JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 20.63.98.115

20.63.98.115 was found in our database!

This IP was reported 156 times. Confidence of Abuse is 100%: ?

100%

ISP	Microsoft Corporation
Usage Type	Data Center/Web Hosting/Transit
ASN	AS8075
Domain Name	microsoft.com
Country	🇨🇦 Canada
City	Toronto, Ontario

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 20.63.98.115

Whois 20.63.98.115

IP Abuse Reports for 20.63.98.115:

This IP address has been reported a total of 156 times from 133 distinct sources. 20.63.98.115 was first reported on July 29th 2026, and the most recent report was 1 minute ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇳🇴 Abuse Buster	2026-07-29 18:01:27 (1 minute ago)	20.63.98.115 - [29/Jul/2026:20:01:25 +0200] "GET /inputs.php HTTP/2.0" 404 36 "-" "Mozilla/5.0 (Wind ... show more 20.63.98.115 - [29/Jul/2026:20:01:25 +0200] "GET /inputs.php HTTP/2.0" 404 36 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" Connecting ip: 20.63.98.115 Forwared for: 20.63.98.115 20.63.98.115 - [29/Jul/2026:20:01:26 +0200] "GET /admin.php HTTP/2.0" 404 36 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" Connecting ip: 20.63.98.115 Forwared for: 20.63.98.115 20.63.98.115 - [29/Jul/2026:20:01:26 +0200] "GET /goods.php HTTP/2.0" 404 36 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" Connecting ip: 20.63.98.115 Forwared for: 20.63.98.115 ... show less	Web App Attack
🇫🇮 Christopher Hughes	2026-07-29 18:00:41 (2 minutes ago)	[Wed Jul 29 19:00:40.418684 2026] [proxy_fcgi:error] [pid 2346450:tid 139825965405760] [client 20.63 ... show more [Wed Jul 29 19:00:40.418684 2026] [proxy_fcgi:error] [pid 2346450:tid 139825965405760] [client 20.63.98.115:33865] AH01071: Got error 'Primary script unknown' [Wed Jul 29 19:00:40.542623 2026] [proxy_fcgi:error] [pid 2346450:tid 139826544240192] [client 20.63.98.115:33865] AH01071: Got error 'Primary script unknown' [Wed Jul 29 19:00:40.665642 2026] [proxy_fcgi:error] [pid 2346450:tid 139826502276672] [client 20.63.98.115:33865] AH01071: Got error 'Primary script unknown' [Wed Jul 29 19:00:40.780514 2026] [proxy_fcgi:error] [pid 2346450:tid 139825973798464] [client 20.63.98.115:33865] AH01071: Got error 'Primary script unknown' [Wed Jul 29 19:00:40.933583 2026] [proxy_fcgi:error] [pid 2346450:tid 139826519062080] [client 20.63.98.115:33865] AH01071: Got error 'Primary script unknown' ... show less	Web App Attack
🇬🇷 setupgr	2026-07-29 17:55:34 (7 minutes ago)	(mod_security) mod_security (id:1000001) triggered by 20.63.98.115 (CA/Canada/Ontario/Toronto/-/[AS8 ... show more (mod_security) mod_security (id:1000001) triggered by 20.63.98.115 (CA/Canada/Ontario/Toronto/-/[AS8075 MICROSOFT-CORP-MSN-AS-BLOCK]): 1 in the last 86400 secs (CF_ENABLE); Ports: *; Direction: inout; Trigger: LF_MODSEC; Logs: [Wed Jul 29 20:55:32.532394 2026] [security2:error] [pid 1406864:tid 1406996] [client 20.63.98.115:27357] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/about.php" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec/modsec2.user.conf"] [line "103"] [id "1000001"] [msg "Bad file blocked: /about.php"] [severity "CRITICAL"] [tag "security"] [hostname "pankoskal.gr"] [uri "/about.php"] [unique_id "amo-lC3xGv1f3EjfUWPpqgAABMc"] show less	Port Scan
🇪🇸 netfactotum	2026-07-29 17:52:05 (11 minutes ago)		Hacking Web App Attack
🇺🇸 valornode	2026-07-29 17:50:45 (12 minutes ago)	Detected by CrowdSec on www.iambrayden.net-47d88224: CrowdSec: crowdsecurity/http-crawl-non_statics ... show more Detected by CrowdSec on www.iambrayden.net-47d88224: CrowdSec: crowdsecurity/http-crawl-non_statics \| ASN: 8075 (MICROSOFT-CORP-MSN-AS-BLOCK) \| Country: CA \| Range: 20.48.0.0/12 show less	Brute-Force SSH
