Dashboard›🇨🇦 Canada›20.63.83.113
ABUSE.MOM
THREAT REPORT

IP Threat Report
20.63.83.113

ABUSE.MOM — BEHAVE OR GET EXPOSED

Generated: 2026-05-30 08:05:28
First seen: 2026-02-26 15:00:15
Last seen: 2026-04-01 05:00:07
280

⛔ Verdict: BLOCK

This IP address has been classified as a source of malicious automated activity. Threat score: 280/100. Total malicious requests observed: 1053.

UA_SUSDANGER_PATHBURSTRATIO_404REDIRECT_PROBE
01

Geolocation & Classification

IP Address
20.63.83.113
Type
Hosting
Country
🇨🇦 Canada
City
Toronto
ISP
Microsoft Corporation
Organization
Microsoft Azure Cloud (canadacentral)
Autonomous System
AS8075 Microsoft Corporation
Hit Count
1053
02

Detection Signatures

SignatureDescriptionPointsSeverity
UA suspicious (short/empty)Behavioral anomaly detected by automated analysis+15
Danger strong hits: 56High-risk paths: shells, RCE vectors, exploits+100
Danger medium hits: 594Medium-risk: admin panels, config files+60
Burst: 48 req / 2sAbnormally fast request rate — automated scanning+35
Burst: 175 req / 10sAbnormally fast request rate — automated scanning+35
Danger strong hits: 18High-risk paths: shells, RCE vectors, exploits+100
Danger medium hits: 196Medium-risk: admin panels, config files+60
Burst: 23 req / 2sAbnormally fast request rate — automated scanning+35
Burst: 77 req / 10sAbnormally fast request rate — automated scanning+35
Danger strong hits: 21High-risk paths: shells, RCE vectors, exploits+100
Danger medium hits: 198Medium-risk: admin panels, config files+60
Burst: 22 req / 2sAbnormally fast request rate — automated scanning+35
Burst: 72 req / 10sAbnormally fast request rate — automated scanning+35
Danger strong hits: 24High-risk paths: shells, RCE vectors, exploits+100
Danger medium hits: 291Medium-risk: admin panels, config files+60
Burst: 21 req / 2sAbnormally fast request rate — automated scanning+35
Burst: 69 req / 10sAbnormally fast request rate — automated scanning+35
Burst: 24 req / 2sAbnormally fast request rate — automated scanning+35
Burst: 88 req / 10sAbnormally fast request rate — automated scanning+35
Burst: 85 req / 10sAbnormally fast request rate — automated scanning+35
Burst: 71 req / 10sAbnormally fast request rate — automated scanning+35
Burst: 82 req / 10sAbnormally fast request rate — automated scanning+35
Burst: 86 req / 10sAbnormally fast request rate — automated scanning+35
Burst: 84 req / 10sAbnormally fast request rate — automated scanning+35
Danger strong hits: 14High-risk paths: shells, RCE vectors, exploits+100
404 ratio 40-60%Majority of requests returned 404 — enumeration+15
Probe pattern 302->404 same pathBehavioral anomaly detected by automated analysis+20
Burst: 83 req / 10sAbnormally fast request rate — automated scanning+35
Danger strong hits: 8High-risk paths: shells, RCE vectors, exploits+100
Danger medium hits: 57Medium-risk: admin panels, config files+60
Danger strong hits: 6High-risk paths: shells, RCE vectors, exploits+100
Danger medium hits: 38Medium-risk: admin panels, config files+60
Danger strong hits: 4High-risk paths: shells, RCE vectors, exploits+100
Burst: 40 req / 10sAbnormally fast request rate — automated scanning+35
Burst: 75 req / 10sAbnormally fast request rate — automated scanning+35
Burst: 73 req / 10sAbnormally fast request rate — automated scanning+35
Burst: 60 req / 10sAbnormally fast request rate — automated scanning+35
Burst: 76 req / 10sAbnormally fast request rate — automated scanning+35
Burst: 80 req / 10sAbnormally fast request rate — automated scanning+35
Burst: 18 req / 2sAbnormally fast request rate — automated scanning+35
Burst: 59 req / 10sAbnormally fast request rate — automated scanning+35
Danger strong hits: 2High-risk paths: shells, RCE vectors, exploits+50
Danger medium hits: 19Medium-risk: admin panels, config files+60
404 ratio >= 60%Majority of requests returned 404 — enumeration+25
Burst: 9 req / 2sAbnormally fast request rate — automated scanning+35
Burst: 16 req / 10sAbnormally fast request rate — automated scanning+35
Burst: 79 req / 10sAbnormally fast request rate — automated scanning+35
Burst: 87 req / 10sAbnormally fast request rate — automated scanning+35
Burst: 81 req / 10sAbnormally fast request rate — automated scanning+35
