JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 20.89.17.85

20.89.17.85 was found in our database!

This IP was reported 149 times. Confidence of Abuse is 100%: ?

100%

ISP	Microsoft Corporation
Usage Type	Data Center/Web Hosting/Transit
ASN	AS8075
Domain Name	microsoft.com
Country	🇯🇵 Japan
City	Tokyo, Tokyo

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 20.89.17.85

Whois 20.89.17.85

IP Abuse Reports for 20.89.17.85:

This IP address has been reported a total of 149 times from 131 distinct sources. 20.89.17.85 was first reported on July 1st 2026, and the most recent report was 1 hour ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇩🇪 LRob	2026-07-02 07:45:07 (1 hour ago)	Repeated attacks detected by Fail2Ban in recidive jail	Hacking
🇬🇧 openstrike.co.uk	2026-07-02 05:14:43 (3 hours ago)	385 attacks on PHP URLs: GET /inputs.php HTTP/1.1	Web App Attack
🇬🇷 setupgr	2026-07-02 03:39:10 (5 hours ago)	(PERMBLOCK) 20.89.17.85 (JP/Japan/Tokyo/Shibuya City/-/[AS8075 MICROSOFT-CORP-MSN-AS-BLOCK]) has had ... show more (PERMBLOCK) 20.89.17.85 (JP/Japan/Tokyo/Shibuya City/-/[AS8075 MICROSOFT-CORP-MSN-AS-BLOCK]) has had more than 4 temp blocks in the last 86400 secs; Ports: *; Direction: inout; Trigger: LF_PERMBLOCK_COUNT; Logs: N/A show less	Port Scan
🇺🇸 Major Hostility	2026-07-02 03:22:35 (5 hours ago)	"GET /a.php HTTP/1.1" 404 "GET /aa.php HTTP/1.1" 404 "GET /aaa.php HTTP/1.1" 404 "GET /ab.php HTTP/1 ... show more "GET /a.php HTTP/1.1" 404 "GET /aa.php HTTP/1.1" 404 "GET /aaa.php HTTP/1.1" 404 "GET /ab.php HTTP/1.1" 404 "GET /lock360.php HTTP/1.1" 404 "GET /anonse/lock360.php HTTP/1.1" 404 "GET /file5.php HTTP/1.1" 404 "GET /sitemaps.php HTTP/1.1" 404 "GET /ioxi-o.php HTTP/1.1" 404 "GET /load.php HTTP/1.1" 404 "GET /k.php HTTP/1.1" 404 "GET /autoload_classmap.php HTTP/1.1" 404 "GET /post.php HTTP/1.1" 404 "GET /1.php HTTP/1.1" 404 "GET /flower.php HTTP/1.1" 404 "GET /admin.php HTTP/1.1" 404 "GET /file.php HTTP/1.1" 404 "GET /default.php HTTP/1.1" 404 "GET /defaults.php HTTP/1.1" 404 "GET /meta.php HTTP/1.1" 404 "GET /index.php HTTP/1.1" 404 "GET /about.php%2 show less	Web App Attack
🇺🇸 TAY	2026-07-02 03:11:38 (5 hours ago)	20.89.17.85 - - [02/Jul/2026:11:05:38 +0800] "GET /update.php HTTP/1.1" 301 440 "-" "Mozilla/5.0 (Wi ... show more 20.89.17.85 - - [02/Jul/2026:11:05:38 +0800] "GET /update.php HTTP/1.1" 301 440 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.89.17.85 - - [02/Jul/2026:11:05:46 +0800] "GET /updates.php HTTP/1.1" 301 441 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.89.17.85 - - [02/Jul/2026:11:11:37 +0800] "GET /update.php HTTP/1.1" 404 80570 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" ... show less	Brute-Force
🇷🇺 Reaper	2026-07-02 03:10:52 (5 hours ago)	GET /admin.php	Web App Attack
🇫🇷 sthoyer.de	2026-07-02 03:05:27 (5 hours ago)	20.89.17.85 - - [02/Jul/2026:05:05:25 +0200] "GET /a.php HTTP/1.1" 302 495 "-" "Mozilla/5.0 (Windows ... show more 20.89.17.85 - - [02/Jul/2026:05:05:25 +0200] "GET /a.php HTTP/1.1" 302 495 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.89.17.85 - - [02/Jul/2026:05:05:25 +0200] "GET /aa.php HTTP/1.1" 302 495 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.89.17.85 - - [02/Jul/2026:05:05:25 +0200] "GET /aaa.php HTTP/1.1" 302 495 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" ... show less	Web App Attack
🇳🇱 CryptoYakari	2026-07-02 02:59:20 (5 hours ago)	[Thu Jul 02 05:59:16.376729 2026] [proxy_fcgi:error] [pid 3279863:tid 3279914] [client 20.89.17.85:0 ... show more [Thu Jul 02 05:59:16.376729 2026] [proxy_fcgi:error] [pid 3279863:tid 3279914] [client 20.89.17.85:0] AH01071: Got error 'Primary script unknown' [Thu Jul 02 05:59:16.661031 2026] [proxy_fcgi:error] [pid 3279863:tid 3279902] [client 20.89.17.85:0] AH01071: Got error 'Primary script unknown' [Thu Jul 02 05:59:16.960997 2026] [proxy_fcgi:error] [pid 3279863:tid 3279909] [client 20.89.17.85:0] AH01071: Got error 'Primary script unknown' ... show less	Web Spam Blog Spam Web App Attack Bad Web Bot
