JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 20.194.2.112

20.194.2.112 was found in our database!

This IP was reported 37 times. Confidence of Abuse is 100%: ?

100%

ISP	Microsoft Corporation
Usage Type	Data Center/Web Hosting/Transit
ASN	AS8075
Domain Name	microsoft.com
Country	🇰🇷 Korea (the Republic of)
City	Seoul, Seoul

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 20.194.2.112

Whois 20.194.2.112

IP Abuse Reports for 20.194.2.112:

This IP address has been reported a total of 37 times from 35 distinct sources. 20.194.2.112 was first reported on September 3rd 2026, and the most recent report was 3 minutes ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇷🇴 clauss	2026-09-03 20:05:08 (3 minutes ago)	20.194.2.112 - - [03/Sep/2026:23:04:55 +0300] "GET /1.php HTTP/2.0" 404 11818 "-" "Mozilla/5.0 (Wind ... show more 20.194.2.112 - - [03/Sep/2026:23:04:55 +0300] "GET /1.php HTTP/2.0" 404 11818 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.194.2.112 - - [03/Sep/2026:23:05:08 +0300] "GET /xleet.php HTTP/2.0" 404 11818 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" ... show less	Web App Attack
🇳🇱 middelkoopcc	2026-09-03 20:05:01 (3 minutes ago)	2026-09-03 21:52:31 GET /autoload_classmap.php [404] && 2026-09-03 21:52:31 GET /post.php [404] && 2 ... show more 2026-09-03 21:52:31 GET /autoload_classmap.php [404] && 2026-09-03 21:52:31 GET /post.php [404] && 2026-09-03 21:52:31 GET /1.php [404] && 450 more within 20 minutes show less	Web App Attack
🇵🇱 strefapi_com	2026-09-03 19:59:33 (9 minutes ago)	Brute-force, web ...	Hacking Brute-Force Web App Attack
🇩🇪 maxpower	2026-09-03 19:53:40 (15 minutes ago)	(aggressive_scanner) REGOLA 9 - Aggressive Web Scanner 20.194.2.112 (KR/South Korea/-): 1 in the las ... show more (aggressive_scanner) REGOLA 9 - Aggressive Web Scanner 20.194.2.112 (KR/South Korea/-): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: 20.194.2.112 - - [03/Sep/2026:21:53:35 +0200] "GET /1.php HTTP/1.1" 200 4728 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" "-" host=gabriellaciammaichella.com show less	Port Scan
🇺🇸 antlac1	2026-09-03 19:49:51 (18 minutes ago)	crowdsecurity/http-backdoors-attempts	Brute-Force Web App Attack
🇩🇪 ger-stg-sifi1	2026-09-03 19:46:48 (21 minutes ago)	(wordpress) Failed wordpress login using wp-login.php or xmlrpc.php	Web App Attack
🇩🇪 macrob	2026-09-03 19:43:09 (25 minutes ago)	2026/09/03 19:42:47 [error] 4192103#4192103: 553111122 access forbidden by rule, client: 20.194.2.1 ... show more 2026/09/03 19:42:47 [error] 4192103#4192103: 553111122 access forbidden by rule, client: 20.194.2.112, server: binixo.co, request: "GET /admin.php HTTP/1.1", host: "binixo.co" 2026/09/03 19:43:04 [error] 4192103#4192103: 553111122 access forbidden by rule, client: 20.194.2.112, server: binixo.co, request: "GET /xmlrpc.php HTTP/1.1", host: "binixo.co" 2026/09/03 19:43:07 [error] 4192103#4192103: 553111122 access forbidden by rule, client: 20.194.2.112, server: binixo.co, request: "GET /wp-admin.php HTTP/1.1", host: "binixo.co" ... show less	Web App Attack
🇩🇪 FeG Deutschland	2026-09-03 19:42:55 (25 minutes ago)	Looking for CMS/PHP/SQL vulnerablilities/excessive crawling - 24	Exploited Host Web App Attack
