JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

20.53.239.152

Recent Activity

Abuse Confidence Score

100% Critical

881 reports

321 reporters · latest 7 hours ago

ISP: Microsoft Corporation
Usage Type: Data Center/Web Hosting/Transit
ASN: AS8075
Domain Name: microsoft.com
Country: 🇦🇺 Australia
City: Sydney, New South Wales

ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report Whois

Example preview

Account required for the enhanced features Log in Sign up

Abuse Reports

Export reports CSV

Total reports

881 from 321 distinct reporters

First reported

October 19th 2026

Most recent report

7 hours ago

Last 60 days

Top reporter locations 🇩🇪 Germany 207 🇺🇸 United States of America 169 🇫🇷 France 97

Most common categories Web App Attack 735 Bad Web Bot 235 Brute-Force 187 Hacking 164 Port Scan 67

Recent reports We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
Anonymous	2026-10-28 09:19:08 (7 hours ago)	FortiWeb WAF: 40 attacks detected. Threat Score: 54200. Types: Client Management(20), Block IP List(20). Origin: Australia.	Web App Attack
🇧🇷 Peregrine	2026-10-28 03:10:58 (14 hours ago)	Fail2Ban Jail s2: tomcat-honeypot \| Evidence: 20.53.239.152 104.22.127.100 - - [22/Oct/2026:12:36:41 -0300] "GET /inputs.php HTTP/1.1" 404 414 20.53.239.152 104.22.127.100 - - [22/Oct/2026:12:36:41 -0300] "GET /ioxi-o.php HTTP/1.1" 404 414 20.53.239. ... show more Fail2Ban Jail s2: tomcat-honeypot \| Evidence: 20.53.239.152 104.22.127.100 - - [22/Oct/2026:12:36:41 -0300] "GET /inputs.php HTTP/1.1" 404 414 20.53.239.152 104.22.127.100 - - [22/Oct/2026:12:36:41 -0300] "GET /ioxi-o.php HTTP/1.1" 404 414 20.53.239.152 104.22.127.100 - - [22/Oct/2026:12:36:41 -0300] "GET /function/function.php HTTP/1.1" 404 414 20.53.239.152 104.22.127.100 - - [22/Oct/2026:12:36:42 -0300] "GET /rip.php HTTP/1.1" 404 414 20.53.239.152 104.22.127.100 - - [22/Oct/2026:12:36:42 -0300] "GET /admin.php HTTP/1.1" 404 414 20.53.239.152 104.22.127.100 - - [22/Oct/2026:12:36:42 -0300] "GET /wp-content/uploads/index.php HTTP/1.1" 404 414 20.53.239.152 104.22.127.100 - - [22/Oct/2026:12:36:43 -0300] "GET /cache.php HTTP/1.1" 404 414 20.53.239.152 104.22.127.100 - - [22/Oct/2026:12:36:43 -0300] "GET /themes.php HTTP/1.1" 404 414 20.53.239.152 104.22.127.100 - - [22/Oct/2026:12:36:44 -0300] "GET /an.php HTTP/1.1" 404 414 show less	Bad Web Bot
🇨🇱 Fernando Soto	2026-10-28 03:05:06 (14 hours ago)	WAF propio vps1 (CL): 404x28,sensx2 score 10 en 1h. sondeo rutas sensibles, barrido 404.	Port Scan Web App Attack
🇪🇸 librebit	2026-10-28 03:00:45 (14 hours ago)	Brute force	Brute-Force
🇳🇱 BlueWire Hosting	2026-10-27 17:03:37 (1 day ago)	Aggressive scanning resulting into 404	Bad Web Bot
🇻🇮 Axel	2026-10-27 16:56:46 (1 day ago)	WAF/ModSecurity blocked 4 malicious request(s) (HTTP 403) from this IP. Activity: request_uri: read wordpress configuration file x1; request_uri: hidden .php execute x1; request_uri: Wordpress - prevent PHP files from executing x1; Wordpress - Protec ... show more WAF/ModSecurity blocked 4 malicious request(s) (HTTP 403) from this IP. Activity: request_uri: read wordpress configuration file x1; request_uri: hidden .php execute x1; request_uri: Wordpress - prevent PHP files from executing x1; Wordpress - Protect uploads diretory listing files x1. Latest: 2026-10-27T16:56:46Z. show less	Hacking Web App Attack
