JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 20.197.198.154

20.197.198.154 was found in our database!

This IP was reported 446 times. Confidence of Abuse is 100%: ?

100%

ISP	Microsoft Corporation
Usage Type	Data Center/Web Hosting/Transit
ASN	AS8075
Domain Name	microsoft.com
Country	🇧🇷 Brazil
City	Campinas, Sao Paulo

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 20.197.198.154

Whois 20.197.198.154

IP Abuse Reports for 20.197.198.154:

This IP address has been reported a total of 446 times from 278 distinct sources. 20.197.198.154 was first reported on July 12th 2026, and the most recent report was 26 minutes ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇨🇭 SOC [GOLINE SA]	2026-07-15 06:02:40 (26 minutes ago)	FortiGate detected IPS attack from IPv4 address 20.197.198.154	Hacking
🇬🇧 openstrike.co.uk	2026-07-15 05:13:39 (1 hour ago)	112 attacks on Alfa URLs, PHP URLs: POST /alfacgiapi/perl.alfa HTTP/1.1 POST /wp-plain.php HTTP/1.1	Hacking Web App Attack
🇧🇷 Peregrine	2026-07-15 03:11:56 (3 hours ago)	Fail2Ban Jail s2: tomcat-honeypot \| Evidence: 20.197.198.154 104.23.254.103 - - [13/Jul/2026:15:42:5 ... show more Fail2Ban Jail s2: tomcat-honeypot \| Evidence: 20.197.198.154 104.23.254.103 - - [13/Jul/2026:15:42:57 -0300] "GET /.dj/index.php HTTP/1.1" 404 414 20.197.198.154 104.23.254.103 - - [13/Jul/2026:15:42:57 -0300] "GET /.trash7206/index.php HTTP/1.1" 404 414 20.197.198.154 104.23.254.103 - - [13/Jul/2026:15:42:57 -0300] "GET /.well-known/gecko-litespeed.php HTTP/1.1" 404 414 20.197.198.154 104.23.254.103 - - [13/Jul/2026:15:42:57 -0300] "GET /.well-known/logs233/index.php HTTP/1.1" 404 414 20.197.198.154 104.23.254.103 - - [13/Jul/2026:15:42:57 -0300] "GET /.well-known/wp-cron.php HTTP/1.1" 404 414 20.197.198.154 104.23.254.103 - - [13/Jul/2026:15:42:57 -0300] "GET /0.kb-v3.php HTTP/1.1" 404 414 20.197.198.154 104.23.254.103 - - [13/Jul/2026:15:42:57 -0300] "GET /0.php HTTP/1.1" 404 414 20.197.198.154 104.23.254.103 - - [13/Jul/2026:15:42:57 -0300] "GET /002.php HTTP/1.1" 404 414 20.197.198.154 104.23.254.103 - - [13/Jul/2026:15:42:58 -0300] "GET /01.php HTTP/1.1" 404 414 show less	Bad Web Bot
Anonymous	2026-07-15 03:07:39 (3 hours ago)	Trying to access config files	Web App Attack
🇺🇸 mw	2026-07-15 00:01:44 (6 hours ago)	GET /wp-admin/user/12.php HTTP/1.1	Web App Attack
🇳🇱 homeshowdomain.nl	2026-07-14 21:59:16 (8 hours ago)	Auto-ban: >3000 req/min op 2026-07-14	Web App Attack SSH Hacking
Anonymous	2026-07-14 20:04:58 (10 hours ago)	Blocked by FortiWeb WAF ML threat detection. ML probability: 99%, Country: BR, