JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

20.63.209.8

Neutral Activity

Abuse Confidence Score

0% Low Risk

68 reports

57 reporters · latest 3 months ago

ISP: Microsoft Corporation
Usage Type: Data Center/Web Hosting/Transit
ASN: AS8075
Domain Name: microsoft.com
Country: 🇯🇵 Japan
City: Osaka, Osaka

ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report Whois

No reports in the last 60 days

20.63.209.8 has been reported 68 times. The most recent report is from 3 months ago.

The full history is preserved below and remains searchable. A 0% score reflects the absence of recent activity, but this is not a guarantee that earlier reports were invalid. Abuse confidence score decays, naturally, over time, when the abusive activity stops.

Abuse Reports

Export reports CSV

Total reports

68 from 57 distinct reporters

First reported

May 20th 2026

Most recent report

3 months ago

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇮🇳 evicky2002	2026-07-30 03:36:26 UTC · (3 months ago)	Confirmed malicious by STILWaters CTI platform (score=100, sources=1)	Hacking Brute-Force SSH
🇮🇳 evicky2002	2026-07-28 06:00:14 UTC · (3 months ago)	Confirmed malicious by STILWaters CTI platform (score=100, sources=1)	Hacking Brute-Force SSH
🇳🇱 Site.eu	2026-05-23 16:35:42 UTC · (5 months ago)	Excessive multi-domain requests	Brute-Force
Anonymous	2026-05-22 06:02:27 UTC · (5 months ago)	Blocked by FortiWeb WAF ML threat detection. ML probability: 99%, Country: JP, Attack patterns: WordPress scanning, Webshell probing	Bad Web Bot Web App Attack
🇬🇧 openstrike.co.uk	2026-05-22 05:13:10 UTC · (5 months ago)	182 attacks on PHP URLs: GET /php.php HTTP/1.1	Web App Attack
🇺🇸 octageeks.com	2026-05-22 04:06:12 UTC · (5 months ago)	Wordpress malicious attack:[octablocked]	Web App Attack
🇺🇸 mnsf	2026-05-21 22:05:26 UTC · (5 months ago)	Too many Status 40X (23)	Brute-Force Web App Attack
Anonymous	2026-05-21 09:40:15 UTC · (5 months ago)	Attempted access to sensitive endpoint (/wp-content/admin.php) detected. Automated scan or unauthorized probing.	Web App Attack
🇫🇮 Christopher Hughes	2026-05-21 08:10:12 UTC · (5 months ago)	[Thu May 21 09:10:10.273325 2026] [proxy_fcgi:error] [pid 262049:tid 139775042401856] [client 20.63.209.8:5616] AH01071: Got error 'Primary script unknown' [Thu May 21 09:10:10.555027 2026] [proxy_fcgi:error] [pid 262049:tid 139773654062656] [client ... show more [Thu May 21 09:10:10.273325 2026] [proxy_fcgi:error] [pid 262049:tid 139775042401856] [client 20.63.209.8:5616] AH01071: Got error 'Primary script unknown' [Thu May 21 09:10:10.555027 2026] [proxy_fcgi:error] [pid 262049:tid 139773654062656] [client 20.63.209.8:5616] AH01071: Got error 'Primary script unknown' [Thu May 21 09:10:10.833396 2026] [proxy_fcgi:error] [pid 262049:tid 139774190933568] [client 20.63.209.8:5616] AH01071: Got error 'Primary script unknown' [Thu May 21 09:10:11.119946 2026] [proxy_fcgi:error] [pid 262049:tid 139775034009152] [client 20.63.209.8:5616] AH01071: Got error 'Primary script unknown' [Thu May 21 09:10:11.398464 2026] [proxy_fcgi:error] [pid 262049:tid 139774207718976] [client 20.63.209.8:5616] AH01071: Got error 'Primary script unknown' ... show less	Web App Attack
🇬🇧 thetomtaylor.co.uk	2026-05-21 08:08:01 UTC · (5 months ago)	Fail2Ban - [RECIDIVE]Repeat offender across multiple jails on recidive ... [ice01,ice02]	Brute-Force Bad Web Bot Exploited Host Web App Attack
