JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 20.196.104.49

20.196.104.49 was found in our database!

This IP was reported 227 times. Confidence of Abuse is 0%: ?

ISP	Microsoft Corporation
Usage Type	Data Center/Web Hosting/Transit
ASN	AS8075
Domain Name	microsoft.com
Country	🇰🇷 Korea (the Republic of)
City	Seoul, Seoul

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 20.196.104.49

Whois 20.196.104.49

IP Abuse Reports for 20.196.104.49:

This IP address has been reported a total of 227 times from 189 distinct sources. 20.196.104.49 was first reported on September 24th 2025, and the most recent report was 9 months ago.

Old Reports: The most recent abuse report for this IP address is from 9 months ago . It is possible that this IP is no longer involved in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇩🇪 igerman	2025-10-18 16:13:23 (9 months ago)	caddy probes: [web] GET /goods.php -> 403 [admin-panel] GET /admin.php -> 403 [web] GET /num.php -> ... show more caddy probes: [web] GET /goods.php -> 403 [admin-panel] GET /admin.php -> 403 [web] GET /num.php -> 403 [web] GET /makeasmtp.php?p= -> 403 [web] GET /moon.php?p= -> 403 [web] GET /simple.php -> 403 [web] GET /atomlib.php -> 403 [web] GET /karak.php -> 403 [web] GET /classwithtostring.php -> 403 [wordpress] GET /wp-activate.php -> 403 show less	Web App Attack
🇹🇷 rtbh.com.tr	2025-09-26 20:09:01 (9 months ago)	list.rtbh.com.tr report: tcp/0	Brute-Force
🇩🇪 Vegascosmetics	2025-09-25 21:51:29 (9 months ago)	Kingcopy(AI-IDS): IP is wandering around the site and acting suspiciously.	Bad Web Bot
🇹🇷 rtbh.com.tr	2025-09-25 20:09:00 (9 months ago)	list.rtbh.com.tr report: tcp/0	Brute-Force
🇭🇺 NyaljBe	2025-09-25 08:52:00 (9 months ago)	20.196.104.49 - - [24/Sep/2025:23:10:29 +0200] "GET /akk.php HTTP/1.1" 404 153 "-" "-" 20.196.104.4 ... show more 20.196.104.49 - - [24/Sep/2025:23:10:29 +0200] "GET /akk.php HTTP/1.1" 404 153 "-" "-" 20.196.104.49 - - [24/Sep/2025:23:10:28 +0200] "GET /mg.php HTTP/1.1" 404 153 "-" "-" 20.196.104.49 - - [24/Sep/2025:23:10:28 +0200] "GET /pnsi.php7 HTTP/1.1" 404 153 "-" "-" 20.196.104.49 - - [24/Sep/2025:23:10:28 +0200] "GET /asd67.php HTTP/1.1" 404 153 "-" "-" 20.196.104.49 - - [24/Sep/2025:23:10:28 +0200] "GET /xo.php HTTP/1.1" 404 153 "-" "-" 20.196.104.49 - - [24/Sep/2025:23:10:27 +0200] "GET /ltsxppjj.php HTTP/1.1" 404 153 "-" "-" 20.196.104.49 - - [24/Sep/2025:23:10:27 +0200] "GET /jq.php HTTP/1.1" 404 153 "-" "-" 20.196.104.49 - - [24/Sep/2025:23:10:27 +0200] "GET /dlu.php HTTP/1.1" 404 153 "-" "-" 20.196.104.49 - - [24/Sep/2025:23:10:27 +0200] "GET /jjlin.php HTTP/1.1" 404 153 "-" "-" 20.196.104.49 - - [24/Sep/2025:23:10:27 +0200] "GET /bolt.php HTTP/1.1" 404 153 "-" "-" 20.196.104.49 - - [24/Sep/2025:23:10:26 +0200] "GET /222.php?p= HTTP/1.1" 404 153 "-" "-" 20.196.104.49 - - [24/Sep/2025:23:10:26 show less	Web App Attack
🇬🇧 openstrike.co.uk	2025-09-25 05:13:04 (9 months ago)	182 attacks on PHP URLs: GET /prod/infos.php HTTP/1.1	Web App Attack
🇦🇺 artful	2025-09-25 05:05:00 (9 months ago)	Excessive errors ~12k in recent days	Web App Attack
