JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 20.91.139.111

20.91.139.111 was found in our database!

This IP was reported 131 times. Confidence of Abuse is 100%: ?

100%

ISP	Microsoft Corporation
Usage Type	Data Center/Web Hosting/Transit
ASN	AS8075
Domain Name	microsoft.com
Country	🇸🇪 Sweden
City	Gavle, Gavleborg

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 20.91.139.111

Whois 20.91.139.111

IP Abuse Reports for 20.91.139.111:

This IP address has been reported a total of 131 times from 109 distinct sources. 20.91.139.111 was first reported on July 26th 2026, and the most recent report was 2 minutes ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇺🇸 lavnet.net	2026-07-26 21:48:25 (2 minutes ago)	20.91.139.111 - - [26/Jul/2026:21:48:24 +0000] "GET /wp-content/plugins/hellopress/wp_filemanager.ph ... show more 20.91.139.111 - - [26/Jul/2026:21:48:24 +0000] "GET /wp-content/plugins/hellopress/wp_filemanager.php HTTP/1.1" 404 6072 "-" "-" 20.91.139.111 - - [26/Jul/2026:21:48:24 +0000] "GET /this_is_a_new_hello_world.php HTTP/1.1" 404 2050 "-" "-" 20.91.139.111 - - [26/Jul/2026:21:48:24 +0000] "GET /this_is_a_new_hello_world.php HTTP/1.1" 404 2050 "-" "-" ... show less	Brute-Force
🇫🇷 bazter.pro	2026-07-26 21:41:58 (8 minutes ago)	Fail2Ban: plesk-scanner - 10 failures	Port Scan Hacking Brute-Force Web App Attack
🇦🇹 nomzamo	2026-07-26 21:40:26 (10 minutes ago)	Fail2Ban reported: nginx-noscript	Brute-Force
🇩🇪 bescared	2026-07-26 21:33:14 (17 minutes ago)	F2B - Malicious activity detected. URL Probing. -151302cd-	Hacking Bad Web Bot Web App Attack
🇧🇷 vfAcceloReporter	2026-07-26 21:25:36 (24 minutes ago)	20.91.139.111 - - [26/Jul/2026:18:25:34 -0300] "GET /ws78.php HTTP/1.1" 404 153 "-" "-" 20.91.139.11 ... show more 20.91.139.111 - - [26/Jul/2026:18:25:34 -0300] "GET /ws78.php HTTP/1.1" 404 153 "-" "-" 20.91.139.111 - - [26/Jul/2026:18:25:34 -0300] "GET /kapxq.php HTTP/1.1" 404 153 "-" "-" 20.91.139.111 - - [26/Jul/2026:18:25:35 -0300] "GET /vjzvvrhr.pdf.phtml HTTP/1.1" 404 153 "-" "-" 20.91.139.111 - - [26/Jul/2026:18:25:35 -0300] "GET /wpls.php HTTP/1.1" 404 153 "-" "-" 20.91.139.111 - - [26/Jul/2026:18:25:35 -0300] "GET /wp.php HTTP/1.1" 404 153 "-" "-" ... show less	Brute-Force Web App Attack Exploited Host
🇧🇷 vfAcceloReporter	2026-07-26 21:05:23 (45 minutes ago)	20.91.139.111 - - [26/Jul/2026:18:05:21 -0300] "GET /wp-content/plugins/hellopress/wp_filemanager.ph ... show more 20.91.139.111 - - [26/Jul/2026:18:05:21 -0300] "GET /wp-content/plugins/hellopress/wp_filemanager.php HTTP/1.1" 404 153 "-" "-" 20.91.139.111 - - [26/Jul/2026:18:05:22 -0300] "GET /this_is_a_new_hello_world.php HTTP/1.1" 404 153 "-" "-" 20.91.139.111 - - [26/Jul/2026:18:05:22 -0300] "GET /public/mI35rZhMg1zJ1vuXdefault.php HTTP/1.1" 404 153 "-" "-" 20.91.139.111 - - [26/Jul/2026:18:05:22 -0300] "GET /000.php HTTP/1.1" 404 153 "-" "-" 20.91.139.111 - - [26/Jul/2026:18:05:22 -0300] "GET /tx79.php HTTP/1.1" 404 153 "-" "-" ... show less	Brute-Force Web App Attack Exploited Host
🇺🇸 Operator873	2026-07-26 21:02:59 (47 minutes ago)	2026/07/26 16:02:56 [error] 143758#0: 66981 access forbidden by rule, client: 20.91.139.111, server ... show more 2026/07/26 16:02:56 [error] 143758#0: 66981 access forbidden by rule, client: 20.91.139.111, server: [OBFUSCATED], request: "GET /wp-content/plugins/hellopress/wp_filemanager.php HTTP/1.1", host: "[OBFUSCATED]" 2026/07/26 16:02:56 [error] 143758#0: 66981 access forbidden by rule, client: 20.91.139.111, server: [OBFUSCATED], request: "GET /wp-content/plugins/hellopress/wp_filemanager.php