JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 20.91.188.128

20.91.188.128 was found in our database!

This IP was reported 370 times. Confidence of Abuse is 100%: ?

100%

ISP	Microsoft Corporation
Usage Type	Data Center/Web Hosting/Transit
ASN	AS8075
Domain Name	microsoft.com
Country	🇸🇪 Sweden
City	Gavle, Gavleborg

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 20.91.188.128

Whois 20.91.188.128

IP Abuse Reports for 20.91.188.128:

This IP address has been reported a total of 370 times from 309 distinct sources. 20.91.188.128 was first reported on June 27th 2026, and the most recent report was 4 hours ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇩🇪 NetShield-DE	2026-06-28 14:07:21 (4 hours ago)	Auto-report via Fail2Ban aggregation. IP observed in jails: abuseipdb. Events: 1. First: 2026-06-28T ... show more Auto-report via Fail2Ban aggregation. IP observed in jails: abuseipdb. Events: 1. First: 2026-06-28T16:07:01+0200. Last: 2026-06-28T16:07:01+0200. Samples: - 2026-06-28 00:34:45,261 fail2ban.actions [996924]: NOTICE [abuseipdb] Ban 20.91.188.128 show less	Web App Attack
Anonymous	2026-06-28 13:02:49 (5 hours ago)	Blocked by FortiWeb WAF ML threat detection. ML probability: 99%, Country: SE, Attack patterns: Word ... show more Blocked by FortiWeb WAF ML threat detection. ML probability: 99%, Country: SE, Attack patterns: WordPress scanning, Malicious User-Agent show less	Bad Web Bot Web App Attack
🇮🇳 walkintoadmin	2026-06-28 10:54:05 (7 hours ago)	scanner probe — datacenter, 0 real-user 200s	Bad Web Bot Web App Attack
🇩🇪 NetShield-DE	2026-06-28 09:07:21 (9 hours ago)	Auto-report via Fail2Ban aggregation. IP observed in jails: abuseipdb. Events: 1. First: 2026-06-28T ... show more Auto-report via Fail2Ban aggregation. IP observed in jails: abuseipdb. Events: 1. First: 2026-06-28T11:07:01+0200. Last: 2026-06-28T11:07:01+0200. Samples: - 2026-06-28 00:34:45,261 fail2ban.actions [996924]: NOTICE [abuseipdb] Ban 20.91.188.128 show less	Web App Attack
🇫🇷 HerrWolf	2026-06-28 09:00:04 (9 hours ago)	CrowdSec Detection: crowdsecurity/http-crawl-non_statics	Bad Web Bot
🇫🇷 phoenix1jl96	2026-06-28 08:48:13 (9 hours ago)	2026/06/28 10:47:27 [error] 5155#5155: 36521 open() "/home/user-data/www/default/cgi-bin/index.php" ... show more 2026/06/28 10:47:27 [error] 5155#5155: 36521 open() "/home/user-data/www/default/cgi-bin/index.php" failed (2: No such file or directory), client: 20.91.188.128, server: goelug.org, request: "GET //cgi-bin/index.php HTTP/1.1", host: "goelug.org" 2026/06/28 10:47:31 [error] 5155#5155: *36521 open() "/home/user-data/www/default/cgi-bin/admin.php" failed (2: No such file or directory), client: 20.91.188.128, server: goelug.org, request: "GET //cgi-bin/admin.php HTTP/1.1", host: "goelug.org" ... show less	DNS Compromise DNS Poisoning DDoS Attack Ping of Death Web Spam Email Spam Blog Spam Port Scan Hacking Brute-Force Bad Web Bot SSH Web App Attack
🇺🇸 TAY	2026-06-28 08:47:24 (9 hours ago)	20.91.188.128 - - [28/Jun/2026:16:38:26 +0800] "GET /2P.update.php HTTP/1.1" 301 453 "-" "-" 20.91.1 ... show more 20.91.188.128 - - [28/Jun/2026:16:38:26 +0800] "GET /2P.update.php HTTP/1.1" 301 453 "-" "-" 20.91.188.128 - - [28/Jun/2026:16:38:26 +0800] "GET /2P.update.php HTTP/1.1" 404 42221 "-" "-" 20.91.188.128 - - [28/Jun/2026:16:47:23 +0800] "GET /2P.update.php HTTP/1.1" 301 453 "-" "-" ... show less	Brute-Force
