JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 20.196.209.159

20.196.209.159 was found in our database!

This IP was reported 334 times. Confidence of Abuse is 100%: ?

100%

ISP	Microsoft Corporation
Usage Type	Data Center/Web Hosting/Transit
ASN	AS8075
Domain Name	microsoft.com
Country	🇰🇷 Korea (the Republic of)
City	Seoul, Seoul

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 20.196.209.159

Whois 20.196.209.159

IP Abuse Reports for 20.196.209.159:

This IP address has been reported a total of 334 times from 275 distinct sources. 20.196.209.159 was first reported on July 15th 2026, and the most recent report was 4 hours ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇫🇷 mail.avx.gr	2026-07-17 13:22:28 (4 hours ago)	Plesk Fail2Ban jail: Plesk-Web-Exploits. Evidence: default:80 20.196.209.159 - - [16/Jul/2026:06:34: ... show more Plesk Fail2Ban jail: Plesk-Web-Exploits. Evidence: default:80 20.196.209.159 - - [16/Jul/2026:06:34:23 +0300] "GET /shell.php HTTP/1.1" 404 412 "-" "-" show less	Web App Attack
🇪🇸 NullBlue	2026-07-17 09:24:53 (8 hours ago)	Web app attack: scanning for secrets/exploits (.env/.git/PHPUnit CVE). Captured by NullBlue67 honeyp ... show more Web app attack: scanning for secrets/exploits (.env/.git/PHPUnit CVE). Captured by NullBlue67 honeypot. show less	Hacking Web App Attack
🇬🇧 openstrike.co.uk	2026-07-17 05:14:46 (12 hours ago)	228 attacks on PHP URLs: GET /file11.php HTTP/1.1	Web App Attack
🇩🇪 ghostwarriors	2026-07-17 03:52:01 (13 hours ago)	Webpage scraping	Brute-Force Bad Web Bot Web App Attack
🇺🇸 drewking	2026-07-16 20:17:40 (21 hours ago)	114 malicious / suspicious requests. Ports: 403 /drykl.php, 403 /f35.php, 403 /wp-link-szoppm.php, 4 ... show more 114 malicious / suspicious requests. Ports: 403 /drykl.php, 403 /f35.php, 403 /wp-link-szoppm.php, 403 /x.php, 403 /min.php. show less	Web App Attack Hacking
Anonymous	2026-07-16 17:04:35 (1 day ago)	Blocked by FortiWeb WAF ML threat detection. ML probability: 99%, Country: KR, Attack patterns: Word ... show more Blocked by FortiWeb WAF ML threat detection. ML probability: 99%, Country: KR, Attack patterns: WordPress scanning, Webshell probing, Malicious User-Agent show less	Bad Web Bot Web App Attack
🇨🇴 adalbertoreyes.org	2026-07-16 15:38:18 (1 day ago)	CategoryPortScan	Port Scan
🇭🇺 NyaljBe	2026-07-16 10:15:00 (1 day ago)	20.196.209.159 - - [16/Jul/2026:03:36:57 +0200] "GET /atomlib.php HTTP/1.1" 404 153 "-" "-" 20.196. ... show more 20.196.209.159 - - [16/Jul/2026:03:36:57 +0200] "GET /atomlib.php HTTP/1.1" 404 153 "-" "-" 20.196.209.159 - - [16/Jul/2026:03:36:56 +0200] "GET /v2.php HTTP/1.1" 404 153 "-" "-" 20.196.209.159 - - [16/Jul/2026:03:36:55 +0200] "GET //x.php HTTP/1.1" 404 153 "-" "-" 20.196.209.159 - - [16/Jul/2026:03:36:54 +0200] "GET /wp-ws68.php HTTP/1.1" 404 153 "-" "-" 20.196.209.159 - - [16/Jul/2026:03:36:54 +0200] "GET /wso.php HTTP/1.1" 404 153 "-" "-" 20.196.209.159 - - [16/Jul/2026:03:36:51 +0200] "GET /r.php HTTP/1.1" 404 153 "-" "-" 20.196.209.159 - - [16/Jul/2026:03:36:51 +0200] "GET //shell.php HTTP/1.1" 404 153 "-" "-" 20.196.209.159 - - [16/Jul/2026:03:36:50 +0200] "GET /xxx.php HTTP/1.1" 404 153 "-" "-" 20.196.209.159 - - [16/Jul/2026:03:36:49 +0200] "GET /sql.php HTTP/1.1" 404 153 "-" "-" 20.196.209.159 - - [16/Jul/2026:03:36:49 +0200] "GET /1.php HTTP/1.1" 404 153 "-" "-" 20.196.209.159 - - [16/Jul/2026:03:36:48 +0200] "GET /atkno.php HTTP/1.1" 404 153 "-" "-" show less	Web App Attack
