JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

20.87.218.237

Recent Activity

Abuse Confidence Score

100% Critical

810 reports

582 reporters · latest 7 minutes ago

ISP: Microsoft Corporation
Usage Type: Data Center/Web Hosting/Transit
ASN: AS8075
Domain Name: microsoft.com
Country: 🇿🇦 South Africa
City: Johannesburg, Gauteng

ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report Whois

Example preview

Account required for the enhanced features Log in Sign up

Abuse Reports

Export reports CSV

Total reports

810 from 582 distinct reporters

First reported

November 13th 2026

Most recent report

7 minutes ago

Last 60 days

Top reporter locations 🇩🇪 Germany 205 🇺🇸 United States of America 151 🇫🇷 France 87

Most common categories Web App Attack 642 Bad Web Bot 217 Brute-Force 169 Hacking 161 Port Scan 73

Recent reports We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
Anonymous	2026-11-14 15:10:56 UTC · (7 minutes ago)	fail2ban jail apache-scanner: 20.87.218.237 - - [13/Nov/2026:08:09:44 -0800] "GET /buy.php HTTP/1.1" 404 65489 "-" "-" 20.87.218.237 - - [13/Nov/2026:08:09:45 -0800] "GET /sitemap.php HTTP/1.1" 404 65489 "-" "-" 20.87.218.237 - - [13/Nov/2026:08:09:4 ... show more fail2ban jail apache-scanner: 20.87.218.237 - - [13/Nov/2026:08:09:44 -0800] "GET /buy.php HTTP/1.1" 404 65489 "-" "-" 20.87.218.237 - - [13/Nov/2026:08:09:45 -0800] "GET /sitemap.php HTTP/1.1" 404 65489 "-" "-" 20.87.218.237 - - [13/Nov/2026:08:09:47 -0800] "GET /gjbyv.php HTTP/1.1" 404 65489 "-" "-" 20.87.218.237 - - [13/Nov/2026:08:09:48 -0800] "GET /xjore1.php HTTP/1.1" 404 65489 "-" "-" 20.87.218.237 - - [13/Nov/2026:08:09:49 -0800] "GET /bless241.php HTTP/1.1" 404 65489 "-" "-" 20.87.218.237 - - [13/Nov/2026:08:09:50 -0800] "GET /tinyfilemanager.php HTTP/1.1" 404 65489 "-" "-" 20.87.218.237 - - [13/Nov/2026:08:09:51 -0800] "GET /akp.php HTTP/1.1" 404 65489 "-" "-" 20.87.218.237 - - [13/Nov/2026:08:09:52 -0800] "GET /dairg.php HTTP/1.1" 404 65489 "-" "-" 20.87.218.237 - - [13/Nov/2026:08:09:53 -0800] "GET /img.php HTTP/1.1" 404 65489 "-" "-" 20.87.218.237 - - [13/Nov/2026:08:09:54 -0800] "GET /mac.php HTTP/1.1" show less	Web App Attack Port Scan
Anonymous	2026-11-14 15:10:46 UTC · (7 minutes ago)	Aggressive web scan	Web App Attack
🇪🇸 pipeline.es	2026-11-14 15:07:04 UTC · (11 minutes ago)	Web scanning / probing for vulnerable paths \| URL: /bro.php \| Evidence: planesgaleriadeviajes.com 20.87.218.237 - - [14/Nov/2026:16:06:08 +0100] \"GET /bro.php HTTP/1.1\" 404 25686 \"-\" \"-\" GEOIP_COUNTRY_CODE=ZA 19262 \| ASN: MICROSOFT-CORP-MSN-AS- ... show more Web scanning / probing for vulnerable paths \| URL: /bro.php \| Evidence: planesgaleriadeviajes.com 20.87.218.237 - - [14/Nov/2026:16:06:08 +0100] \"GET /bro.php HTTP/1.1\" 404 25686 \"-\" \"-\" GEOIP_COUNTRY_CODE=ZA 19262 \| ASN: MICROSOFT-CORP-MSN-AS-BLOCK \| Country: ZA show less	Port Scan Web App Attack
