forwared for: 20.25.145.66 20.25.145.66 - [11/Nov/2026:15:12:55 +0100] "GET /this_is_a_new_hello_w ... show more 20.25.145.66 - [11/Nov/2026:15:12:55 +0100] "GET /wp-content/plugins/hellopress/wp_filemanager.php HTTP/2.0" 404 36 "-" "-" Connecting ip: 20.25.145.66 Forwared for: 20.25.145.66 20.25.145.66 - [11/Nov/2026:15:12:55 +0100] "GET /this_is_a_new_hello_world.php HTTP/2.0" 404 36 "-" "-" Connecting ip: 20.25.145.66 Forwared for: 20.25.145.66 20.25.145.66 - [11/Nov/2026:15:12:55 +0100] "GET /llw.php HTTP/2.0" 404 36 "-" "-" Connecting ip: 20.25.145.66 Forwared for: 20.25.145.66 ... show less	Web App Attack
🇺🇸 ph	2026-11-11 15:54:47 UTC · (6 minutes ago)	Bad web bot attempting to run wp-content on non-WP site	Hacking Bad Web Bot Web App Attack
🇫🇷 ISPLtd	2026-11-11 15:53:56 UTC · (7 minutes ago)	20.25.145.66 [11/Nov/2026:11:53:49 -0400] regaliachem.com:80 URL:/wp-content/plugins/hellopress/wp_filemanager.php "GET /wp-content/plugins/hellopress/wp_filemanager.php 20.25.145.66 [11/Nov/2026:11:53:56 -0400] regaliachem.com:80 URL:/wp-content/the ... show more 20.25.145.66 [11/Nov/2026:11:53:49 -0400] regaliachem.com:80 URL:/wp-content/plugins/hellopress/wp_filemanager.php "GET /wp-content/plugins/hellopress/wp_filemanager.php 20.25.145.66 [11/Nov/2026:11:53:56 -0400] regaliachem.com:80 URL:/wp-content/themes/reviall.php "GET /wp-content/themes/reviall.php ... show less	Hacking Web App Attack
🇩🇪 reznekcs	2026-11-11 15:48:45 UTC · (12 minutes ago)	F2B apache-noscript ban. Logs: [Wed Nov 11 16:48:44.179403 2026] [proxy_fcgi:error] [pid 152419] [client 20.25.145.66:62109] AH01071: Got error 'Primary script unknown' [Wed Nov 11 16:48:44.335783 2026] [proxy_fcgi:error] [pid 152419] [client 20.25.1 ... show more F2B apache-noscript ban. Logs: [Wed Nov 11 16:48:44.179403 2026] [proxy_fcgi:error] [pid 152419] [client 20.25.145.66:62109] AH01071: Got error 'Primary script unknown' [Wed Nov 11 16:48:44.335783 2026] [proxy_fcgi:error] [pid 152419] [client 20.25.145.66:62109] AH01071: Got error 'Primary script unknown' [Wed Nov 11 16:48:44.484763 2026] [proxy_fcgi:error] [pid 152419] [client 20.25.145.66:62109] AH01071: Got error 'Primary script unknown' show less	Web App Attack
🇫🇷 putputlaw	2026-11-11 15:39:04 UTC · (22 minutes ago)	20.25.145.66 - - [11/Nov/2026:15:39:02 +0000] "GET /wp-content/plugins/hellopress/wp_filemanager.php HTTP/1.1" 301 162 "-" "-" 20.25.145.66 - - [11/Nov/2026:15:39:03 +0000] "GET /wp-content/plugins/hellopress/wp_filemanager.php HTTP/1.1" 404 146 "-" ... show more 20.25.145.66 - - [11/Nov/2026:15:39:02 +0000] "GET /wp-content/plugins/hellopress/wp_filemanager.php HTTP/1.1" 301 162 "-" "-" 20.25.145.66 - - [11/Nov/2026:15:39:03 +0000] "GET /wp-content/plugins/hellopress/wp_filemanager.php HTTP/1.1" 404 146 "-" "-" 20.25.145.66 - - [11/Nov/2026:15:39:03 +0000] "GET /wp-content/plugins/hellopress/wp_filemanager.php HTTP/1.1" 404 146 "-" "-" ... show less	Web App Attack