HTTP/1.1", host: "[OBFUSCATED]" 2026/07/26 16:02:57 [error] 143758#0: 66981 access forbidden by rule, client: 20.91.139.111, server: [OBFUSCATED], request: "GET /this_is_a_new_hello_world.php HTTP/1.1", host: "[OBFUSCATED]" 2026/07/26 16:02:57 [error] 143758#0: 66981 access forbidden by rule, client: 20.91.139.111, server: [OBFUSCATED], request: "GET /this_is_a_new_hello_world.php HTTP/1.1", host: "[OBFUSCATED]" 2026/07/26 16:02:57 [error] 143758#0: 66981 access forbidden by rule, client: 20.91.139.111, server: [OBFUSCATED], request: "GET /public/mI35r ... show less	Brute-Force Web App Attack
🇧🇷 chronos	2026-07-26 21:02:37 (47 minutes ago)	Web traffic. Possible probing or exploitation attempts. \| Port: 80 \| Proto: TCP \| Location: Sweden, ... show more Web traffic. Possible probing or exploitation attempts. \| Port: 80 \| Proto: TCP \| Location: Sweden, N/A show less	Brute-Force Web App Attack Exploited Host
🇳🇱 oisecnet	2026-07-26 21:01:44 (48 minutes ago)	Automated report: Unauthorized vulnerability scanning detected on 2026-07-26. 11 requests from this ... show more Automated report: Unauthorized vulnerability scanning detected on 2026-07-26. 11 requests from this IP. show less	Brute-Force Web App Attack SSH
🇩🇪 webanyone	2026-07-26 21:00:57 (49 minutes ago)	Apache web server attack detected by Fail2Ban in plesk-apache jail	Web App Attack
🇷🇴 iulianh	2026-07-26 20:56:51 (53 minutes ago)	*	Brute-Force SSH
🇨🇿 Prcek	2026-07-26 20:53:21 (57 minutes ago)	PortScan:HOST=20.91.139.111,DPORTS=80,443	Port Scan
🇦🇺 Lazarus	2026-07-26 20:49:17 (1 hour ago)	HTTP probe.	Web App Attack
🇺🇦 URAN Publishing Service	2026-07-26 20:45:45 (1 hour ago)	20.91.139.111 - - [26/Jul/2026:23:45:43 +0300] "GET /wp-content/plugins/hellopress/wp_filemanager.ph ... show more 20.91.139.111 - - [26/Jul/2026:23:45:43 +0300] "GET /wp-content/plugins/hellopress/wp_filemanager.php HTTP/1.1" 301 654 "-" "-" ... show less	Web App Attack
Anonymous	2026-07-26 20:32:53 (1 hour ago)	20.91.139.111 - - [26/Jul/2026:22:32:37 +0200] "GET /wp-content/plugins/hellopress/wp_filemanager.ph ... show more 20.91.139.111 - - [26/Jul/2026:22:32:37 +0200] "GET /wp-content/plugins/hellopress/wp_filemanager.php HTTP/1.1" 404 119467 "-" "-" 20.91.139.111 - - [26/Jul/2026:22:32:40 +0200] "GET /wp-content/plugins/hellopress/wp_filemanager.php HTTP/1.1" 404 119245 "-" "-" 20.91.139.111 - - [26/Jul/2026:22:32:41 +0200] "GET /this_is_a_new_hello_world.php HTTP/1.1" 404 118758 "-" "-" 20.91.139.111 - - [26/Jul/2026:22:32:42 +0200] "GET /this_is_a_new_hello_world.php HTTP/1.1" 404 118528 "-" "-" 20.91.139.111 - - [26/Jul/2026:22:32:42 +0200] "GET /public/mI35rZhMg1zJ1vuXdefault.php HTTP/1.1" 404 118758 "-" "-" 20.91.139.111 - - [26/Jul/2026:22:32:43 +0200] "GET /public/mI35rZhMg1zJ1vuXdefault.php HTTP/1.1" 404 118528 "-" "-" 20.91.139.111 - - [26/Jul/2026:22:32:44 +0200] "GET /000.php HTTP/1.1" 404 118758 "-" "-" 20.91.139.111 - - [26/Jul/2026:22:32:45 +0200] "GET /000.php HTTP/1.1" 404 118528 "-" "-" 20.91.139.111 - - [26/Jul/2026:22:32:45 +0200] "GET /tx79.php HTTP/1.1" 404 118758 "-" "-" 20.91.139 ... show less	Bad Web Bot Web App Attack

Showing 1 to 15 of 131 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇳🇱 45.153.34.112

🇨🇷 45.130.162.152

🇨🇳 218.13.141.86

🇪🇹 196.189.126.10

🇨🇭 194.191.26.234

🇷🇴 193.46.255.86

🇧🇷 179.185.227.77

🇧🇷 170.231.252.57

🇳🇱 158.94.210.203

🇨🇦 142.44.220.59

🇦🇹 46.124.138.117

🇩🇪 43.228.157.8

🇺🇸 20.102.116.167

🇺🇸 20.64.104.5

🇫🇷 13.140.132.21

🇰🇷 220.85.210.200

🇧🇷 200.188.226.9

🇧🇪 198.235.24.229

🇮🇳 138.252.100.167

🇨🇿 92.62.233.214