🇩🇪 hchristo	2026-11-14 15:00:01 UTC · (18 minutes ago)	[Sat Nov 14 15:59:59.331541 2026] [proxy_fcgi:error] [pid 33369:tid 33441] [client 20.87.218.237:22552] AH01071: Got error 'Primary script unknown' [Sat Nov 14 15:59:59.694797 2026] [proxy_fcgi:error] [pid 33369:tid 33435] [client 20.87.218.237:22552 ... show more [Sat Nov 14 15:59:59.331541 2026] [proxy_fcgi:error] [pid 33369:tid 33441] [client 20.87.218.237:22552] AH01071: Got error 'Primary script unknown' [Sat Nov 14 15:59:59.694797 2026] [proxy_fcgi:error] [pid 33369:tid 33435] [client 20.87.218.237:22552] AH01071: Got error 'Primary script unknown' [Sat Nov 14 16:00:00.051299 2026] [proxy_fcgi:error] [pid 33369:tid 33463] [client 20.87.218.237:22552] AH01071: Got error 'Primary script unknown' [Sat Nov 14 16:00:00.399188 2026] [proxy_fcgi:error] [pid 33369:tid 33448] [client 20.87.218.237:22552] AH01071: Got error 'Primary script unknown' [Sat Nov 14 16:00:00.747112 2026] [proxy_fcgi:error] [pid 33369:tid 33460] [client 20.87.218.237:22552] AH01071: Got error 'Primary script unknown' ... show less	Brute-Force
🇩🇪 hidemail.app	2026-11-14 14:50:31 UTC · (27 minutes ago)	Automated scan for exposed config/secret files and known web exploits (e.g. /.env, RCE probes); auto-banned by fail2ban.	Web App Attack Hacking
Anonymous	2026-11-14 14:45:03 UTC · (33 minutes ago)	Observed scanned 137 known-sensitive endpoint(s), e.g.: ///admin.php, //300_n.php, //admin.php, //asd.php, //av.php, //buy.php	Bad Web Bot Web App Attack
Anonymous	2026-11-14 14:44:55 UTC · (33 minutes ago)	80/tcp (1 or more attempts)	Port Scan
🇷🇺 avaio-media	2026-11-14 14:42:04 UTC · (36 minutes ago)		Web App Attack
🇨🇦 webemsegundos	2026-11-14 14:37:19 UTC · (41 minutes ago)	Web vulnerability scanner: 89 probe paths (e.g. /wp-content/plugins/hellopress/wp_filemanager.php, /this_is_a_new_hello_world.php, /wp-admin/css/colors/blue/qww.php, /ggg.php, /zzxx.php, /wplor.php). Blocked by WeS Firewall.	Bad Web Bot Web App Attack
🇩🇪 svr	2026-11-14 14:34:38 UTC · (43 minutes ago)	Abusive Automated Web Scanner	Web App Attack
Anonymous	2026-11-14 14:32:08 UTC · (46 minutes ago)	Automated report: 16 malicious HTTP request(s) blocked by WAF/IPS on public web services. Requested: /wp-admin/css/colors/blue/qww.php, /wp-content/plugins/index.php, ["/admin.php","/adminfuns.php","/admin.php?"], ["/this_is_a_new_hello_world.php","/ ... show more Automated report: 16 malicious HTTP request(s) blocked by WAF/IPS on public web services. Requested: /wp-admin/css/colors/blue/qww.php, /wp-content/plugins/index.php, ["/admin.php","/adminfuns.php","/admin.php?"], ["/this_is_a_new_hello_world.php","/ggg.php","/zzxx.php","/wplor.php?p=","/link. show less	Bad Web Bot Web App Attack