🇦🇺 FEWA	2026-11-11 15:35:50 UTC · (25 minutes ago)	Fail2Ban Ban Triggered	Hacking Bad Web Bot Web App Attack
🇺🇸 ruusvuu	2026-11-11 15:33:05 UTC · (28 minutes ago)	Automated abuse report: 114 attack/probe requests from Microsoft Corporation / US. Targeted paths: /wp-content/plugins/hellopress/wp_filemanager.php, /this_is_a_new_hello_world.php, /dehnl.php, /motu.php, /tpg-contato.php. Sample log lines: [helpdesk ... show more Automated abuse report: 114 attack/probe requests from Microsoft Corporation / US. Targeted paths: /wp-content/plugins/hellopress/wp_filemanager.php, /this_is_a_new_hello_world.php, /dehnl.php, /motu.php, /tpg-contato.php. Sample log lines: [helpdesk] 11/10/2026 21:13:26 20.25.145.66 GET /wp-content/themes/reviall.php 404 168 1.3 ms [helpdesk] 11/10/2026 21:13:26 20.25.145.66 GET /admin.php/ws.php 404 155 1.4 ms [helpdesk] 11/11/2026 08:33:05 20.25.145.66 GET /this_is_a_new_hello_world.php 404 168 1.5 ms Detected by an automated web-server log monitor. show less	Web App Attack
Anonymous	2026-11-11 15:23:36 UTC · (37 minutes ago)	20.25.145.66 arduino.ua [11/Nov/2026:17:23:36 +0200] "GET /wp-content/plugins/hellopress/wp_filemanager.php HTTP/1.1" 404 27 "-" "-" 0.000 376 ...	Hacking SQL Injection Web App Attack
🇩🇪 hchristo	2026-11-11 15:15:21 UTC · (45 minutes ago)	[Wed Nov 11 16:15:20.386963 2026] [proxy_fcgi:error] [pid 22602:tid 22669] [client 20.25.145.66:37842] AH01071: Got error 'Primary script unknown' [Wed Nov 11 16:15:20.674262 2026] [proxy_fcgi:error] [pid 22602:tid 22680] [client 20.25.145.66:37842] ... show more [Wed Nov 11 16:15:20.386963 2026] [proxy_fcgi:error] [pid 22602:tid 22669] [client 20.25.145.66:37842] AH01071: Got error 'Primary script unknown' [Wed Nov 11 16:15:20.674262 2026] [proxy_fcgi:error] [pid 22602:tid 22680] [client 20.25.145.66:37842] AH01071: Got error 'Primary script unknown' [Wed Nov 11 16:15:20.952497 2026] [proxy_fcgi:error] [pid 22602:tid 22655] [client 20.25.145.66:37842] AH01071: Got error 'Primary script unknown' [Wed Nov 11 16:15:21.232650 2026] [proxy_fcgi:error] [pid 22602:tid 22671] [client 20.25.145.66:37842] AH01071: Got error 'Primary script unknown' [Wed Nov 11 16:15:21.512932 2026] [proxy_fcgi:error] [pid 22602:tid 22679] [client 20.25.145.66:37842] AH01071: Got error 'Primary script unknown' ... show less	Brute-Force
Anonymous	2026-11-11 15:12:20 UTC · (48 minutes ago)	[Wed Nov 11 16:12:19.026759 2026] [proxy_fcgi:error] [pid 1413:tid 1602] [client 20.25.145.66:60757] AH01071: Got error 'Primary script unknown' ...	Brute-Force Web App Attack
Anonymous	2026-11-11 15:12:03 UTC · (49 minutes ago)		Web App Attack
