JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 20.63.64.130

20.63.64.130 was found in our database!

This IP was reported 672 times. Confidence of Abuse is 100%: ?

100%

ISP	Microsoft Corporation
Usage Type	Data Center/Web Hosting/Transit
ASN	AS8075
Domain Name	microsoft.com
Country	🇨🇦 Canada
City	Toronto, Ontario

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 20.63.64.130

Whois 20.63.64.130

IP Abuse Reports for 20.63.64.130:

This IP address has been reported a total of 672 times from 487 distinct sources. 20.63.64.130 was first reported on August 21st 2026, and the most recent report was 1 minute ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇫🇷 Kraften	2026-08-22 20:01:52 (1 minute ago)	Trying script web attack ...	Web App Attack
🇮🇩 sockominfo	2026-08-22 20:00:28 (2 minutes ago)	Reported by TangerangKota-CSIRT. Status: MALICIOUS	Hacking Email Spam
🇫🇷 Campus France	2026-08-22 19:59:57 (3 minutes ago)	[Sat Aug 22 21:59:56.387424 2026] [php:error] [pid 398689] [client 20.63.64.130:44532] script '/var/ ... show more [Sat Aug 22 21:59:56.387424 2026] [php:error] [pid 398689] [client 20.63.64.130:44532] script '/var/www/html/desk.radio-campus.org/desk/www/this_is_a_new_hello_world.php' not found or unable to stat [Sat Aug 22 21:59:56.514246 2026] [php:error] [pid 398689] [client 20.63.64.130:44532] script '/var/www/html/desk.radio-campus.org/desk/www/v2.php' not found or unable to stat [Sat Aug 22 21:59:56.514246 2026] [php:error] [pid 398689] [client 20.63.64.130:44532] script '/var/www/html/desk.radio-campus.org/desk/www/v2.php' not found or unable to stat ... show less	Brute-Force Web App Attack
🇺🇸 chrisj	2026-08-22 19:54:32 (8 minutes ago)	[Sat Aug 22 19:54:32.007832 2026] [proxy_fcgi:error] [pid 1286687:tid 1286741] [client 20.63.64.130: ... show more [Sat Aug 22 19:54:32.007832 2026] [proxy_fcgi:error] [pid 1286687:tid 1286741] [client 20.63.64.130:44037] AH01071: Got error 'Primary script unknown' [Sat Aug 22 19:54:32.134255 2026] [proxy_fcgi:error] [pid 1286687:tid 1286757] [client 20.63.64.130:44037] AH01071: Got error 'Primary script unknown' [Sat Aug 22 19:54:32.197234 2026] [proxy_fcgi:error] [pid 1286687:tid 1286748] [client 20.63.64.130:44037] AH01071: Got error 'Primary script unknown' ... show less	Brute-Force
Anonymous	2026-08-22 19:54:11 (8 minutes ago)	Repeated unauthorized connection attempts to restricted service observed.	Port Scan Hacking Bad Web Bot Web App Attack
Anonymous	2026-08-22 19:52:43 (10 minutes ago)	Web App Attack	Brute-Force Web App Attack
🇨🇿 plzenskypruvodce.cz	2026-08-22 19:50:18 (12 minutes ago)	[Sat Aug 22 21:50:09.144448 2026] [authz_core:error] [pid 1737:tid 1836] [client 20.63.64.130:50622] ... show more [Sat Aug 22 21:50:09.144448 2026] [authz_core:error] [pid 1737:tid 1836] [client 20.63.64.130:50622] AH01630: client denied by server configuration: /var/www/baletniskola-ok.cz/www/wp-content/min.php [Sat Aug 22 21:50:17.944059 2026] [authz_core:error] [pid 1737:tid 1855] [client 20.63.64.130:48004] AH01630: client denied by server configuration: /var/www/baletniskola-ok.cz/www/wp-content/index.php ... show less	Web App Attack
