JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

20.196.208.116

Recent Activity

Abuse confidence score ?

100% Critical

1,212 reports

661 reporters · latest 14 minutes ago

ISP	Microsoft Corporation
Usage Type	Data Center/Web Hosting/Transit
ASN	AS8075
Domain Name	microsoft.com
Country	🇰🇷 Korea (the Republic of)
City	Seoul, Seoul

ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report Whois

Reports Activity

Example preview

Report Categories (Last 60 Days)

Example preview

Top Reporter Countries (Last 60 Days)

Example preview

Account required for the enhanced features Log in Sign up

IP Abuse Reports for 20.196.208.116

Export CSV

This IP address has been reported a total of 1,212 times from 661 distinct sources. 20.196.208.116 was first reported on June 15th 2022, and the most recent report was 14 minutes ago. In the last 60 days, the top reporter locations were: Germany with 306 reports; United States of America with 250 reports; France with 130 reports. The most common categories in these recent reports were: Web App Attack 963 times; Bad Web Bot 314 times; Hacking 251 times; Brute-Force 239 times; Port Scan 110 times; Other 220 times.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇩🇪 macrob	2026-10-14 13:36:40 (14 minutes ago)	2026/10/14 13:36:38 [error] 3960611#3960611: 51458757 access forbidden by rule, client: 20.196.208. ... show more 2026/10/14 13:36:38 [error] 3960611#3960611: 51458757 access forbidden by rule, client: 20.196.208.116, server: behemoti.com, request: "GET /admin.php HTTP/2.0", host: "behemoti.com" 2026/10/14 13:36:39 [error] 3960611#3960611: 51458790 access forbidden by rule, client: 20.196.208.116, server: behemoti.com, request: "GET /wp-includes/block-supports/ HTTP/2.0", host: "behemoti.com" 2026/10/14 13:36:39 [error] 3960611#3960611: 51458782 access forbidden by rule, client: 20.196.208.116, server: behemoti.com, request: "GET /wp-content/admin.php HTTP/2.0", host: "behemoti.com" ... show less	Web App Attack
🇩🇪 ISPLtd	2026-10-14 13:35:13 (15 minutes ago)	20.196.208.116 [14/Oct/2026:10:35:12 -0300] target.domain.com:443 URL:/PII/controller/extension/exte ... show more 20.196.208.116 [14/Oct/2026:10:35:12 -0300] target.domain.com:443 URL:/PII/controller/extension/extension/ultra.php "GET /PII/controller/extension/extension/ultra.php 20.196.208.116 [14/Oct/2026:10:35:13 -0300] target.domain.ca:443 URL:/PII/controller/extension/extension/ultra.php "GET /PII/controller/extension/extension/ultra.php ... show less	Hacking Web App Attack
Anonymous	2026-10-14 13:31:44 (19 minutes ago)	20.196.208.116 - - [14/Oct/2026:15:31:19 +0200] "GET /wp-includes/assets/index.php HTTP/1.1" 404 562 ... show more 20.196.208.116 - - [14/Oct/2026:15:31:19 +0200] "GET /wp-includes/assets/index.php HTTP/1.1" 404 562 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.196.208.116 - - [14/Oct/2026:15:31:19 +0200] "GET /images/ HTTP/1.1" 403 584 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.196.208.116 - - [14/Oct/2026:15:31:20 +0200] "GET /wp-admin/ HTTP/1.1" 404 562 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.196.208.116 - - [14/Oct/2026:15:31:20 +0200] "GET /wp-admin/css/colors/midnight/ HTTP/1.1" 404 562 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.196.208.116 - - [14/Oct/2026:15:31:20 +0200] "GET /wp-content/themes/about.php HTTP/1.1" 404 562 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537. ... show less	DDoS Attack