🇧🇾 lns.bz	2026-09-03 19:42:36 (26 minutes ago)	Too many 404 requests [BY]	Web App Attack
🇫🇮 paissangroup	2026-09-03 19:40:47 (27 minutes ago)	Multiple WAF Violations	Web App Attack
Anonymous	2026-09-03 19:39:01 (29 minutes ago)	20.194.2.112 - - [03/Sep/2026:21:35:22 +0200] "GET /autoload_classmap.php HTTP/1.1" 404 4886 "-" "Mo ... show more 20.194.2.112 - - [03/Sep/2026:21:35:22 +0200] "GET /autoload_classmap.php HTTP/1.1" 404 4886 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.194.2.112 - - [03/Sep/2026:21:35:23 +0200] "GET /post.php HTTP/1.1" 404 360 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.194.2.112 - - [03/Sep/2026:21:35:23 +0200] "GET /1.php HTTP/1.1" 404 360 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.194.2.112 - - [03/Sep/2026:21:35:23 +0200] "GET /flower.php HTTP/1.1" 404 360 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.194.2.112 - - [03/Sep/2026:21:35:24 +0200] "GET /admin.php HTTP/1.1" 404 360 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 2 ... show less	DDoS Attack
🇦🇺 rubixstudios	2026-09-03 19:29:02 (39 minutes ago)	Excessive HTTP requests consistent with automated attack behaviour detected by Imunify360	DDoS Attack Brute-Force Web App Attack
🇮🇹 madaello	2026-09-03 19:25:25 (43 minutes ago)	20.194.2.112 - - [03/Sep/2026:21:25:22 +0200] "GET /autoload_classmap.php HTTP/1.1" 404 4227 "-" "Mo ... show more 20.194.2.112 - - [03/Sep/2026:21:25:22 +0200] "GET /autoload_classmap.php HTTP/1.1" 404 4227 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.194.2.112 - - [03/Sep/2026:21:25:22 +0200] "GET /post.php HTTP/1.1" 404 267 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.194.2.112 - - [03/Sep/2026:21:25:23 +0200] "GET /1.php HTTP/1.1" 404 267 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.194.2.112 - - [03/Sep/2026:21:25:23 +0200] "GET /flower.php HTTP/1.1" 404 267 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.194.2.112 - - [03/Sep/2026:21:25:24 +0200] "GET /admin.php HTTP/1.1" 404 267 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" ... show less	Port Scan
🇨🇭 zynex	2026-09-03 19:21:57 (46 minutes ago)	URL Probing: /autoload_classmap.php	Web App Attack
🇨🇭 4server	2026-09-03 19:20:34 (48 minutes ago)	[ThuSep0321:20:30.2313602026][security2:error][pid1411621:tid1412041][client20.194.2.112:0]ModSecuri ... show more [ThuSep0321:20:30.2313602026][security2:error][pid1411621:tid1412041][client20.194.2.112:0]ModSecurity:Accessdeniedwithcode403\(phase1\).Stringmatch\"/xmlrpc.php\"atREQUEST_URI.[file\"/etc/apache2/conf.d/modsec_custom_rules.conf\"][line\"614\"][id\"960024\"][msg\"XML-RPCdisabled\"][hostname\"webdisk.aidconsultancy.ch\"][uri\"/xmlrpc.php\"][unique_id\"apnIflxB9MeRANicPyk9twAAAQ8\"] show less	Hacking Web App Attack

Showing 1 to 15 of 37 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇧🇷 179.148.218.12

🇬🇧 165.22.115.137

🇭🇰 157.254.191.103

🇺🇸 147.185.132.117

🇮🇷 95.38.179.72

🇹🇷 94.154.43.214

🇹🇷 5.181.87.33

🇨🇳 219.131.11.234

🇺🇸 195.184.76.97

🇦🇫 180.94.76.126

🇨🇳 112.94.252.222

🇫🇮 74.125.46.30

🇮🇶 65.20.131.212

🇷🇺 31.128.37.67

🇰🇿 178.91.82.213

🇺🇸 162.216.150.184

🇺🇸 162.216.149.103

🇺🇸 136.66.56.237

🇰🇷 125.130.102.172

🇭🇰 113.253.65.76