JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 20.197.179.48

20.197.179.48 was found in our database!

This IP was reported 256 times. Confidence of Abuse is 100%: ?

100%

ISP	Microsoft Corporation
Usage Type	Data Center/Web Hosting/Transit
ASN	AS8075
Domain Name	microsoft.com
Country	🇧🇷 Brazil
City	Campinas, Sao Paulo

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 20.197.179.48

Whois 20.197.179.48

IP Abuse Reports for 20.197.179.48:

This IP address has been reported a total of 256 times from 193 distinct sources. 20.197.179.48 was first reported on June 30th 2026, and the most recent report was 2 days ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇨🇦 zXero	2026-07-09 10:57:08 (2 days ago)	Fail2Ban automatic report - jail: no-wordpress	Brute-Force SSH DDoS Attack
🇨🇦 zXero	2026-07-07 12:50:50 (3 days ago)	Fail2Ban automatic report - jail: no-wordpress	Brute-Force SSH DDoS Attack
🇺🇸 Rayulcifer	2026-07-07 06:25:43 (4 days ago)	[Tue Jun 30 17:37:21.511420 2026] [authz_core:error] [pid 1041455:tid 131149485557440] [client 20.19 ... show more [Tue Jun 30 17:37:21.511420 2026] [authz_core:error] [pid 1041455:tid 131149485557440] [client 20.197.179.48:19377] AH01630: client denied by server configuration: proxy:http://localhost:4000/wp-content/plugins/hellopress/wp_filemanager.php [Tue Jun 30 17:37:21.628427 2026] [authz_core:error] [pid 1041455:tid 131150014035648] [client 20.197.179.48:19377] AH01630: client denied by server configuration: proxy:http://localhost:4000/this_is_a_new_hello_world.php [Tue Jun 30 17:37:21.751932 2026] [authz_core:error] [pid 1041455:tid 131148973864640] [client 20.197.179.48:19377] AH01630: client denied by server configuration: proxy:http://localhost:4000/min.php [Tue Jun 30 17:37:21.865878 2026] [authz_core:error] [pid 1041455:tid 131153798829760] [client 20.197.179.48:19377] AH01630: client denied by server configuration: proxy:http://localhost:4000/xozx.php [Tue Jun 30 17:37:21.979710 2026] [authz_core:error] [pid 1041455:tid 131152715175616] [client 20.197.179.48:19377] AH01630: client deni ... show less	Brute-Force SSH
🇩🇪 ghostwarriors	2026-07-06 08:55:03 (5 days ago)	Webpage scraping	Brute-Force Bad Web Bot Web App Attack
Anonymous	2026-07-04 21:24:53 (6 days ago)	Bulk report from WAF Auto-Blocker Dashboard	Brute-Force SSH
🇪🇸 Gem	2026-07-03 22:17:48 (1 week ago)	Unauthorized web scan.	Web App Attack
Anonymous	2026-07-03 08:36:47 (1 week ago)	Bulk report from WAF Auto-Blocker Dashboard	Brute-Force SSH
🇩🇪 psauxit	2026-07-02 07:51:10 (1 week ago)	Fail2Ban - NGINX bad requests 400-401-403-404-444, high level vulnerability scanning, commonly xmlrp ... show more Fail2Ban - NGINX bad requests 400-401-403-404-444, high level vulnerability scanning, commonly xmlrpc_attack, wp-login brute force, excessive crawling/scraping show less	Web App Attack Hacking
🇩🇪 LRob	2026-07-02 07:45:08 (1 week ago)	Repeated attacks detected by Fail2Ban in recidive jail	Hacking
🇧🇪 sid3windr	2026-07-02 07:41:44 (1 week ago)	GET /wp-content/plugins/hellopress/wp_filemanager.php (Tarpitted for 4m20s, wasted 15.35kB)	Web App Attack