🇺🇸 chronos	2026-05-21 08:06:16 UTC · (5 months ago)	[AUTORAVALT][[21/05/2026 - 05:06:16 -03:00 UTC] Attack from [Microsoft Corporation] [20.63.209.8] Action: BLocKed Hacking... Unauthorized attempts to access the server. Web App Attack -> Attempts to probe for or exploit installed web applications su ... show more [AUTORAVALT][[21/05/2026 - 05:06:16 -03:00 UTC] Attack from [Microsoft Corporation] [20.63.209.8] Action: BLocKed Hacking... Unauthorized attempts to access the server. Web App Attack -> Attempts to probe for or exploit installed web applications such as a CMS like WordPress/Drupal, e-commerce solutions, forum software, phpMyAdmin and various other software pl] ... show less	Hacking Web App Attack
🇨🇱 Denis Chavez	2026-05-21 07:53:18 UTC · (5 months ago)	Fail2Ban detected malicious activity on Nginx	Brute-Force SSH Web App Attack
🇬🇧 thetomtaylor.co.uk	2026-05-21 07:07:02 UTC · (5 months ago)	Fail2Ban - [NGINX]Malicious request blocked on nginx-444 ... [ice01,ice02,wa01,wa02]	Hacking Bad Web Bot
🇵🇱 webadmin	2026-05-21 06:33:33 UTC · (5 months ago)	20.63.209.8 - - [21/May/2026:08:33:13 +0200] "GET /wp-admin/ HTTP/1.1" 400 25 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.63.209.8 - - [21/May/2026:08:33:25 +0200] "GET /wp- ... show more 20.63.209.8 - - [21/May/2026:08:33:13 +0200] "GET /wp-admin/ HTTP/1.1" 400 25 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.63.209.8 - - [21/May/2026:08:33:25 +0200] "GET /wp-includes/fonts/ HTTP/1.1" 400 25 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.63.209.8 - - [21/May/2026:08:33:26 +0200] "GET /wp-content/uploads/ HTTP/1.1" 400 25 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.63.209.8 - - [21/May/2026:08:33:28 +0200] "GET /wp-admin/js/ HTTP/1.1" 400 25 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.63.209.8 - - [21/May/2026:08:33:33 +0200] "GET /wp-admin/css/colors/ectoplasm/ HTTP/1.1" 400 25 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" show less	Web App Attack
Anonymous	2026-05-21 06:16:18 UTC · (5 months ago)	20.63.209.8 - - [21/May/2026:08:15:54 +0200] "GET /inputs.php HTTP/1.1" 404 4886 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.63.209.8 - - [21/May/2026:08:15:55 +0200] "GET / ... show more 20.63.209.8 - - [21/May/2026:08:15:54 +0200] "GET /inputs.php HTTP/1.1" 404 4886 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.63.209.8 - - [21/May/2026:08:15:55 +0200] "GET /admin.php HTTP/1.1" 404 360 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.63.209.8 - - [21/May/2026:08:15:55 +0200] "GET /goods.php HTTP/1.1" 404 360 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.63.209.8 - - [21/May/2026:08:15:55 +0200] "GET /file.php HTTP/1.1" 404 360 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.63.209.8 - - [21/May/2026:08:15:55 +0200] "GET /adminfuns.php HTTP/1.1" 404 360 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.63.209. ... show less	DDoS Attack

Showing 1 to 15 of 68 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown

Recently Reported IPs:

🇺🇸 192.3.159.187

🇬🇧 185.206.227.180

🇳🇱 157.245.69.67

🇨🇳 150.158.57.26

🇺🇸 130.131.18.23

🇺🇸 96.18.236.243

🇺🇸 65.49.1.198

🇨🇳 49.7.134.232

🇸🇦 46.152.1.141

🇧🇷 45.4.213.109

🇹🇳 41.227.190.189

🇺🇸 20.65.179.77

🇫🇷 5.39.57.91

🇳🇱 193.47.62.111

🇧🇴 190.181.22.164

🇧🇩 103.133.5.79

🇨🇦 85.217.149.44

🇺🇸 74.0.232.6

🇺🇸 64.62.197.91

🇺🇸 64.62.197.17