🇨🇳 WMK965	2026-10-14 13:28:18 (22 minutes ago)	Malicious requests IP: 20.196.208.116 Time: 14/Oct/2026:21:28:12 +0800 User-Agent: Mozilla/5.0 (Win ... show more Malicious requests IP: 20.196.208.116 Time: 14/Oct/2026:21:28:12 +0800 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Activities: "GET /wp-includes/block-supports/ HTTP/2.0" 444 0 "-" "GET /wp-content/admin.php HTTP/2.0" 444 0 "-" "GET /wp-admin/images/admin.php HTTP/2.0" 444 0 "-" "GET /wp-admin/css/ HTTP/2.0" 444 0 "-" "GET /wp-admin/css/colors/index.php HTTP/2.0" 444 0 "-" show less	Bad Web Bot Web App Attack
🇫🇷 security.rdmc.fr	2026-10-14 13:19:22 (31 minutes ago)	Web scan: requests for sensitive files	Web App Attack Bad Web Bot
🇺🇸 brightenfield	2026-10-14 13:18:45 (32 minutes ago)	Web App Attack	Web App Attack
🇧🇷 Host One	2026-10-14 13:04:34 (46 minutes ago)	Web vulnerability scanning: automated requests without User-Agent; requests to known exploit/probe p ... show more Web vulnerability scanning: automated requests without User-Agent; requests to known exploit/probe paths; requests blocked by WAF (ModSecurity) rules. Blocked by firewall on 16 different hosting servers. Protocol TCP, port 80, 443 (HTTP/HTTPS). Requested paths: /wso.php, /admin.php, /fetch.php, /xmlrpc.php, /alfa.php. Automated report. show less	Hacking Bad Web Bot Web App Attack
🇵🇱 strefapi_com	2026-10-14 13:04:21 (46 minutes ago)	Brute-force, web ...	Hacking Brute-Force Web App Attack
🇺🇸 ambor	2026-10-14 13:03:28 (47 minutes ago)	Honeypot triggered: /admin.php on ifebridge.com. User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x6 ... show more Honeypot triggered: /admin.php on ifebridge.com. User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36. Method: GET show less	Web App Attack
🇩🇪 svr	2026-10-14 13:02:16 (48 minutes ago)	Abusive Automated Web Scanner	Web App Attack
🇳🇱 JCB	2026-10-14 13:00:00 (51 minutes ago)	20.196.208.116 - - [13/Oct/2026:15:28:05 +0300] "GET /wp-admin/css/colors/index.php HTTP/1.1" 404 23 ... show more 20.196.208.116 - - [13/Oct/2026:15:28:05 +0300] "GET /wp-admin/css/colors/index.php HTTP/1.1" 404 236 "-" "-" 20.196.208.116 - - [13/Oct/2026:15:28:05 +0300] "GET /wp-includes/images/about.php HTTP/1.1" 404 236 "-" "-" ... show less	Web App Attack
🇬🇧 consul.to	2026-10-14 12:55:29 (55 minutes ago)	Web attack/malicious scanning detected	Web App Attack
🇫🇷 sthoyer.de	2026-10-14 12:54:02 (57 minutes ago)	20.196.208.116 - - [14/Oct/2026:14:53:57 +0200] "GET /admin.php HTTP/2" 302 495 "-" "Mozilla/5.0 (Wi ... show more 20.196.208.116 - - [14/Oct/2026:14:53:57 +0200] "GET /admin.php HTTP/2" 302 495 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 20.196.208.116 - - [14/Oct/2026:14:54:00 +0200] "GET /public/css.php HTTP/2" 302 495 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" ... show less	Web App Attack
🇳🇱 Site.eu	2026-10-14 12:53:16 (57 minutes ago)	Excessive multi-domain requests	Brute-Force
🇫🇷 regishoussin	2026-10-14 12:51:00 (1 hour ago)	Automated web scanning detected by Wazuh (rule 100180): repeated 400/404 errors from mass probing of ... show more Automated web scanning detected by Wazuh (rule 100180): repeated 400/404 errors from mass probing of admin/backdoor paths (e.g. wp-login.php, known CMS shell filenames) on an Apache web server, on 2026-10-14 12:51 UTC. show less	Bad Web Bot Web App Attack

Showing 1 to 15 of 1212 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇸🇬 34.126.174.200

🇹🇷 176.33.67.144

🇬🇧 134.122.98.34

🇨🇳 106.52.23.231

🇫🇷 85.217.140.19

🇳🇱 45.148.10.141

🇷🇺 212.32.212.177

🇨🇦 193.242.184.224

🇨🇦 172.69.214.234

🇹🇼 104.199.176.250

🇳🇱 45.156.87.209

🇺🇸 40.119.27.186

🇧🇷 177.91.119.59

🇺🇸 135.119.19.253

🇨🇦 89.251.0.177

🇨🇿 77.75.78.169

🇷🇺 46.158.4.43

🇨🇿 46.135.20.176

🇳🇱 45.142.193.169

🇸🇬 43.172.195.227