JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 20.97.227.207

20.97.227.207 was found in our database!

This IP was reported 452 times. Confidence of Abuse is 100%: ?

100%

ISP	Microsoft Corporation
Usage Type	Data Center/Web Hosting/Transit
ASN	AS8075
Domain Name	microsoft.com
Country	🇺🇸 United States of America
City	Boydton, Virginia

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 20.97.227.207

Whois 20.97.227.207

IP Abuse Reports for 20.97.227.207:

This IP address has been reported a total of 452 times from 354 distinct sources. 20.97.227.207 was first reported on July 20th 2026, and the most recent report was 50 minutes ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇮🇳 evicky2002	2026-07-22 06:00:00 (50 minutes ago)	Confirmed malicious by STILWaters CTI platform (score=100, sources=1)	Hacking Brute-Force SSH
🇬🇧 openstrike.co.uk	2026-07-22 05:14:02 (1 hour ago)	616 attacks on Alfa URLs, PHP URLs: POST /alfacgiapi/perl.alfa HTTP/1.1 GET /images/stories/admin-po ... show more 616 attacks on Alfa URLs, PHP URLs: POST /alfacgiapi/perl.alfa HTTP/1.1 GET /images/stories/admin-post.php HTTP/1.1 show less	Hacking Web App Attack
🇭🇺 DumaNet	2026-07-22 04:36:00 (2 hours ago)	WordPress (CMS) attack attempts. Date: 2026 Jul 21. 22:17:01 Source IP: 20.97.227.207 Portion o ... show more WordPress (CMS) attack attempts. Date: 2026 Jul 21. 22:17:01 Source IP: 20.97.227.207 Portion of the log(s): 20.97.227.207 - [21/Jul/2026:22:17:01 +0200] "GET /wp-includes/wp-includes/about.php HTTP/1.1" 404 153 "-" "-" 20.97.227.207 - [21/Jul/2026:22:17:01 +0200] "GET /admin/uploads/lv.php HTTP/1.1" 404 153 "-" "-" 20.97.227.207 - [21/Jul/2026:22:17:01 +0200] "GET /wp-content/uploads/json.php HTTP/1.1" 404 153 "-" "-" 20.97.227.207 - [21/Jul/2026:22:17:01 +0200] "GET /assets/images/about.php HTTP/1.1" 404 153 "-" "-" 20.97.227.207 - [21/Jul/2026:22:17:00 +0200] "GET /wp-includes/random_compat/chosen.php HTTP/1.1" 404 153 "-" "-" 20.97.227.207 - [21/Jul/2026:22:17:00 +0200] "GET /wp-content/plugins/seoplugins/mar.php HTTP/1.1" 404 153 "-" "-" 20.97.227.207 - [21/Jul/2026:22:17:00 +0200] "GET /.well-knownold/inputs.php HTTP/1.1" 404 153 "-" "-" 20.97.227.207 - [21/Jul/2026:22:17:00 +0200] "GET /wp-admin/js/wp-conflg.php HTTP/1.1" 404 153 "-" "-" 20.97.227.207 - [21/Jul/2026:22:17:00 +0200] "GET show less	Web App Attack Hacking
🇧🇪 taivas.nl	2026-07-22 04:32:30 (2 hours ago)	Many_bad_calls	Web App Attack
🇲🇽 octageeks.com	2026-07-22 04:16:51 (2 hours ago)	Wordpress malicious attack:[octablocked]	Web App Attack
🇮🇳 walkintoadmin	2026-07-22 02:37:01 (4 hours ago)	wp_filemanager.php botnet scanner	Bad Web Bot Web App Attack
Anonymous	2026-07-22 02:36:13 (4 hours ago)	Backdrop CMS module - malicious activity detected	Bad Web Bot Web App Attack
🇳🇱 i-turnradio.nl	2026-07-22 01:27:58 (5 hours ago)	2026-07-22 @ 03:27:58 (CET) ~ Blocked for trying to access: /wp-content/plugins/hellopress/wp_filema ... show more 2026-07-22 @ 03:27:58 (CET) ~ Blocked for trying to access: /wp-content/plugins/hellopress/wp_filemanager.php show less	Web App Attack
🇩🇪 maxpower	2026-07-22 01:27:33 (5 hours ago)	(backdoor_scan) REGOLA 7 - Backdoor Scan Attempt 20.97.227.207 (US/United States/-): 1 in the last 3 ... show more (backdoor_scan) REGOLA 7 - Backdoor Scan Attempt 20.97.227.207 (US/United States/-): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: 20.97.227.207 - - [22/Jul/2026:03:27:30 +0200] "GET /wp-content/themes/seotheme/db.php?u HTTP/1.1" 301 307 "www.google.com" "Mozlila/5.0 (Linux; Android 7.0; SM-G892A Bulid/NRD90M; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/60.0.3112.107 Moblie Safari/537.36" "20.97.227.207" host=consorzioaet.it show less	Port Scan