Anonymous	2026-11-11 15:05:31 UTC · (55 minutes ago)	Blocked by fail2ban on a public web server.	Web App Attack
🇳🇱 DrLex0	2026-11-11 15:05:01 UTC · (56 minutes ago)	The eternal WordPress and/or random PHP poking from Azure ranges; at this point I am almost certain Microsoft willingly allows this. 20.25.145.66 80 - [11/Nov/2026:15:05:01 +0000] "GET /wp-content/plugins/hellopress/wp_filemanager.php HTTP/1.1" 404 ... show more The eternal WordPress and/or random PHP poking from Azure ranges; at this point I am almost certain Microsoft willingly allows this. 20.25.145.66 80 - [11/Nov/2026:15:05:01 +0000] "GET /wp-content/plugins/hellopress/wp_filemanager.php HTTP/1.1" 404 480 "-" "-" 20.25.145.66 80 - [11/Nov/2026:15:05:01 +0000] "GET /this_is_a_new_hello_world.php HTTP/1.1" 404 480 "-" "-" show less	Brute-Force Bad Web Bot Web App Attack
Anonymous	2026-11-11 14:45:13 UTC · (1 hour ago)	Observed scanned 98 known-sensitive endpoint(s), e.g.: //CAE-2.5.php, /1010.php, /300_n.php, /3PJcpMFsD8B.php, /ab.php, /admin.php/bhigtouj.php	Bad Web Bot Web App Attack
🇦🇺 electronico	2026-11-11 14:38:44 UTC · (1 hour ago)	20.25.145.66 - - [12/Nov/2026:01:38:40 +1100] "GET /wp-content/plugins/hellopress/wp_filemanager.php HTTP/1.1" 404 7385 "-" "-" 20.25.145.66 - - [12/Nov/2026:01:38:41 +1100] "GET /this_is_a_new_hello_world.php HTTP/1.1" 404 252 "-" "-" 20.25.145.66 - ... show more 20.25.145.66 - - [12/Nov/2026:01:38:40 +1100] "GET /wp-content/plugins/hellopress/wp_filemanager.php HTTP/1.1" 404 7385 "-" "-" 20.25.145.66 - - [12/Nov/2026:01:38:41 +1100] "GET /this_is_a_new_hello_world.php HTTP/1.1" 404 252 "-" "-" 20.25.145.66 - - [12/Nov/2026:01:38:41 +1100] "GET /llw.php HTTP/1.1" 404 252 "-" "-" 20.25.145.66 - - [12/Nov/2026:01:38:41 +1100] "GET /300_n.php HTTP/1.1" 404 252 "-" "-" 20.25.145.66 - - [12/Nov/2026:01:38:42 +1100] "GET /sm.php HTTP/1.1" 404 252 "-" "-" 20.25.145.66 - - [12/Nov/2026:01:38:42 +1100] "GET /motu.php HTTP/1.1" 404 252 "-" "-" 20.25.145.66 - - [12/Nov/2026:01:38:42 +1100] "GET /wp_.php HTTP/1.1" 404 252 "-" "-" 20.25.145.66 - - [12/Nov/2026:01:38:42 +1100] "GET /1010.php HTTP/1.1" 404 252 "-" "-" 20.25.145.66 - - [12/Nov/2026:01:38:43 +1100] "GET /tpg-contato.php HTTP/1.1" 404 252 "-" "-" 20.25.145.66 - - [12/Nov/2026:01:38:43 +1100] "GET /wp-ainefgskk.php HTTP/1.1" 404 252 "-" "-" ... show less	Brute-Force Web App Attack

Showing 1 to 15 of 759 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown

Recently Reported IPs:

🇺🇸 195.184.76.113

🇯🇵 139.162.116.160

🇺🇸 128.9.29.131

🇨🇦 68.183.204.0

🇮🇷 37.32.14.11

🇮🇳 20.197.11.4

🇹🇼 1.169.4.121

🇬🇧 195.96.139.185

🇬🇧 193.163.125.131

🇺🇸 139.144.239.98

🇺🇸 129.158.206.162

🇷🇺 109.124.94.146

🇩🇪 102.220.162.137

🇦🇺 101.168.3.207

🇺🇸 74.125.82.194

🇸🇬 20.195.13.95

🇭🇰 20.189.119.158

🇺🇸 20.172.147.63

🇬🇧 195.96.139.183

🇬🇧 185.152.39.213