🇺🇸 Operator873	2026-08-22 19:48:10 (14 minutes ago)	2026/08/22 14:48:07 [error] 622221#0: 2983314 access forbidden by rule, client: 20.63.64.130, serve ... show more 2026/08/22 14:48:07 [error] 622221#0: 2983314 access forbidden by rule, client: 20.63.64.130, server: [OBFUSCATED], request: "GET /wp-content/plugins/hellopress/wp_filemanager.php HTTP/1.1", host: "[OBFUSCATED]" 2026/08/22 14:48:07 [error] 622221#0: 2983314 access forbidden by rule, client: 20.63.64.130, server: [OBFUSCATED], request: "GET /wp-content/plugins/hellopress/wp_filemanager.php HTTP/1.1", host: "[OBFUSCATED]" 2026/08/22 14:48:07 [error] 622221#0: 2983314 access forbidden by rule, client: 20.63.64.130, server: [OBFUSCATED], request: "GET /this_is_a_new_hello_world.php HTTP/1.1", host: "[OBFUSCATED]" 2026/08/22 14:48:07 [error] 622221#0: 2983314 access forbidden by rule, client: 20.63.64.130, server: [OBFUSCATED], request: "GET /this_is_a_new_hello_world.php HTTP/1.1", host: "[OBFUSCATED]" 2026/08/22 14:48:07 [error] 622221#0: 2983314 access forbidden by rule, client: 20.63.64.130, server: [OBFUSCATED], request: "GET /v2.php HTTP/1.1", host: ... show less	Brute-Force Web App Attack
Anonymous	2026-08-22 19:46:23 (16 minutes ago)	Detected by CrowdSec: crowdsecurity/http-probing	Web App Attack
🇳🇱 thedreamer.nl	2026-08-22 19:46:20 (16 minutes ago)	20.63.64.130 - - [22/Aug/2026:21:45:01 +0200] "GET /wp-content/plugins/hellopress/wp_filemanager.php ... show more 20.63.64.130 - - [22/Aug/2026:21:45:01 +0200] "GET /wp-content/plugins/hellopress/wp_filemanager.php HTTP/1.1" 301 162 "-" "-" "CA" "Toronto" "43.70900" "-79.40570" 20.63.64.130 - - [22/Aug/2026:21:45:01 +0200] "GET /wp-content/plugins/hellopress/wp_filemanager.php HTTP/1.1" 499 0 "-" "-" "CA" "Toronto" "43.70900" "-79.40570" 20.63.64.130 - - [22/Aug/2026:21:45:01 +0200] "GET /wp-content/plugins/hellopress/wp_filemanager.php HTTP/1.1" 499 0 "-" "-" "CA" "Toronto" "43.70900" "-79.40570" ... show less	Hacking Brute-Force Bad Web Bot Web App Attack
Anonymous	2026-08-22 19:37:30 (25 minutes ago)	20.63.64.130 - - [22/Aug/2026:19:37:15 +0000] "GET /wp-content/plugins/hellopress/wp_filemanager.php ... show more 20.63.64.130 - - [22/Aug/2026:19:37:15 +0000] "GET /wp-content/plugins/hellopress/wp_filemanager.php HTTP/1.1" 302 630 "-" "-" 20.63.64.130 - - [22/Aug/2026:19:37:15 +0000] "GET /wp-content/plugins/hellopress/wp_filemanager.php HTTP/1.1" 404 31699 "-" "-" 20.63.64.130 - - [22/Aug/2026:19:37:17 +0000] "GET /wp-content/min.php HTTP/1.1" 302 570 "-" "-" 20.63.64.130 - - [22/Aug/2026:19:37:17 +0000] "GET /wp-content/min.php HTTP/1.1" 404 26903 "-" "-" 20.63.64.130 - - [22/Aug/2026:19:37:29 +0000] "G ... show less	Web App Attack