🇭🇺 DumaNet	2025-09-25 04:07:00 (9 months ago)	Web app attack attempts, scanning for vulnerability. Date: 2025 Sep 24. 22:31:22 Source IP: 20.196 ... show more Web app attack attempts, scanning for vulnerability. Date: 2025 Sep 24. 22:31:22 Source IP: 20.196.104.49 Portion of the log(s): 20.196.104.49 - [24/Sep/2025:22:31:19 +0200] "GET /c.php HTTP/1.1" 404 153 "-" "-" 20.196.104.49 - [24/Sep/2025:22:31:19 +0200] "GET /jlex.php HTTP/1.1" 404 153 "-" "-" 20.196.104.49 - [24/Sep/2025:22:31:19 +0200] "GET /xmrlpc.php?p= HTTP/1.1" 404 153 "-" "-" 20.196.104.49 - [24/Sep/2025:22:31:19 +0200] "GET /warm.PhP7 HTTP/1.1" 404 153 "-" "-" 20.196.104.49 - [24/Sep/2025:22:31:18 +0200] "GET /themes.php HTTP/1.1" 404 153 "-" "-" 20.196.104.49 - [24/Sep/2025:22:31:18 +0200] "GET /tinny.php HTTP/1.1" 404 153 "-" "-" 20.196.104.49 - [24/Sep/2025:22:31:18 +0200] "GET /mar.php HTTP/1.1" 404 153 "-" "-" 20.196.104.49 - [24/Sep/2025:22:31:18 +0200] "GET /rss.php HTTP/1.1" 404 153 "-" "-" 20.196.104.49 - [24/Sep/2025:22:31:17 +0200] "GET /xx.php HTTP/1.1" 404 153 "-" "-" 20.196.104.49 - [24/Sep/2025:22:31:17 +0200] "GET /wp.php HTTP/1.1" 404 153 "-" "-" show less	Web App Attack
🇺🇸 octageeks.com	2025-09-25 04:06:43 (9 months ago)	Wordpress malicious attack:[octascan]	Web App Attack
🇭🇺 DumaNet	2025-09-25 03:51:00 (9 months ago)	Web app attack attempts, scanning for vulnerability. Date: 2025 Sep 24. 22:21:18 Source IP: 20.196 ... show more Web app attack attempts, scanning for vulnerability. Date: 2025 Sep 24. 22:21:18 Source IP: 20.196.104.49 Portion of the log(s): 20.196.104.49 - [24/Sep/2025:22:21:16 +0200] "GET /as.php HTTP/1.1" 404 153 "-" "-" 20.196.104.49 - [24/Sep/2025:22:21:16 +0200] "GET /radio.php HTTP/1.1" 404 153 "-" "-" 20.196.104.49 - [24/Sep/2025:22:21:16 +0200] "GET /autoload_classmap.php?p= HTTP/1.1" 404 153 "-" "-" 20.196.104.49 - [24/Sep/2025:22:21:15 +0200] "GET /wp-activate.php HTTP/1.1" 404 153 "-" "-" 20.196.104.49 - [24/Sep/2025:22:21:15 +0200] "GET /classwithtostring.php HTTP/1.1" 404 153 "-" "-" 20.196.104.49 - [24/Sep/2025:22:21:15 +0200] "GET /karak.php HTTP/1.1" 404 153 "-" "-" 20.196.104.49 - [24/Sep/2025:22:21:15 +0200] "GET /atomlib.php HTTP/1.1" 404 153 "-" "-" 20.196.104.49 - [24/Sep/2025:22:21:15 +0200] "GET /simple.php HTTP/1.1" 404 153 "-" "-" 20.196.104.49 - [24/Sep/2025:22:21:14 +0200] "GET /moon.php?p= HTTP/1.1" 404 153 "-" "-" 20.196.104.49 - [24/Sep/2025:22:21:14 +0200] "GET /makeasmtp show less	Web App Attack
🇺🇸 Charlesiv	2025-09-25 03:39:32 (9 months ago)	Triggered Cloudflare WAF (botFight) from KR. Action taken: MANAGED_CHALLENGE ASN: 8075 (MICROSOFT-CO ... show more Triggered Cloudflare WAF (botFight) from KR. Action taken: MANAGED_CHALLENGE ASN: 8075 (MICROSOFT-CORP-MSN-AS-BLOCK) Protocol: HTTP/1.1 (GET method) Endpoint: /aa17.php Timestamp: 2025-09-24T22:48:17Z Ray ID: 9845d414ee33d5ad UA: Empty string show less	Bad Web Bot
