JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

20.87.24.214

Recent Activity

Abuse Confidence Score

100% Critical

787 reports

589 reporters · latest 2 minutes ago

ISP: Microsoft Corporation
Usage Type: Data Center/Web Hosting/Transit
ASN: AS8075
Domain Name: microsoft.com
Country: 🇿🇦 South Africa
City: Johannesburg, Gauteng

ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report Whois

Example preview

Account required for the enhanced features Log in Sign up

Abuse Reports

Export reports CSV

Total reports

787 from 589 distinct reporters

First reported

November 6th 2026

Most recent report

2 minutes ago

Last 60 days

Top reporter locations 🇩🇪 Germany 200 🇺🇸 United States of America 167 🇫🇷 France 81

Most common categories Web App Attack 599 Bad Web Bot 206 Brute-Force 176 Hacking 170 Port Scan 74

Recent reports We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇦🇺 FireGuard Server	2026-11-07 13:15:08 UTC · (2 minutes ago)	Blocked by os-abuseipdb; 5 hits, proto=tcp, ports=80	Port Scan Hacking
🇵🇱 alianet	2026-11-07 13:08:40 UTC · (9 minutes ago)	[Sat Nov 07 13:08:35.889612 2026] [proxy_fcgi:error] [pid 1866405:tid 1866437] [client 20.87.24.214:12336] AH01071: Got error 'Primary script unknown' [Sat Nov 07 13:08:36.264789 2026] [proxy_fcgi:error] [pid 1866405:tid 1866436] [client 20.87.24.214 ... show more [Sat Nov 07 13:08:35.889612 2026] [proxy_fcgi:error] [pid 1866405:tid 1866437] [client 20.87.24.214:12336] AH01071: Got error 'Primary script unknown' [Sat Nov 07 13:08:36.264789 2026] [proxy_fcgi:error] [pid 1866405:tid 1866436] [client 20.87.24.214:12336] AH01071: Got error 'Primary script unknown' [Sat Nov 07 13:08:36.639682 2026] [proxy_fcgi:error] [pid 1866405:tid 1866456] [client 20.87.24.214:12336] AH01071: Got error 'Primary script unknown' [Sat Nov 07 13:08:37.014844 2026] [proxy_fcgi:error] [pid 1866405:tid 1866447] [client 20.87.24.214:12336] AH01071: Got error 'Primary script unknown' [Sat Nov 07 13:08:37.390052 2026] [proxy_fcgi:error] [pid 1866405:tid 1866451] [client 20.87.24.214:12336] AH01071: Got error 'Primary script unknown' [Sat Nov 07 13:08:37.765223 2026] [proxy_fcgi:error] [pid 1866405:tid 1866434] [client 20.87.24.214:12336] AH01071: Got error 'Primary script unknown' [Sat Nov 07 13:08:38.141157 2026] [proxy_fcgi:error] [pid 1866405:tid 1866450] [client 20.87.2 ... show less	Port Scan Web App Attack
🇦🇺 OneLuca	2026-11-07 13:08:25 UTC · (9 minutes ago)	probed for WordPress GET /wp-content/plugins/hellopress/wp_filemanager.php)	Web App Attack
🇺🇸 1cyb3rpunk	2026-11-07 13:07:09 UTC · (10 minutes ago)	Honeypot interaction [EXPLOIT]: php_webshell_probe on /wp-content/plugins/hellopress/wp_filemanager.php. MITRE: T1204 (User Execution). UA: . Observed on sectrace.org honeypot surface — automated scanner/attacker activity.	Exploited Host Hacking
🇨🇦 Roper123	2026-11-07 13:01:54 UTC · (15 minutes ago)	Web exploits	Hacking Web App Attack
🇩🇪 Blexyel	2026-11-07 12:59:34 UTC · (18 minutes ago)	20.87.24.214 - - [07/Nov/2026:13:59:34 +0100] "GET /blog/wp-login.php HTTP/1.1" 301 169 "-" "-" "pingusmc.org" ...	Brute-Force Web App Attack
🇺🇦 Olexiy Backend	2026-11-07 12:57:00 UTC · (20 minutes ago)	20.87.24.214 ...	Bad Web Bot Web App Attack