Danger medium hits: 62Medium-risk: admin panels, config files+60
Burst: 62 req / 10sAbnormally fast request rate — automated scanning+35
Danger strong hits: 9High-risk paths: shells, RCE vectors, exploits+100
Danger strong hits: 12High-risk paths: shells, RCE vectors, exploits+100
Danger medium hits: 93Medium-risk: admin panels, config files+60
Burst: 74 req / 10sAbnormally fast request rate — automated scanning+35
Danger strong hits: 1High-risk paths: shells, RCE vectors, exploits+25
Danger medium hits: 1Medium-risk: admin panels, config files+10
Burst: 78 req / 10sAbnormally fast request rate — automated scanning+35
Danger medium hits: 60Medium-risk: admin panels, config files+60
Burst: 58 req / 10sAbnormally fast request rate — automated scanning+35
Danger strong hits: 7High-risk paths: shells, RCE vectors, exploits+100
Danger medium hits: 56Medium-risk: admin panels, config files+60
Danger medium hits: 90Medium-risk: admin panels, config files+60
Danger medium hits: 58Medium-risk: admin panels, config files+60
Danger medium hits: 85Medium-risk: admin panels, config files+60
Danger medium hits: 89Medium-risk: admin panels, config files+60
Danger medium hits: 2Medium-risk: admin panels, config files+20
Danger strong hits: 3High-risk paths: shells, RCE vectors, exploits+75
Danger medium hits: 30Medium-risk: admin panels, config files+60
Burst: 30 req / 10sAbnormally fast request rate — automated scanning+35
Burst: 56 req / 10sAbnormally fast request rate — automated scanning+35
Burst: 20 req / 2sAbnormally fast request rate — automated scanning+35
Danger medium hits: 103Medium-risk: admin panels, config files+60
Burst: 57 req / 10sAbnormally fast request rate — automated scanning+35
Danger medium hits: 52Medium-risk: admin panels, config files+60
Burst: 54 req / 10sAbnormally fast request rate — automated scanning+35
Danger medium hits: 152Medium-risk: admin panels, config files+60
Burst: 63 req / 10sAbnormally fast request rate — automated scanning+35
Burst: 70 req / 10sAbnormally fast request rate — automated scanning+35
Burst: 68 req / 10sAbnormally fast request rate — automated scanning+35
Danger medium hits: 155Medium-risk: admin panels, config files+60
Danger medium hits: 102Medium-risk: admin panels, config files+60
Danger medium hits: 151Medium-risk: admin panels, config files+60
Danger medium hits: 47Medium-risk: admin panels, config files+60
Danger medium hits: 97Medium-risk: admin panels, config files+60
Danger medium hits: 154Medium-risk: admin panels, config files+60
Danger medium hits: 6Medium-risk: admin panels, config files+60
Burst: 6 req / 2sAbnormally fast request rate — automated scanning+35
Danger medium hits: 156Medium-risk: admin panels, config files+60
Burst: 67 req / 10sAbnormally fast request rate — automated scanning+35
Burst: 65 req / 10sAbnormally fast request rate — automated scanning+35
Danger strong hits: 5High-risk paths: shells, RCE vectors, exploits+100
Danger medium hits: 4Medium-risk: admin panels, config files+40
Burst: 8 req / 2sAbnormally fast request rate — automated scanning+35
Danger medium hits: 9Medium-risk: admin panels, config files+60
Burst: 5 req / 2sAbnormally fast request rate — automated scanning+35
Burst: 12 req / 2sAbnormally fast request rate — automated scanning+35
Burst: 12 req / 10sAbnormally fast request rate — automated scanning+35
Burst: 11 req / 2sAbnormally fast request rate — automated scanning+35
Burst: 10 req / 2sAbnormally fast request rate — automated scanning+35
Danger strong hits: 20High-risk paths: shells, RCE vectors, exploits+100
Danger medium hits: 41Medium-risk: admin panels, config files+60
Burst: 41 req / 10sAbnormally fast request rate — automated scanning+35
Danger strong hits: 31High-risk paths: shells, RCE vectors, exploits+100
Danger medium hits: 42Medium-risk: admin panels, config files+60
Danger strong hits: 10High-risk paths: shells, RCE vectors, exploits+100
Danger medium hits: 21Medium-risk: admin panels, config files+60
Burst: 19 req / 2sAbnormally fast request rate — automated scanning+35
Burst: 21 req / 10sAbnormally fast request rate — automated scanning+35
Danger strong hits: 30High-risk paths: shells, RCE vectors, exploits+100
Burst: 61 req / 10sAbnormally fast request rate — automated scanning+35