🇪🇸 pipeline.es	2026-07-16 09:50:17 (1 day ago)	Web scanning / probing for vulnerable paths	Port Scan Web App Attack
🇺🇸 Mehmet_The_Script_Kiddie	2026-07-16 08:27:00 (1 day ago)	CloudFlare WAF REPORT: /samll.php	Bad Web Bot Web App Attack
🇫🇷 mrcrassi	2026-07-16 08:07:22 (1 day ago)	Triggered Cloudflare WAF (botFight) from KR. Action taken: MANAGED_CHALLENGE Protocol: HTTP/1.1 (GET ... show more Triggered Cloudflare WAF (botFight) from KR. Action taken: MANAGED_CHALLENGE Protocol: HTTP/1.1 (GET method) Endpoint: /wp-tivate.php UA: Empty string This report was generated by: https://github.com/sefinek/Cloudflare-WAF-To-AbuseIPDB show less	Bad Web Bot
Anonymous	2026-07-16 07:58:19 (1 day ago)	"GET /wp-content/plugins/hellopress/wp_filemanager.php HTTP/1.1"	Hacking Web App Attack
🇺🇸 xmission.com	2026-07-16 07:39:02 (1 day ago)	Blocked by UFW (TCP on 80) Source port: 61253 TTL: 113 Packet length: 52 TOS: 0x00 This report (for ... show more Blocked by UFW (TCP on 80) Source port: 61253 TTL: 113 Packet length: 52 TOS: 0x00 This report (for 20.196.209.159) was generated by: https://github.com/sefinek/UFW-AbuseIPDB-Reporter show less	Port Scan Web App Attack
🇨🇭 dalslab ltd	2026-07-16 07:34:48 (1 day ago)	[16/Jul/2026:09:34:45 +0200] - 404 404 - GET https wpa-sec.dalslab.com "/wp-content/plugins/hellopre ... show more [16/Jul/2026:09:34:45 +0200] - 404 404 - GET https wpa-sec.dalslab.com "/wp-content/plugins/hellopress/wp_filemanager.php" [Client 20.196.209.159] [Length 27] [Gzip -] [Sent-to 10.1.1.235] "-" "-" [16/Jul/2026:09:34:46 +0200] - 404 404 - GET https wpa-sec.dalslab.com "/this_is_a_new_hello_world.php" [Client 20.196.209.159] [Length 27] [Gzip -] [Sent-to 10.1.1.235] "-" "-" [16/Jul/2026:09:34:46 +0200] - 404 404 - GET https wpa-sec.dalslab.com "/wp-der.php" [Client 20.196.209.159] [Length 27] [Gzip -] [Sent-to 10.1.1.235] "-" "-" [16/Jul/2026:09:34:47 +0200] - 404 404 - GET https wpa-sec.dalslab.com "/wp-slss.php" [Client 20.196.209.159] [Length 27] [Gzip -] [Sent-to 10.1.1.235] "-" "-" [16/Jul/2026:09:34:47 +0200] - 404 404 - GET https wpa-sec.dalslab.com "/min.php" [Client 20.196.209.159] [Length 27] [Gzip -] [Sent-to 10.1.1.235] "-" "-" ... show less	Web Spam Brute-Force Bad Web Bot Web App Attack
🇺🇸 deskpass.com	2026-07-16 07:21:24 (1 day ago)	GET /jj.php	Web App Attack

Showing 1 to 15 of 334 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇿🇦 185.132.186.87

🇧🇷 152.32.200.213

🇩🇪 151.243.11.232

🇧🇬 91.92.47.90

🇨🇦 85.217.149.60

🇺🇸 71.6.167.142

🇳🇱 213.152.161.54

🇹🇷 176.239.244.121

🇺🇸 173.239.224.115

🇺🇸 162.217.100.201

🇺🇸 137.184.152.130

🇺🇸 98.81.129.51

🇫🇷 91.231.89.173

🇫🇷 91.231.89.71

🇸🇬 52.237.80.79

🇺🇸 40.77.167.38

🇨🇳 27.155.120.135

🇫🇷 13.140.191.186

🇯🇵 220.102.229.196

🇭🇰 199.45.154.191