🇺🇸 igerman	2026-11-07 12:55:16 UTC · (22 minutes ago)	caddy probes: admin-panel: GET /adminfuns.php(DROP) \| web: GET /1.php(DROP), GET /222.php(DROP), GET /3PJcpMFsD8B.php(DROP), GET /MacKenzie.php?p=(DROP), GET /alfa.php(DROP), GET /ant.php(DROP), GET /b.php?p=(DROP), GET /bnmtp.php(DROP), GET /chosen. ... show more caddy probes: admin-panel: GET /adminfuns.php(DROP) \| web: GET /1.php(DROP), GET /222.php(DROP), GET /3PJcpMFsD8B.php(DROP), GET /MacKenzie.php?p=(DROP), GET /alfa.php(DROP), GET /ant.php(DROP), GET /b.php?p=(DROP), GET /bnmtp.php(DROP), GET /chosen.php(DROP), GET /config.php?(DROP), GET /core.php(DROP), GET /date1.php(DROP), GET /footer.php(DROP), GET /functions.php(DROP), GET /header.php(DROP), GET /lib.php(DROP), GET /lock.php(DROP), GET /main.php(DROP), GET /np.php?p=(DROP), GET /sitemap.php(DROP), GET /this_is_a_new_hello_world.php(DROP), GET /ws.php(DROP) \| wordpress: GET /wp-content/plugins/hellopress/wp_filemanager.php(DROP), GET /wp-content/themes/index.php(DROP) show less	Web App Attack
Anonymous	2026-11-07 12:52:29 UTC · (25 minutes ago)	Too many successive quick attempts with error status 301, 404, 405, 444, 403 or 400	Bad Web Bot
🇺🇸 kuroneko_omu	2026-11-07 12:47:57 UTC · (29 minutes ago)	Fail2Ban <webattack> jail detected 5 attempts against 20.87.24.214.	DDoS Attack Hacking Brute-Force Web App Attack
🇩🇪 macrob	2026-11-07 12:46:46 UTC · (31 minutes ago)	2026/11/07 12:46:27 [error] 264515#264515: 12482921 access forbidden by rule, client: 20.87.24.214, server: bin.partners, request: "GET /wp-content/plugins/hellopress/wp_filemanager.php HTTP/2.0", host: "bin.partners" 2026/11/07 12:46:33 [error] 264 ... show more 2026/11/07 12:46:27 [error] 264515#264515: 12482921 access forbidden by rule, client: 20.87.24.214, server: bin.partners, request: "GET /wp-content/plugins/hellopress/wp_filemanager.php HTTP/2.0", host: "bin.partners" 2026/11/07 12:46:33 [error] 264519#264519: 12483176 access forbidden by rule, client: 20.87.24.214, server: bin.partners, request: "GET /adminfuns.php HTTP/2.0", host: "bin.partners" 2026/11/07 12:46:45 [error] 264515#264515: 12483693 access forbidden by rule, client: 20.87.24.214, server: bin.partners, request: "GET //admin.php HTTP/2.0", host: "bin.partners" ... show less	Web App Attack
Anonymous	2026-11-07 12:45:15 UTC · (32 minutes ago)	(mod_security) mod_security triggered on hostname [redacted] 20.87.24.214 (ZA/South Africa/-)	SQL Injection
🇫🇷 bab	2026-11-07 12:39:42 UTC · (38 minutes ago)	fail2ban: blocked after 3 matches in jail nginx-scan	Hacking Web App Attack
🇩🇪 Nevermind	2026-11-07 12:31:16 UTC · (46 minutes ago)	20.87.24.214 - - [07/Nov/2026:13:31:14 +0100] "GET /wp-content/plugins/hellopress/wp_filemanager.php HTTP/1.1" 404 6314 "-" "-" 20.87.24.214 - - [07/Nov/2026:13:31:15 +0100] "GET /this_is_a_new_hello_world.php HTTP/1.1" 404 6314 "-" "-" 20.87.24.214 ... show more 20.87.24.214 - - [07/Nov/2026:13:31:14 +0100] "GET /wp-content/plugins/hellopress/wp_filemanager.php HTTP/1.1" 404 6314 "-" "-" 20.87.24.214 - - [07/Nov/2026:13:31:15 +0100] "GET /this_is_a_new_hello_world.php HTTP/1.1" 404 6314 "-" "-" 20.87.24.214 - - [07/Nov/2026:13:31:15 +0100] "GET /core.php HTTP/1.1" 404 6314 "-" "-" 20.87.24.214 - - [07/Nov/2026:13:31:16 +0100] "GET /footer.php HTTP/1.1" 404 6314 "-" "-" ... show less	Web App Attack
🇺🇸 Sonoflet	2026-11-07 12:23:40 UTC · (54 minutes ago)	CrowdSec detection \| scenario: http-admin-interface-probing	Port Scan Web App Attack

Showing 1 to 15 of 787 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown

Recently Reported IPs:

🇨🇳 106.75.132.16

🇵🇰 103.174.206.222

🇮🇳 103.109.109.224

🇳🇱 45.148.10.151

🇨🇳 221.15.13.13

🇮🇳 203.145.165.2

🇳🇱 195.178.110.51

🇨🇦 192.53.123.32

🇻🇳 103.48.192.48

🇲🇩 89.34.65.87

🇮🇳 49.47.9.228

🇹🇭 45.194.70.250

🇳🇱 45.148.10.233

🇦🇪 5.38.45.227

🇳🇱 216.252.238.222

🇦🇷 190.97.21.208

🇲🇾 123.253.33.99

🇨🇳 121.29.84.33

🇳🇱 81.19.216.71

🇺🇸 69.91.146.163