🇩🇪 pscriptos	2026-11-14 14:29:14 UTC · (49 minutes ago)	This IP was detected by CrowdSec triggering crowdsecurity/http-probing	Web App Attack Hacking
🇩🇪 macrob	2026-11-14 14:27:17 UTC · (51 minutes ago)	2026/11/14 14:27:07 [error] 3997142#3997142: 5299188 access forbidden by rule, client: 20.87.218.237, server: binixo.pl, request: "GET /wp-content/plugins/hellopress/wp_filemanager.php HTTP/2.0", host: "binixo.pl" 2026/11/14 14:27:10 [error] 3997142 ... show more 2026/11/14 14:27:07 [error] 3997142#3997142: 5299188 access forbidden by rule, client: 20.87.218.237, server: binixo.pl, request: "GET /wp-content/plugins/hellopress/wp_filemanager.php HTTP/2.0", host: "binixo.pl" 2026/11/14 14:27:10 [error] 3997142#3997142: 5389376 access forbidden by rule, client: 20.87.218.237, server: binixo.pl, request: "GET /adminfuns.php HTTP/2.0", host: "binixo.pl" 2026/11/14 14:27:16 [error] 3997143#3997143: 5368741 access forbidden by rule, client: 20.87.218.237, server: binixo.pl, request: "GET /admins.php HTTP/2.0", host: "binixo.pl" ... show less	Web App Attack
🇦🇺 Klaverstyn	2026-11-14 14:22:43 UTC · (55 minutes ago)	Repeated 403 Forbidden responses	Web App Attack
🇫🇷 phoenix1jl96	2026-11-14 14:20:29 UTC · (57 minutes ago)	[Sat Nov 14 15:20:27.505440 2026] [proxy_fcgi:error] [pid 190823:tid 190849] [client 20.87.218.237:62980] AH01071: Got error 'Primary script unknown' [Sat Nov 14 15:20:27.693587 2026] [proxy_fcgi:error] [pid 190823:tid 190838] [client 20.87.218.237:6 ... show more [Sat Nov 14 15:20:27.505440 2026] [proxy_fcgi:error] [pid 190823:tid 190849] [client 20.87.218.237:62980] AH01071: Got error 'Primary script unknown' [Sat Nov 14 15:20:27.693587 2026] [proxy_fcgi:error] [pid 190823:tid 190838] [client 20.87.218.237:62980] AH01071: Got error 'Primary script unknown' [Sat Nov 14 15:20:27.863695 2026] [proxy_fcgi:error] [pid 190823:tid 190834] [client 20.87.218.237:62980] AH01071: Got error 'Primary script unknown' [Sat Nov 14 15:20:28.032229 2026] [proxy_fcgi:error] [pid 190823:tid 190830] [client 20.87.218.237:62980] AH01071: Got error 'Primary script unknown' [Sat Nov 14 15:20:28.201996 2026] [proxy_fcgi:error] [pid 190823:tid 190836] [client 20.87.218.237:62980] AH01071: Got error 'Primary script unknown' ... show less	DNS Compromise DNS Poisoning DDoS Attack Web Spam Port Scan Brute-Force Bad Web Bot Exploited Host Web App Attack SSH

Showing 1 to 15 of 810 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown

Recently Reported IPs:

🇺🇸 154.83.199.184

🇻🇳 123.31.31.125

🇻🇳 103.154.62.14

🇧🇷 45.229.91.2

🇻🇪 45.195.13.75

🇺🇸 34.148.73.188

🇹🇼 34.80.246.9

🇧🇷 181.191.169.224

🇺🇸 172.71.158.12

🇺🇸 104.207.44.160

🇷🇴 92.118.39.50

🇺🇸 66.132.172.231

🇻🇪 38.51.209.68

🇴🇲 37.28.66.3

🇧🇪 35.210.124.168

🇦🇿 212.47.133.98

🇸🇬 159.89.199.108

🇨🇳 112.83.12.103

🇩🇪 104.164.106.96

🇺🇸 76.33.238.214