🇮🇹 madaello	2026-07-02 02:40:51 (6 hours ago)	20.89.17.85 - - [02/Jul/2026:04:40:49 +0200] "GET /a.php HTTP/1.1" 404 4227 "-" "Mozilla/5.0 (Window ... show more 20.89.17.85 - - [02/Jul/2026:04:40:49 +0200] "GET /a.php HTTP/1.1" 404 4227 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.89.17.85 - - [02/Jul/2026:04:40:49 +0200] "GET /aa.php HTTP/1.1" 404 267 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.89.17.85 - - [02/Jul/2026:04:40:50 +0200] "GET /aaa.php HTTP/1.1" 404 267 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.89.17.85 - - [02/Jul/2026:04:40:50 +0200] "GET /ab.php HTTP/1.1" 404 267 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.89.17.85 - - [02/Jul/2026:04:40:50 +0200] "GET /lock360.php HTTP/1.1" 404 267 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" ... show less	Port Scan
🇺🇸 Mundo Bueno	2026-07-02 02:37:16 (6 hours ago)	[ISILIA Protection v2.1] Tentative d'accès: /alfa-rex.php \| Pays: JP \| UA: Mozilla/5.0 (Windows NT 1 ... show more [ISILIA Protection v2.1] Tentative d'accès: /alfa-rex.php \| Pays: JP \| UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Sa show less	Hacking Web App Attack
🇮🇹 Inartis	2026-07-02 02:32:31 (6 hours ago)	20.89.17.85 - - [02/Jul/2026:04:32:15 +0200] "GET /admin.php HTTP/1.1" 301 508 "-" "Mozilla/5.0 (Win ... show more 20.89.17.85 - - [02/Jul/2026:04:32:15 +0200] "GET /admin.php HTTP/1.1" 301 508 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.89.17.85 - - [02/Jul/2026:04:32:30 +0200] "GET /xmlrpc.php HTTP/1.1" 403 490 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.89.17.85 - - [02/Jul/2026:04:32:30 +0200] "GET /xmlrpc.php0 HTTP/1.1" 301 510 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" ... show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 chronos	2026-07-02 02:17:06 (6 hours ago)	[AUTORAVALT][[01/07/2026 - 23:17:06 -03:00 UTC] Attack from [Microsoft Corporation] [20.89.17.85] Ac ... show more [AUTORAVALT][[01/07/2026 - 23:17:06 -03:00 UTC] Attack from [Microsoft Corporation] [20.89.17.85] Action: BLocKed DDoS Attack -> Participating in distributed denial-of-service. Phishing -> Phishing websites and/or email. Web Spam -> Comment/forum spam, HTTP referer spam, or other CMS spam. Blog Spam -> CMS blog comment spam. Web App Attack -> Attempts to probe] ... show less	DDoS Attack Phishing Web Spam Blog Spam Web App Attack
🇬🇧 thetomtaylor.co.uk	2026-07-02 02:09:01 (6 hours ago)	Fail2Ban - [NGINX]WordPress Logins Sniffings on nginx-wordpress-sniffer ... [mx02,mx03]	Bad Web Bot Web App Attack
🇺🇸 antlac1	2026-07-02 02:01:07 (6 hours ago)	crowdsecurity/http-probing	Brute-Force Web App Attack
🇪🇸 el-brujo	2026-07-02 01:56:29 (6 hours ago)	[Thu Jul 02 03:56:28.376748 2026] [proxy_fcgi:error] [pid 592529:tid 592582] [remote 20.89.17.85:0] ... show more [Thu Jul 02 03:56:28.376748 2026] [proxy_fcgi:error] [pid 592529:tid 592582] [remote 20.89.17.85:0] AH01071: Got error 'Primary script unknown\n' [Thu Jul 02 03:56:28.889528 2026] [proxy_fcgi:error] [pid 592529:tid 592655] [remote 20.89.17.85:0] AH01071: Got error 'Primary script unknown\n' ... show less	Hacking Web App Attack

Showing 1 to 15 of 149 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇷🇴 193.32.162.60

🇮🇷 84.47.253.61

🇺🇸 141.11.88.122

🇨🇳 117.29.44.72

🇷🇺 109.184.22.16

🇮🇩 103.155.47.50

🇳🇱 91.92.40.204

🇨🇦 85.217.149.20

🇺🇸 43.135.135.17

🇩🇪 8.211.46.254

🇳🇱 185.242.226.61

🇨🇭 104.251.181.72

🇸🇬 47.84.109.84

🇺🇸 45.130.83.17

🇮🇳 185.100.212.141

🇷🇺 46.138.254.1

🇯🇵 203.25.124.192

🇨🇴 186.147.162.215

🇨🇦 167.99.184.164

🇺🇸 164.90.142.114