JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

20.189.248.150

Recent Activity

Abuse Confidence Score

100% Critical

27 reports

26 reporters · latest 42 minutes ago

ISP: Microsoft Corporation
Usage Type: Data Center/Web Hosting/Transit
ASN: AS8075
Domain Name: microsoft.com
Country: 🇯🇵 Japan
City: Osaka, Osaka

ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report Whois

Example preview

Account required for the enhanced features Log in Sign up

Abuse Reports

Export reports CSV

Total reports

27 from 26 distinct reporters

First reported

November 4th 2026

Most recent report

42 minutes ago

Last 60 days

Top reporter locations 🇩🇪 Germany 8 🇳🇱 Netherlands 4 🇺🇸 United States of America 3

Most common categories Web App Attack 19 Hacking 7 Brute-Force 6 Port Scan 3 Bad Web Bot 2

Recent reports We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇺🇸 ne1for23	2026-11-08 05:21:05 UTC · (42 minutes ago)	Attempt to access invalid virtual host name (###.###.###.###). Typically used to access "internal" resources improperly exposed externally and "protected" only by a lack of external DNS resolution. 20.189.248.150 - - [08/Nov/2026:05:21:05 +0000] "G ... show more Attempt to access invalid virtual host name (###.###.###.###). Typically used to access "internal" resources improperly exposed externally and "protected" only by a lack of external DNS resolution. 20.189.248.150 - - [08/Nov/2026:05:21:05 +0000] "GET / HTTP/1.1" 403 555 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/84.0.4147.111 Safari/537.36" "-" show less	Hacking
🇳🇱 Savvii	2026-11-07 16:33:45 UTC · (13 hours ago)	20 attempts against mh-misbehave-ban on pavo	Brute-Force Bad Web Bot Web App Attack
Anonymous	2026-11-06 10:41:25 UTC · (1 day ago)	Http Port:80 (http_status:403) - Agent:Mozilla/5.0 (Windows NT 5.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.102 Safari/537.36	Web App Attack
🇸🇪 1337v411	2026-11-06 07:34:33 UTC · (1 day ago)	[2026-11-06T07:34:32+00:00] uri="/.env" ua="Mozilla/5.0 (Macintosh; Intel Mac OS X 10.8; rv:47.0) Gecko/20100101 Firefox/47.0" [2026-11-06T07:34:33+00:00] uri="/.env.example" ua="Mozilla/5.0 (Macintosh; Intel Mac OS X 10.8; rv:47.0) Gecko/20100101 Fi ... show more [2026-11-06T07:34:32+00:00] uri="/.env" ua="Mozilla/5.0 (Macintosh; Intel Mac OS X 10.8; rv:47.0) Gecko/20100101 Firefox/47.0" [2026-11-06T07:34:33+00:00] uri="/.env.example" ua="Mozilla/5.0 (Macintosh; Intel Mac OS X 10.8; rv:47.0) Gecko/20100101 Firefox/47.0" [2026-11-06T07:34:33+00:00] uri="/.env.development" ua="Mozilla/5.0 (Macintosh; Intel Mac OS X 10.8; rv:47.0) Gecko/20100101 Firefox/47.0" show less	Bad Web Bot Web App Attack
🇺🇸 jhuisi	2026-11-06 06:11:23 UTC · (1 day ago)	Mod Security Hit	Web App Attack
🇩🇪 AuthenticHowler	2026-11-06 04:58:37 UTC · (2 days ago)	HTTP request flood, nginx rate limit exceeded: 20 failed attempts. Banned 1h by fail2ban [nginx-limit-req]. Log evidence, own hostname redacted: limiting requests, excess: 10.920 by zone "perip", client: 20.189.248.150, server: _, request: "GET /.env ... show more HTTP request flood, nginx rate limit exceeded: 20 failed attempts. Banned 1h by fail2ban [nginx-limit-req]. Log evidence, own hostname redacted: limiting requests, excess: 10.920 by zone "perip", client: 20.189.248.150, server: _, request: "GET /.env.yml HTTP/1.1", host: "212.95.40.132" \| limiting requests, excess: 10.630 by zone "perip", client: 20.189.248.150, server: _, request: "GET /.env~ HTTP/1.1", host: "212.95.40.132" \| limiting requests, excess: 10.510 by zone "perip", client: 20.189.248.150, server: _, request: "GET /bootstrap/cache/config.php HTTP/1.1", host: "212.95.40.132" \| limiting requests, excess: 10.410 by zone "perip", client: 20.189.248.150, server: _, request: "GET /bootstrap/cache/services.php HTTP/1.1", host: "212.95.40.132" show less	DDoS Attack
🇩🇪 Mr-Money	2026-11-06 04:56:44 UTC · (2 days ago)	scenario: crowdsecurity/http-sensitive-files - events: 5	Web App Attack Hacking
Anonymous	2026-11-06 02:34:03 UTC · (2 days ago)	(mod_security) mod_security triggered on hostname [redacted]): (CF_ENABLE)	SQL Injection
Anonymous	2026-11-06 00:46:21 UTC · (2 days ago)	20.189.248.150 - - [06/Nov/2026:01:46:20 +0100] "GET /.env.test HTTP/1.1" 301 162 "-" "Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 5.1; Trident/6.0)" ...	Brute-Force Web App Attack
🇨🇦 Mediashaker	2026-11-05 20:22:17 UTC · (2 days ago)	(mod_security) mod_security triggered on hostname [redacted] 20.189.248.150 (JP/Japan/-)	SQL Injection
🇩🇪 YF	2026-11-05 20:00:19 UTC · (2 days ago)	404 errors Vulnerability scan	Web App Attack
🇧🇬 Ilcheff	2026-11-05 17:32:44 UTC · (2 days ago)	Web scan (probing for sensitive files, CrowdSec http-sensitive-files): requests from 20.189.248.150 [JP, AS8075 Microsoft Corporation] to a web server.	Web App Attack
🇧🇷 diego	2026-11-05 17:21:11 UTC · (2 days ago)	[probe-168-134] 2026-11-05 17:04:57, Client: 20.189.248.150, Protocol: 6, Unauthorized activity to HTTP: GET /	Web App Attack
🇫🇷 dynamix	2026-11-05 15:46:24 UTC · (2 days ago)	Multiple WAF Violations	Web App Attack
🇩🇪 maxpower	2026-11-05 09:06:33 UTC · (2 days ago)	(nginx_hardened) REGOLA 3 - Nginx Hardening Triggered 20.189.248.150 (JP/Japan/-): 3 in the last 3600 secs; Ports: ; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: 20.189.248.150 - - [05/Nov/2026:10:06:24 +0100] "GET /storage/logs/laravel-2026-1 ... show more (nginx_hardened) REGOLA 3 - Nginx Hardening Triggered 20.189.248.150 (JP/Japan/-): 3 in the last 3600 secs; Ports: ; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: 20.189.248.150 - - [05/Nov/2026:10:06:24 +0100] "GET /storage/logs/laravel-2026-11-04.log HTTP/1.1" 403 146 "-" "Mozilla/5.0 (X11; Ubuntu; Linux i686 on x86_64; rv:47.0) Gecko/20100101 Firefox/47.0" "-" host=51.77.95.119 20.189.248.150 - - [05/Nov/2026:10:06:24 +0100] "GET /storage/logs/laravel-2026-11-03.log HTTP/1.1" 403 146 "-" "Mozilla/5.0 (X11; Ubuntu; Linux i686 on x86_64; rv:47.0) Gecko/20100101 Firefox/47.0" "-" host=51.77.95.119 2026/11/05 10:06:27 [error] 1174583#1174583: *3411251 access forbidden by rule, client: 20.189.248.150, server: archabi.it, request: "GET /bootstrap/cache/config.php HTTP/1.1", host: "51.77.95.119" show less	Port Scan

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown

Recently Reported IPs:

🇦🇹 185.24.11.169

🇯🇵 103.125.146.49

🇸🇮 102.220.160.173

🇺🇸 66.132.159.37

🇯🇵 51.241.75.14

🇷🇺 37.29.47.125

🇰🇷 222.110.19.24

🇺🇸 199.165.159.222

🇨🇳 183.66.166.30

🇩🇪 164.92.200.161

🇯🇵 103.125.146.34

🇧🇷 96.126.138.173

🇧🇷 80.174.191.205

🇺🇸 65.49.1.15

🇰🇷 59.22.201.143

🇨🇿 45.145.221.107

🇷🇺 2a02:6b8::1:127

🇨🇳 223.83.108.169

🇻🇳 171.226.12.127

🇺🇸 147.78.183.103