Danger medium hits: 63Medium-risk: admin panels, config files+60
Burst: 44 req / 10sAbnormally fast request rate — automated scanning+35
Burst: 66 req / 10sAbnormally fast request rate — automated scanning+35
Danger medium hits: 32Medium-risk: admin panels, config files+60
Burst: 32 req / 10sAbnormally fast request rate — automated scanning+35
Danger medium hits: 10Medium-risk: admin panels, config files+60
Burst: 64 req / 10sAbnormally fast request rate — automated scanning+35
Burst: 22 req / 10sAbnormally fast request rate — automated scanning+35
Danger medium hits: 36Medium-risk: admin panels, config files+60
Burst: 36 req / 10sAbnormally fast request rate — automated scanning+35
Danger medium hits: 50Medium-risk: admin panels, config files+60
Burst: 50 req / 10sAbnormally fast request rate — automated scanning+35
Burst: 7 req / 2sAbnormally fast request rate — automated scanning+35
Burst: 10 req / 10sAbnormally fast request rate — automated scanning+35
Danger medium hits: 3Medium-risk: admin panels, config files+30
Burst: 28 req / 10sAbnormally fast request rate — automated scanning+35
Burst: 26 req / 10sAbnormally fast request rate — automated scanning+35
Danger medium hits: 14Medium-risk: admin panels, config files+60
Burst: 14 req / 2sAbnormally fast request rate — automated scanning+35
Burst: 14 req / 10sAbnormally fast request rate — automated scanning+35
Burst: 13 req / 2sAbnormally fast request rate — automated scanning+35
Burst: 24 req / 10sAbnormally fast request rate — automated scanning+35
Danger medium hits: 7Medium-risk: admin panels, config files+60
Burst: 15 req / 2sAbnormally fast request rate — automated scanning+35
Burst: 20 req / 10sAbnormally fast request rate — automated scanning+35
Burst: 17 req / 2sAbnormally fast request rate — automated scanning+35
Burst: 17 req / 10sAbnormally fast request rate — automated scanning+35
Burst: 13 req / 10sAbnormally fast request rate — automated scanning+35
Danger medium hits: 13Medium-risk: admin panels, config files+60
Danger medium hits: 88Medium-risk: admin panels, config files+60
Danger medium hits: 132Medium-risk: admin panels, config files+60
Danger medium hits: 44Medium-risk: admin panels, config files+60
Burst: 45 req / 10sAbnormally fast request rate — automated scanning+35
Danger medium hits: 96Medium-risk: admin panels, config files+60
Danger medium hits: 48Medium-risk: admin panels, config files+60
Danger medium hits: 144Medium-risk: admin panels, config files+60
Danger medium hits: 94Medium-risk: admin panels, config files+60
Danger strong hits: 16High-risk paths: shells, RCE vectors, exploits+100
Danger medium hits: 141Medium-risk: admin panels, config files+60
Danger medium hits: 75Medium-risk: admin panels, config files+60
Danger strong hits: 60High-risk paths: shells, RCE vectors, exploits+100
Danger medium hits: 122Medium-risk: admin panels, config files+60
Danger strong hits: 45High-risk paths: shells, RCE vectors, exploits+100
Danger medium hits: 80Medium-risk: admin panels, config files+60
Danger medium hits: 84Medium-risk: admin panels, config files+60
Danger strong hits: 36High-risk paths: shells, RCE vectors, exploits+100
Danger medium hits: 72Medium-risk: admin panels, config files+60
Danger medium hits: 110Medium-risk: admin panels, config files+60
Danger medium hits: 17Medium-risk: admin panels, config files+60
Burst: 52 req / 10sAbnormally fast request rate — automated scanning+35
Danger medium hits: 66Medium-risk: admin panels, config files+60
Danger medium hits: 27Medium-risk: admin panels, config files+60
Danger medium hits: 135Medium-risk: admin panels, config files+60
Burst: 48 req / 10sAbnormally fast request rate — automated scanning+35
Danger medium hits: 20Medium-risk: admin panels, config files+60
Danger medium hits: 92Medium-risk: admin panels, config files+60
Danger medium hits: 174Medium-risk: admin panels, config files+60
Danger strong hits: 15High-risk paths: shells, RCE vectors, exploits+100
Danger medium hits: 101Medium-risk: admin panels, config files+60
Danger medium hits: 73Medium-risk: admin panels, config files+60
Danger medium hits: 202Medium-risk: admin panels, config files+60
Danger medium hits: 161Medium-risk: admin panels, config files+60
Σ = 8960
03

