JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 20.194.96.223

20.194.96.223 was found in our database!

This IP was reported 1,284 times. Confidence of Abuse is 100%: ?

100%

ISP	Microsoft Corporation
Usage Type	Data Center/Web Hosting/Transit
ASN	AS8075
Domain Name	microsoft.com
Country	🇰🇷 Korea (the Republic of)
City	Seoul, Seoul

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 20.194.96.223

Whois 20.194.96.223

IP Abuse Reports for 20.194.96.223:

This IP address has been reported a total of 1,284 times from 675 distinct sources. 20.194.96.223 was first reported on October 12th 2026, and the most recent report was 1 hour ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇩🇪 svr	2026-10-17 17:29:54 (1 hour ago)	Abusive Automated Web Scanner	Web App Attack
🇫🇷 guillaume illien	2026-10-17 17:13:13 (1 hour ago)	20.194.96.223 - - [17/Oct/2026:17:13:05 +0000] "GET /wp-content/plugins/hellopress/wp_filemanager.ph ... show more 20.194.96.223 - - [17/Oct/2026:17:13:05 +0000] "GET /wp-content/plugins/hellopress/wp_filemanager.php HTTP/1.1" 301 178 "-" "-" 20.194.96.223 - - [17/Oct/2026:17:13:09 +0000] "GET /this_is_a_new_hello_world.php HTTP/1.1" 301 178 "-" "-" 20.194.96.223 - - [17/Oct/2026:17:13:10 +0000] "GET /tpg-contato.php HTTP/1.1" 301 178 "-" "-" 20.194.96.223 - - [17/Oct/2026:17:13:10 +0000] "GET /init-notica.php HTTP/1.1" 301 178 "-" "-" 20.194.96.223 - - [17/Oct/2026:17:13:11 +0000] "GET /myglu.php HTTP/1.1" 301 178 "-" "-" 20.194.96.223 - - [17/Oct/2026:17:13:12 +0000] "GET /as.php HTTP/1.1" 301 178 "-" "-" 20.194.96.223 - - [17/Oct/2026:17:13:13 +0000] "GET /wp-ainefgskk.php HTTP/1.1" 301 178 "-" "-" ... show less	Hacking Brute-Force Web App Attack SSH
🇩🇪 usc-IPDB	2026-10-17 17:02:08 (1 hour ago)	20.194.96.223 - - [17/Oct/2026:19:02:06 +0200] "GET /wp-content/plugins/hellopress/wp_filemanager.ph ... show more 20.194.96.223 - - [17/Oct/2026:19:02:06 +0200] "GET /wp-content/plugins/hellopress/wp_filemanager.php HTTP/1.1" 301 162 "-" "-" 20.194.96.223 - - [17/Oct/2026:19:02:07 +0200] "GET /wp-content/plugins/hellopress/wp_filemanager.php HTTP/1.1" 404 146 "-" "-" 20.194.96.223 - - [17/Oct/2026:19:02:07 +0200] "GET /this_is_a_new_hello_world.php HTTP/1.1" 301 162 "-" "-" ... show less	Port Scan
Anonymous	2026-10-17 16:54:35 (1 hour ago)	wp admin page access attempt ...	Hacking Web App Attack
🇩🇪 hchristo	2026-10-17 16:48:23 (1 hour ago)	[Sat Oct 17 18:48:21.085889 2026] [proxy_fcgi:error] [pid 667:tid 732] [client 20.194.96.223:19191] ... show more [Sat Oct 17 18:48:21.085889 2026] [proxy_fcgi:error] [pid 667:tid 732] [client 20.194.96.223:19191] AH01071: Got error 'Primary script unknown' [Sat Oct 17 18:48:21.583023 2026] [proxy_fcgi:error] [pid 667:tid 740] [client 20.194.96.223:19191] AH01071: Got error 'Primary script unknown' [Sat Oct 17 18:48:22.729407 2026] [proxy_fcgi:error] [pid 667:tid 773] [client 20.194.96.223:19191] AH01071: Got error 'Primary script unknown' [Sat Oct 17 18:48:23.204760 2026] [proxy_fcgi:error] [pid 667:tid 748] [client 20.194.96.223:19191] AH01071: Got error 'Primary script unknown' [Sat Oct 17 18:48:23.677026 2026] [proxy_fcgi:error] [pid 667:tid 734] [client 20.194.96.223:19191] AH01071: Got error 'Primary script unknown' ... show less	Brute-Force