🇩🇪 hidemail.app	2026-07-29 17:47:11 (16 minutes ago)	Automated scan for exposed config/secret files and known web exploits (e.g. /.env, RCE probes); auto ... show more Automated scan for exposed config/secret files and known web exploits (e.g. /.env, RCE probes); auto-banned by fail2ban. show less	Web App Attack Hacking
🇺🇸 paulo.apoloni	2026-07-29 17:43:48 (19 minutes ago)	20.63.98.115 - - [29/Jul/2026:14:17:16 -0300] "GET /wp-admin/ HTTP/1.1" 444 0 "-" "Mozilla/5.0 (Wind ... show more 20.63.98.115 - - [29/Jul/2026:14:17:16 -0300] "GET /wp-admin/ HTTP/1.1" 444 0 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.63.98.115 - - [29/Jul/2026:14:17:16 -0300] "GET /wp-admin/ HTTP/1.1" 444 0 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.63.98.115 - - [29/Jul/2026:14:17:16 -0300] "GET /wp-admin/ HTTP/1.1" 444 0 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.63.98.115 - - [29/Jul/2026:14:17:16 -0300] "GET /wp-admin/ HTTP/1.1" 444 0 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.63.98.115 - - [29/Jul/2026:14:43:48 -0300] "GET /wp-admin/ HTTP/1.1" 444 0 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" ... show less	Bad Web Bot Web App Attack
Anonymous	2026-07-29 17:36:54 (26 minutes ago)	Automated report (2026-07-30T01:36:54+08:00). Caught probing for webshells/backdoors. Host might be ... show more Automated report (2026-07-30T01:36:54+08:00). Caught probing for webshells/backdoors. Host might be compromised. show less	Hacking Exploited Host Web App Attack Open Proxy
🇺🇸 Epimetheus	2026-07-29 17:26:51 (36 minutes ago)	Unauthorized access attempts: [GET] /wp-admin/css/colors/ectoplasm/ [GET] /randkeyword.PhP7 [GET] / ... show more Unauthorized access attempts: [GET] /wp-admin/css/colors/ectoplasm/ [GET] /randkeyword.PhP7 [GET] /vx.php [GET] /wp-admin/js/index.php [GET] /bgymj.php [GET] /chosen.php [GET] /.well-known/ UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 show less	Web App Attack
🇭🇳 unph	2026-07-29 17:24:37 (38 minutes ago)	Intento de acceso sospechoso bloqueado por AbuseIPDB Blocker Plugin	Brute-Force
🇩🇪 thesimonmanuel	2026-07-29 17:24:26 (38 minutes ago)	20.63.98.115 - - [29/Jul/2026:22:54:25 +0530] "GET /info.php HTTP/1.1" 403 141 "-" "Mozilla/5.0 (Win ... show more 20.63.98.115 - - [29/Jul/2026:22:54:25 +0530] "GET /info.php HTTP/1.1" 403 141 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" "20.63.98.115" show less	Web App Attack
🇺🇸 deskpass.com	2026-07-29 17:22:40 (40 minutes ago)	GET /php.php	Web App Attack
🇫🇷 Lunix	2026-07-29 17:21:07 (42 minutes ago)		Brute-Force Web App Attack
🇩🇪 todix	2026-07-29 17:20:09 (43 minutes ago)	Web App Attack Exploid from 20.63.98.115	Web App Attack
🇬🇧 Smish	2026-07-29 17:17:08 (46 minutes ago)	HONEYPOT HIT --> Fail2ban time=1785345427 log=2026-07-29T18:17:07+01:00 ip=20.63.98.115 host=as21066 ... show more HONEYPOT HIT --> Fail2ban time=1785345427 log=2026-07-29T18:17:07+01:00 ip=20.63.98.115 host=as210667.net method=GET uri="/admin.php" status=404 ua="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" ref="-" rid=88eee67e8da6f705e04f81c6502ac853 show less	Web App Attack

Showing 1 to 15 of 156 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇳🇴 193.200.221.8

🇭🇰 152.32.128.149

🇺🇸 142.93.126.42

🇹🇷 94.154.43.36

🇮🇳 93.114.15.105

🇷🇴 92.118.39.212

🇺🇸 180.149.17.70

🇺🇸 172.253.91.146

🇺🇸 172.202.98.196

🇧🇷 170.238.51.216

🇧🇷 167.249.132.143

🇺🇸 162.43.236.234

🇧🇷 149.19.166.17

🇺🇸 146.174.37.115

🇺🇸 136.59.154.105

🇷🇺 109.187.190.107

🇮🇩 103.99.214.211

🇧🇬 93.94.141.115

🇺🇸 66.132.224.224

🇨🇦 51.161.8.211