🇨🇿 ddw	2026-08-22 19:36:47 (26 minutes ago)	Access Violation Attempts - Multiple 403 Forbidden responses.	Hacking Bad Web Bot Web App Attack
🇩🇪 Stefan Dreher	2026-08-22 19:35:26 (27 minutes ago)	20.63.64.130 - - [22/Aug/2026:21:33:24 +0200] "GET /wp-content/plugins/hellopress/wp_filemanager.php ... show more 20.63.64.130 - - [22/Aug/2026:21:33:24 +0200] "GET /wp-content/plugins/hellopress/wp_filemanager.php HTTP/1.1" 404 153 "-" "-" 20.63.64.130 - - [22/Aug/2026:21:33:24 +0200] "GET /this_is_a_new_hello_world.php HTTP/1.1" 404 153 "-" "-" 20.63.64.130 - - [22/Aug/2026:21:33:24 +0200] "GET /v2.php HTTP/1.1" 404 153 "-" "-" 20.63.64.130 - - [22/Aug/2026:21:33:25 +0200] "GET /pfm.php HTTP/1.1" 404 153 "-" "-" 20.63.64.130 - - [22/Aug/2026:21:33:25 +0200] "GET /xty.php?p= HTTP/1.1" 404 153 "-" "-" ... show less	Hacking Brute-Force
🇬🇷 setupgr	2026-08-22 19:35:25 (27 minutes ago)	(mod_security) mod_security (id:1000001) triggered by 20.63.64.130 (CA/Canada/Ontario/Toronto/-/[AS8 ... show more (mod_security) mod_security (id:1000001) triggered by 20.63.64.130 (CA/Canada/Ontario/Toronto/-/[AS8075 MICROSOFT-CORP-MSN-AS-BLOCK]): 1 in the last 86400 secs (CF_ENABLE); Ports: *; Direction: inout; Trigger: LF_MODSEC; Logs: [Sat Aug 22 22:35:21.865395 2026] [security2:error] [pid 713441:tid 713612] [client 20.63.64.130:54055] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/wp-content/plugins/hellopress/wp_filemanager.php" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec/modsec2.user.conf"] [line "103"] [id "1000001"] [msg "Bad file blocked: /wp-content/plugins/hellopress/wp_filemanager.php"] [severity "CRITICAL"] [tag "security"] [hostname "mail.setworldup365.com"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "aon5-cI_VnjvIOUAnP1AMgAAA84"] show less	Port Scan
🇺🇸 chrisj	2026-08-22 19:34:25 (28 minutes ago)	[Sat Aug 22 19:34:24.471032 2026] [proxy_fcgi:error] [pid 1286687:tid 1286738] [client 20.63.64.130: ... show more [Sat Aug 22 19:34:24.471032 2026] [proxy_fcgi:error] [pid 1286687:tid 1286738] [client 20.63.64.130:44116] AH01071: Got error 'Primary script unknown' [Sat Aug 22 19:34:24.530323 2026] [proxy_fcgi:error] [pid 1286687:tid 1286745] [client 20.63.64.130:44116] AH01071: Got error 'Primary script unknown' [Sat Aug 22 19:34:24.590320 2026] [proxy_fcgi:error] [pid 1286687:tid 1286757] [client 20.63.64.130:44116] AH01071: Got error 'Primary script unknown' ... show less	Brute-Force

Showing 1 to 15 of 672 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇭🇰 104.208.99.163

🇮🇳 103.77.14.62

🇫🇷 85.217.140.48

🇷🇴 2.57.122.150

🇹🇼 198.235.24.104

🇹🇼 198.235.24.102

🇺🇸 181.214.83.95

🇦🇷 181.9.209.183

🇺🇸 167.172.203.111

🇨🇦 20.104.50.220

🇹🇼 198.235.24.101

🇧🇦 195.222.59.154

🇭🇰 193.176.211.61

🇳🇱 178.62.216.118

🇺🇸 172.253.1.27

🇬🇧 172.71.241.19

🇧🇪 109.128.179.196

🇮🇳 49.207.195.254

🇫🇮 45.154.244.193

🇨🇳 39.74.209.209