🇩🇪 h7ex	2026-10-27 16:18:31 (1 day ago)	Attempted execution of scripts via Apache (noscripts) (Jail: apache-noscript)	Hacking Exploited Host
Anonymous	2026-10-27 15:47:37 (1 day ago)	20.53.239.152 - - [27/Oct/2026:17:47:33 +0200] "GET /wp-content/uploads/ HTTP/1.1" 404 185 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.53.239.152 - - [27/Oct/2026:17:47:33 + ... show more 20.53.239.152 - - [27/Oct/2026:17:47:33 +0200] "GET /wp-content/uploads/ HTTP/1.1" 404 185 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.53.239.152 - - [27/Oct/2026:17:47:33 +0200] "GET /wp-content/themes/admin.php HTTP/1.1" 404 185 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.53.239.152 - - [27/Oct/2026:17:47:33 +0200] "GET /wp-content/themes/index.php HTTP/1.1" 404 185 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.53.239.152 - - [27/Oct/2026:17:47:33 +0200] "GET /wp-content/plugins/index.php HTTP/1.1" 404 185 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.53.239.152 - - [27/Oct/2026:17:47:33 +0200] "GET /wp-includes/PHPMailer/ HTTP/1.1" 404 185 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64 ... show less	Bad Web Bot Web App Attack
🇮🇹 Inartis	2026-10-27 15:18:14 (1 day ago)	20.53.239.152 - - [27/Oct/2026:16:18:13 +0100] "GET /222.php HTTP/1.1" 200 51415 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" ...	Brute-Force Bad Web Bot Web App Attack
🇳🇱 e.fierstra	2026-10-27 15:12:29 (1 day ago)	excessive HTTP 404 errors	Bad Web Bot
🇸🇬 Cloudkul Cloudkul	2026-10-27 15:07:43 (1 day ago)	Attempted Not Found (404 status code) requests on our application, more than 30% of their total requests.	Brute-Force Web App Attack
🇩🇰 donkzquixote	2026-10-27 15:06:55 (1 day ago)	Scan for exploitable WordPress files/information, or other brute force attempts.	Web App Attack Brute-Force
🇫🇷 regishoussin	2026-10-27 15:04:22 (1 day ago)	Automated web scanning detected by Wazuh (rule 100180): repeated 400/404 errors from mass probing of admin/backdoor paths (e.g. wp-login.php, known CMS shell filenames) on an Apache web server, on 2026-10-27 15:04 UTC.	Bad Web Bot Web App Attack
🇩🇪 Jarda_H	2026-10-27 15:03:40 (1 day ago)	http-probing	Web App Attack
🇫🇷 Baking333	2026-10-27 14:44:34 (1 day ago)	[redacted] 20.53.239.152 - - [27/Oct/2026:15:44:32 +0100] "GET /wp-content/uploads/ HTTP/1.1" 301 635 0/308 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 443 [redacted] 20.53.239 ... show more [redacted] 20.53.239.152 - - [27/Oct/2026:15:44:32 +0100] "GET /wp-content/uploads/ HTTP/1.1" 301 635 0/308 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 443 [redacted] 20.53.239.152 - - [27/Oct/2026:15:44:33 +0100] "GET /wp-content/themes/[redacted] HTTP/1.1" 302 1559 0/47037 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 443 show less	Bad Web Bot Web App Attack

Showing 1 to 15 of 881 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown

Recently Reported IPs:

🇺🇸 212.87.216.220

🇨🇴 190.60.55.86

🇩🇪 109.160.32.166

🇩🇪 213.209.159.226

🇰🇪 197.248.8.33

🇹🇳 197.238.180.227

🇰🇷 183.96.163.213

🇨🇭 179.43.153.2

🇺🇸 152.163.101.43

🇹🇼 152.32.229.251

🇸🇬 150.109.10.219

🇨🇳 121.15.140.235

🇺🇸 45.206.81.201

🇺🇸 45.61.188.238

🇺🇸 34.125.60.145

🇸🇪 13.50.234.55

🇬🇪 2.57.217.229

🇷🇴 2.57.121.112

🇻🇪 201.243.45.116

🇫🇷 193.151.191.60