🇮🇪 AutosOnShow	2026-06-28 08:44:05 (9 hours ago)	blocked for webapp attack \| path requested: /btex.php \| seen at 2026-06-28 08:43:38.204 \|	Web App Attack
🇺🇸 oukat	2026-06-28 08:37:51 (9 hours ago)	Web bot / web application probing against nginx	Bad Web Bot Web App Attack
🇳🇱 i-turnradio.nl	2026-06-28 08:31:03 (10 hours ago)	2026-06-28 @ 10:31:03 (CET) ~ Blocked for trying to access: /wp-content/plugins/hellopress/wp_filema ... show more 2026-06-28 @ 10:31:03 (CET) ~ Blocked for trying to access: /wp-content/plugins/hellopress/wp_filemanager.php show less	Web App Attack
🇺🇸 Epimetheus	2026-06-28 08:28:11 (10 hours ago)	Unauthorized access attempts: [GET] /btex.php [GET] /yuuds.php [GET] /samll.php [GET] /zxcs.php [GE ... show more Unauthorized access attempts: [GET] /btex.php [GET] /yuuds.php [GET] /samll.php [GET] /zxcs.php [GET] /g30DRm.php [GET] /wp-pass.php [GET] /wp-blink.php [GET] /2000.php [GET] /mds.php [GET] /aboute.php [GET] /turkshell.php [GET] /nwflm.php [GET] /h02ugyh.php [GET] /wp-test.php [GET] /100.php [GET] /s1.php [GET] /moon.php UA: Unknown show less	Web App Attack
🇩🇪 JLKnoch.com	2026-06-28 08:24:45 (10 hours ago)	CrowdSec crowdsecurity/http-probing	Brute-Force Web App Attack
🇩🇪 Skyrider	2026-06-28 08:03:55 (10 hours ago)	crowdsecurity/http-probing	Web App Attack
🇺🇸 ruusvuu	2026-06-28 07:47:39 (10 hours ago)	Automated abuse report: 15 attack/probe requests from Microsoft Corporation / SE. Targeted paths: /w ... show more Automated abuse report: 15 attack/probe requests from Microsoft Corporation / SE. Targeted paths: /wp-content/plugins/hellopress/wp_filemanager.php, /this_is_a_new_hello_world.php, /water.php, /3PJcpMFsD8B.php, /sid4.php. Sample log lines: [mir-com] [6/28/2026, 12:47:38 AM] GET .mirregistry.com/w.php 404 20.91.188.128 - 0.749 ms [mir-com] [6/28/2026, 12:47:38 AM] GET .mirregistry.com/19.php 404 20.91.188.128 - 0.964 ms [mir-com] [6/28/2026, 12:47:38 AM] GET .mirregistry.com/like.php 404 20.91.188.128 - 0.784 ms Detected by an automated web-server log monitor. show less	Web App Attack
Anonymous	2026-06-28 07:45:50 (10 hours ago)	20.91.188.128 - - [28/Jun/2026:15:45:49 +0800] "GET /wp-content/plugins/hellopress/wp_filemanager.ph ... show more 20.91.188.128 - - [28/Jun/2026:15:45:49 +0800] "GET /wp-content/plugins/hellopress/wp_filemanager.php HTTP/1.1" 404 196 "-" "-" 20.91.188.128 - - [28/Jun/2026:15:45:50 +0800] "GET /this_is_a_new_hello_world.php HTTP/1.1" 404 16 "-" "-" 20.91.188.128 - - [28/Jun/2026:15:45:50 +0800] "GET /this_is_a_new_hello_world.php HTTP/1.1" 404 16 "-" "-" ... show less	Bad Web Bot Web App Attack

Showing 1 to 15 of 370 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇧🇪 198.235.24.207

🇺🇸 138.197.87.21

🇳🇱 45.148.10.121

🇺🇸 20.46.246.132

🇫🇷 194.163.149.168

🇦🇷 190.220.172.154

🇨🇳 111.26.95.254

🇳🇱 45.148.10.157

🇺🇸 45.42.88.54

🇺🇸 20.169.53.118

🇧🇪 198.235.24.222

🇿🇦 197.87.10.75

🇲🇽 189.161.78.135

🇧🇷 138.185.145.78

🇸🇪 85.224.222.37

🇺🇸 74.125.181.155

🇺🇸 74.7.227.22

🇩🇪 69.5.169.155

🇺🇸 67.86.152.44

🇫🇷 51.68.34.131