🇨🇭 beatsnet.com	2026-07-02 07:39:05 (1 week ago)	[Thu Jul 02 09:39:03.842226 2026] [proxy_fcgi:error] [pid 4138:tid 20404475889680] [client 20.197.17 ... show more [Thu Jul 02 09:39:03.842226 2026] [proxy_fcgi:error] [pid 4138:tid 20404475889680] [client 20.197.179.48:7714] AH01071: Got error 'Primary script unknown' [Thu Jul 02 09:39:04.360177 2026] [proxy_fcgi:error] [pid 4138:tid 20404475889680] [client 20.197.179.48:7714] AH01071: Got error 'Primary script unknown' [Thu Jul 02 09:39:04.560645 2026] [proxy_fcgi:error] [pid 4138:tid 20404475889680] [client 20.197.179.48:7714] AH01071: Got error 'Primary script unknown' [Thu Jul 02 09:39:04.762436 2026] [proxy_fcgi:error] [pid 4138:tid 20404475889680] [client 20.197.179.48:7714] AH01071: Got error 'Primary script unknown' ... show less	Brute-Force Web App Attack
🇳🇱 middelkoopcc	2026-07-02 07:05:08 (1 week ago)	2026-07-02 09:02:00 [client 20.197.179.48:37479] AH01071: Got error 'Primary script unknown' && 2026 ... show more 2026-07-02 09:02:00 [client 20.197.179.48:37479] AH01071: Got error 'Primary script unknown' && 2026-07-02 09:02:01 [client 20.197.179.48:37479] AH01071: Got error 'Primary script unknown' && 2026-07-02 09:02:02 [client 20.197.179.48:37479] AH01071: Got error 'Primary script unknown' && 94 more within 20 minutes show less	Web App Attack
Anonymous	2026-07-02 07:00:06 (1 week ago)	Large-scale coordinated botnet (200+k IPs). Attacker: mikhail-smirnov-79830323 (LinkedIn/profile ID) ... show more Large-scale coordinated botnet (200+k IPs). Attacker: mikhail-smirnov-79830323 (LinkedIn/profile ID) employed by Angara Technologies Group (Explicitly identified himself as enemy a week before attack began) \| /wp-content/plugins/hellopress/wp_filemanager.php \| (Magento Site) show less	Hacking Bad Web Bot
🇱🇻 garmtech.com	2026-07-02 06:48:56 (1 week ago)	Attempted access to sensitive endpoint (/wp-content/plugins/hellopress/wp_filemanager.php) detected. ... show more Attempted access to sensitive endpoint (/wp-content/plugins/hellopress/wp_filemanager.php) detected. Automated scan or unauthorized probing. show less	Web App Attack
Anonymous	2026-07-02 06:48:12 (1 week ago)	20.197.179.48 - - [02/Jul/2026:14:48:10 +0800] "GET /wp-content/plugins/hellopress/wp_filemanager.ph ... show more 20.197.179.48 - - [02/Jul/2026:14:48:10 +0800] "GET /wp-content/plugins/hellopress/wp_filemanager.php HTTP/1.1" 404 196 "-" "-" 20.197.179.48 - - [02/Jul/2026:14:48:11 +0800] "GET /this_is_a_new_hello_world.php HTTP/1.1" 404 16 "-" "-" 20.197.179.48 - - [02/Jul/2026:14:48:11 +0800] "GET /this_is_a_new_hello_world.php HTTP/1.1" 404 16 "-" "-" 20.197.179.48 - - [02/Jul/2026:14:48:11 +0800] "GET /min.php HTTP/1.1" 404 16 "-" "-" 20.197.179.48 - - [02/Jul/2026:14:48:11 +0800] "GET /min.php HTTP/1.1" 404 16 "-" "-" 20.197.179.48 - - [02/Jul/2026:14:48:12 +0800] "GET /xozx.php HTTP/1.1" 404 16 "-" "-" ... show less	Bad Web Bot Web App Attack

Showing 1 to 15 of 256 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇺🇸 2604:a880:400:d1:0:4:6c79:7001

🇧🇷 200.175.61.207

🇷🇺 176.77.9.196

🇮🇳 159.65.148.158

🇮🇳 49.205.151.132

🇷🇴 2.57.122.209

🇺🇸 162.217.100.196

🇺🇸 136.144.35.190

🇹🇷 88.255.41.28

🇳🇱 45.43.157.113

🇲🇾 202.184.151.147

🇺🇸 192.186.151.175

🇺🇸 147.182.183.153

🇺🇸 136.144.35.207

🇳🇱 91.148.244.131

🇬🇧 35.203.211.140

🇩🇪 217.79.181.38

🇯🇵 212.32.76.66

🇩🇪 209.50.186.160

🇱🇹 158.173.79.8