🇭🇺 DumaNet	2025-09-25 03:36:00 (9 months ago)	Web app attack attempts, scanning for vulnerability. Date: 2025 Sep 24. 22:10:15 Source IP: 20.196 ... show more Web app attack attempts, scanning for vulnerability. Date: 2025 Sep 24. 22:10:15 Source IP: 20.196.104.49 Portion of the log(s): 20.196.104.49 - [24/Sep/2025:22:10:13 +0200] "GET /js.php HTTP/1.1" 404 153 "-" "-" 20.196.104.49 - [24/Sep/2025:22:10:13 +0200] "GET /about.php HTTP/1.1" 404 153 "-" "-" 20.196.104.49 - [24/Sep/2025:22:10:13 +0200] "GET /cong.php HTTP/1.1" 404 153 "-" "-" 20.196.104.49 - [24/Sep/2025:22:10:12 +0200] "GET /lv.php HTTP/1.1" 404 153 "-" "-" 20.196.104.49 - [24/Sep/2025:22:10:12 +0200] "GET /buy.php HTTP/1.1" 404 153 "-" "-" 20.196.104.49 - [24/Sep/2025:22:10:12 +0200] "GET /cache.php HTTP/1.1" 404 153 "-" "-" 20.196.104.49 - [24/Sep/2025:22:10:12 +0200] "GET /file.php HTTP/1.1" 404 153 "-" "-" 20.196.104.49 - [24/Sep/2025:22:10:11 +0200] "GET /ar.php HTTP/1.1" 404 153 "-" "-" 20.196.104.49 - [24/Sep/2025:22:10:11 +0200] "GET /class.php HTTP/1.1" 404 153 "-" "-" 20.196.104.49 - [24/Sep/2025:22:10:11 +0200] "GET /lock360.php HTTP/1.1" 404 153 "-" "-" show less	Web App Attack
🇫🇮 nNordic	2025-09-25 02:28:18 (10 months ago)	Connection attempt blocked by IDS/IPS from IP 20.196.104.49/32	Hacking
🇩🇪 becker-software.de	2025-09-25 02:19:37 (10 months ago)	{"ip": "20.196.104.49","host": "www.becker-software.de","path": "/wp-content/plugins/hellopress/wp_f ... show more {"ip": "20.196.104.49","host": "www.becker-software.de","path": "/wp-content/plugins/hellopress/wp_filemanager.php","status": "404","referrer": "-","user_agent": "-","length": 197,"generation_time_milli": 0.002,"date": "2025-09-25T02:19:17+00:00"} {"ip": "20.196.104.49","host": "www.becker-software.de","path": "/abcd.php","status": "404","referrer": "-","user_agent": "-","length": 197,"generation_time_milli": 0.001,"date": "2025-09-25T02:19:17+00:00"} {"ip": "20.196.104.49","host": "www.becker-software.de","path": "/nc4.php","status": "404","referrer": "-","user_agent": "-","length": 197,"generation_time_milli": 0.001,"date": "2025-09-25T02:19:18+00:00"} {"ip": "20.196.104.49","host": "www.becker-software.de","path": "/we.php","status": "404","referrer": "-","user_agent": "-","length": 197,"generation_time_milli": 0.001,"date": "2025-09-25T02:19:19+00:00"} {"ip": "20.196.104.49","host": "www.becker-software.de","path": "/lock360.php","status": "404","referrer": "-","user_agent": "-","l ... show less	Web App Attack
🇫🇷 Savoie	2025-09-25 02:15:00 (10 months ago)	20.196.104.49 *.* - [25/Sep/2025:04:15:36 +0200] "GET /abcd.php HTTP/1.1" 404 196 "-" "-" AND ... show more 20.196.104.49 *.* - [25/Sep/2025:04:15:36 +0200] "GET /abcd.php HTTP/1.1" 404 196 "-" "-" AND : GET /nc4.php HTTP/1.1 GET /we.php HTTP/1.1 GET /file.php? HTTP/1.1 GET /cache.php HTTP/1.1 GET /cong.php HTTP/1.1 GET /goods.php HTTP/1.1 GET /num.php HTTP/1.1 GET /karak.php HTTP/1.1 GET /radio.php HTTP/1.1 GET /as.php HTTP/1.1 GET /tinny.php HTTP/1.1 Searching for inexistent files. show less	Bad Web Bot Web App Attack

Showing 1 to 15 of 227 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇫🇮 185.148.1.234

🇳🇱 176.65.148.150

🇧🇯 137.255.13.201

🇺🇸 44.242.235.139

🇩🇪 34.141.123.218

🇨🇳 211.149.182.162

🇲🇽 189.194.140.170

🇧🇷 152.248.81.129

🇩🇪 130.12.180.65

🇹🇭 125.27.188.214

🇺🇿 95.46.71.7

🇫🇷 85.217.140.23

🇫🇷 51.178.198.251

🇳🇱 45.148.10.147

🇿🇼 41.190.35.79

🇮🇪 3.253.96.54

🇨🇳 218.4.156.254

🇷🇺 212.3.155.8

🇭🇰 199.45.155.73

🇺🇸 172.104.215.178