Observed Activity

Reconstructed HTTP requests from server access logs. Target domains redacted for security.

[redacted]
GET
/
200
[redacted]
GET
/page
200
Requests shown: 2 · HTTP 404: 0 · Dangerous patterns: 0

* Typical request patterns for detected signatures. Actual target domains are redacted.

04

Timeline

2026-02-26 15:00:15
First malicious request detected
IP entered monitoring from server access logs
During observation
Multiple detection signatures triggered
UA suspicious (short/empty) (+15), Danger strong hits: 56 (+100), Danger medium hits: 594 (+60)
2026-04-01 05:00:07
Last malicious request observed
Total score reached: 280/100
Next cycle
IP blocked — all subsequent requests denied (HTTP 403)
Added to blocklist automatically
05

Network Provider

Microsoft Corporation
AS8075 · 🇨🇦 Canada
06

Recommendations

Actions taken & recommended

  • IP 20.63.83.113 is blocked at application level (HTTP 403)
  • Consider blocking at firewall level (iptables/CSF) to reduce server load
  • Report abuse to the network provider via their abuse contact
  • Ensure sensitive files (.env, .git, backups) are not accessible from the web

🤖 Bot Detection

Address UA spoofing from 20.63.83.113: maintain blocklist of known malicious UA strings, require consistent UA across sessions, implement TLS fingerprinting.

🌊 Flood / DDoS Mitigation

Implement limit_req_zone in nginx. Deploy CDN with DDoS protection. Configure SYN cookies and connection tracking to throttle 20.63.83.113.

🔎 Directory Scan Defense

IP 20.63.83.113 is enumerating directories. Configure fail2ban apache-404 jail after 10+ 404 errors. Disable directory listings. Normalize all 404 responses.

09

Blacklist Status (DNSBL)

This IP was checked against major DNS-based blacklists used by mail servers and firewalls worldwide.

⛔ LISTED
Spamhaus ZEN

Checked: Spamhaus, SpamCop, Barracuda, SORBS, CBL, UCEProtect. Results may change over time.

10

Threat Analysis

20.63.83.113 has been assigned a threat score of 280/100 (Critical). This is a critical-level threat. Systems administrators should treat this IP as hostile and block all inbound connections without exception.

The following attack categories were identified:

User-Agent AnomalyRequest FloodingPath Enumeration

📊 Threat Analysis

The address 20.63.83.113 originates from Toronto, Canada, operating on the network of Microsoft Corporation. It was identified through automated analysis of incoming network traffic across monitored endpoints. During its 33-day observation window, we recorded 1,053 hostile requests from this IP — roughly 31.9 per day on average. This address belongs to a datacenter or cloud hosting provider. Hosting IPs are frequently leveraged by threat actors who rent cheap VPS instances specifically for conducting attacks. The diversity of 3 separate attack methods suggests a comprehensive attack toolkit — likely an automated scanner that tests for vulnerabilities across multiple categories. With 110 flagged addresses, Canada represents a significant presence in our threat database. A score of 280/100 places this address in the top tier of severity. Block and investigate any historical connections.

This IP belongs to a hosting or data center provider. Malicious traffic from hosting infrastructure often originates from compromised VPS instances, rented servers used for scanning campaigns, or abused free-tier cloud accounts. Hosting providers typically respond to abuse reports within 24-72 hours.

11

Related Threats

🇨🇦 Top threats from Canada

20.151.111.128 (308)45.91.23.64 (305)147.15.149.40 (300)148.116.72.171 (300)89.251.0.24 (295)View all →

🏢 Same network: AS8075

20.151.111.128 (308)4.205.39.97 (283)20.63.36.125 (280)20.151.220.171 (280)20.104.114.39 (280)View all →
12

Security Intelligence

💡 HTTP Header Analysis for Threat Detection

Examining HTTP headers beyond User-Agent reveals attack tools and automated scripts. Missing standard headers, unusual ordering, non-standard values, and inconsistencies with claimed client identity all serve as reliable detection signals.

💡 Privacy-Preserving Threat Detection

Advanced techniques enable threat detection while minimizing privacy impact. Encrypted DNS, differential privacy in analytics, and federated learning for threat models allow effective security monitoring without unnecessary surveillance of legitimate user behavior.

🔍 Check Any IP Address

Share this report:
AboutDisclaimerTermsAbuse Reports Tracker
Report generated 30.05.2026 08:05
Behave or get exposed