🇦🇺 Lawtro	2026-10-17 16:18:49 (2 hours ago)	{"level":"error","ts":1792253928.0916812,"logger":"http.log.access.log1","msg":"handled request","re ... show more {"level":"error","ts":1792253928.0916812,"logger":"http.log.access.log1","msg":"handled request","request":{"remote_ip":"20.194.96.223","remote_port":"10375","proto":"HTTP/1.1","method":"GET","host":"weddingcakeswhitsunday.com.au","uri":"/wp-content/plugins/hellopress/wp_filemanager.php","headers":{},"tls":{"resumed":false,"version":772,"cipher_suite":4865,"proto":"","server_name":"weddingcakeswhitsunday.com.au"}},"user_id":"","duration":0.000141997,"size":15,"status":403,"resp_headers":{"Alt-Svc":["h3=\":443\"; ma=2592000"],"Content-Type":["text/plain; charset=utf-8"]}} {"level":"error","ts":1792253928.365896,"logger":"http.log.access.log1","msg":"handled request","request":{"remote_ip":"20.194.96.223","remote_port":"10375","proto":"HTTP/1.1","method":"GET","host":"weddingcakeswhitsunday.com.au","uri":"/this_is_a_new_hello_world.php","headers":{},"tls":{"resumed":false,"version":772,"cipher_suite":4865,"proto":"","server_name":"weddingcakeswhitsunday.com.au"}},"user_id":"","duration": ... show less	Bad Web Bot Web App Attack
🇸🇬 khairilgunawan	2026-10-17 16:05:08 (2 hours ago)	ZonaKuota Sentinel: Malicious automated scanner/exploit probe trapped. Blocked.	Web App Attack Bad Web Bot
🇦🇺 CalmBrain	2026-10-17 16:00:42 (2 hours ago)	This IP was detected by CrowdSec triggering crowdsecurity/http-crawl-non_statics	Web App Attack Bad Web Bot
🇸🇬 fazar	2026-10-17 16:00:16 (2 hours ago)	bad-behavior: 10 attempts from 20.194.96.223 on node: sgp01	Exploited Host Web App Attack
🇩🇪 macrob	2026-10-17 15:56:49 (2 hours ago)	2026/10/17 15:56:25 [error] 1186588#1186588: 8539033 access forbidden by rule, client: 20.194.96.22 ... show more 2026/10/17 15:56:25 [error] 1186588#1186588: 8539033 access forbidden by rule, client: 20.194.96.223, server: binixo.es, request: "GET /wp-content/plugins/hellopress/wp_filemanager.php HTTP/1.1", host: "binixo.es" 2026/10/17 15:56:32 [error] 1186588#1186588: 8539033 access forbidden by rule, client: 20.194.96.223, server: binixo.es, request: "GET /wp-login.php HTTP/1.1", host: "binixo.es" 2026/10/17 15:56:47 [error] 1186588#1186588: 8539033 access forbidden by rule, client: 20.194.96.223, server: binixo.es, request: "GET /admins.php HTTP/1.1", host: "binixo.es" ... show less	Web App Attack
🇸🇰 iplusv	2026-10-17 15:00:12 (3 hours ago)	Automatic report from IV firewall log.	Port Scan Hacking Brute-Force
🇺🇸 nasset	2026-10-17 14:37:20 (3 hours ago)	20.194.96.223 - - [17/Oct/2026:07:37:17 -0700] "GET /wp-ainefgskk.php HTTP/1.1" 403 584 "-" "-" TLSv ... show more 20.194.96.223 - - [17/Oct/2026:07:37:17 -0700] "GET /wp-ainefgskk.php HTTP/1.1" 403 584 "-" "-" TLSv1.3 TLS_AES_256_GCM_SHA384 20.194.96.223 - - [17/Oct/2026:07:37:18 -0700] "GET /opsh.php HTTP/1.1" 403 584 "-" "-" TLSv1.3 TLS_AES_256_GCM_SHA384 20.194.96.223 - - [17/Oct/2026:07:37:19 -0700] "GET /y.php HTTP/1.1" 403 584 "-" "-" TLSv1.3 TLS_AES_256_GCM_SHA384 20.194.96.223 - - [17/Oct/2026:07:37:19 -0700] "GET /mac.php HTTP/1.1" 403 584 "-" "-" TLSv1.3 TLS_AES_256_GCM_SHA384 20.194.96.223 - - [17/Oct/2026:07:37:20 -0700] "GET /lp.php HTTP/1.1" 403 584 "-" "-" TLSv1.3 TLS_AES_256_GCM_SHA384 ... show less	Bad Web Bot Web App Attack
🇺🇸 agenciahypelab.com.br	2026-10-17 13:40:37 (4 hours ago)	WordPress login brute-force detectado e bloqueado pelo CSF/LFD. Trigger: LF_TRIGGER	Brute-Force SSH
🇩🇪 raph	2026-10-17 13:24:41 (5 hours ago)	[Wordpress] crawler /wp-admin/, /wp-content/, etc.	Bad Web Bot Web App Attack
🇹🇷 eryilmaz	2026-10-17 13:22:29 (5 hours ago)	Automated attack blocked by eryilmaz WAF/defense engine (level 4, source: auto, path: /tpg-contato.p ... show more Automated attack blocked by eryilmaz WAF/defense engine (level 4, source: auto, path: /tpg-contato.php) show less	Web App Attack Hacking

Showing 1 to 15 of 1284 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇮🇳 168.144.67.214

🇺🇸 154.12.227.89

🇭🇰 148.66.49.226

🇨🇳 115.190.213.72

🇳🇱 109.160.32.128

🇳🇬 102.88.137.213

🇭🇰 101.79.165.43

🇸🇬 43.173.179.32

🇰🇷 43.128.156.124

🇨🇳 223.91.26.93

🇩🇰 212.27.12.204

🇹🇼 198.235.24.65

🇰🇷 118.219.233.147

🇩🇪 69.5.169.254

🇲🇾 47.254.198.155

🇳🇱 45.148.10.120

🇺🇸 192.3.116.169

🇮🇳 168.144.151.33

🇳🇱 89.248.172.9

🇦🇱 192.109.219.97