🇵🇱 Roper123	2026-07-22 01:27:10 (5 hours ago)	WP-LOGIN brute-force	Brute-Force Web App Attack
🇵🇱 stareradia.pl	2026-07-22 01:24:26 (5 hours ago)	[Wed Jul 22 03:24:21.270903 2026] [php:error] [pid 2160868:tid 2160868] [client 20.97.227.207:0] scr ... show more [Wed Jul 22 03:24:21.270903 2026] [php:error] [pid 2160868:tid 2160868] [client 20.97.227.207:0] script '/var/www/html/this_is_a_new_hello_world.php' not found or unable to stat [Wed Jul 22 03:24:22.060268 2026] [php:error] [pid 2155759:tid 2155759] [client 20.97.227.207:0] script '/var/www/html/shell.php' not found or unable to stat [Wed Jul 22 03:24:25.804967 2026] [php:error] [pid 2160868:tid 2160868] [client 20.97.227.207:0] script '/var/www/html/browse.php' not found or unable to stat [Wed Jul 22 03:24:26.069927 2026] [php:error] [pid 2159090:tid 2159090] [client 20.97.227.207:0] script '/var/www/html/shell20211028.php' not found or unable to stat ... show less	Web App Attack
🇩🇪 Teufel100	2026-07-22 01:23:59 (5 hours ago)	ModSecurity rejected a query	Brute-Force Hacking Web App Attack
🇫🇷 Tilellit.PRO	2026-07-22 01:20:38 (5 hours ago)	Malicious web traffic detected by CrowdSec	Hacking
🇬🇷 setupgr	2026-07-22 01:18:59 (5 hours ago)	(PERMBLOCK) 20.97.227.207 (US/United States/Virginia/Boydton/-/[AS8075 MICROSOFT-CORP-MSN-AS-BLOCK]) ... show more (PERMBLOCK) 20.97.227.207 (US/United States/Virginia/Boydton/-/[AS8075 MICROSOFT-CORP-MSN-AS-BLOCK]) has had more than 4 temp blocks in the last 86400 secs; Ports: *; Direction: inout; Trigger: LF_PERMBLOCK_COUNT; Logs: N/A show less	Port Scan
🇺🇸 Rayulcifer	2026-07-22 01:18:38 (5 hours ago)	[Wed Jul 22 01:18:37.485445 2026] [authz_core:error] [pid 1283323:tid 124314942699200] [client 20.97 ... show more [Wed Jul 22 01:18:37.485445 2026] [authz_core:error] [pid 1283323:tid 124314942699200] [client 20.97.227.207:61656] AH01630: client denied by server configuration: proxy:http://localhost:4000/wp-content/plugins/hellopress/wp_filemanager.php [Wed Jul 22 01:18:37.497250 2026] [authz_core:error] [pid 1283323:tid 124315471177408] [client 20.97.227.207:61656] AH01630: client denied by server configuration: proxy:http://localhost:4000/this_is_a_new_hello_world.php [Wed Jul 22 01:18:37.510966 2026] [authz_core:error] [pid 1283323:tid 124319204095680] [client 20.97.227.207:61656] AH01630: client denied by server configuration: proxy:http://localhost:4000/wp-admin/images/wp-login.php [Wed Jul 22 01:18:37.516925 2026] [authz_core:error] [pid 1283323:tid 124314934306496] [client 20.97.227.207:61656] AH01630: client denied by server configuration: proxy:http://localhost:4000/wp-content/themes/astra/inc/network.php [Wed Jul 22 01:18:37.522625 2026] [authz_core:error] [pid 1283323:tid 12431814713926 ... show less	Brute-Force SSH

Showing 1 to 15 of 452 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇮🇩 202.145.0.112

🇨🇦 192.178.64.21

🇫🇷 91.231.89.129

🇧🇪 35.189.208.209

🇬🇧 2a06:4880:8000::a1

🇮🇳 203.193.150.244

🇮🇩 165.154.48.160

🇳🇱 160.119.71.92

🇮🇳 98.70.50.166

🇺🇦 82.207.17.254

🇬🇧 82.32.67.52

🇳🇱 77.239.124.239

🇺🇸 66.132.172.47

🇬🇧 51.195.244.27

🇵🇰 39.45.251.199

🇯🇵 8.216.0.135

🇬🇧 2.57.17.11

🇮🇸 213.181.107.100

🇳🇱 176.65.149.220

🇸🇬 165.245.189.161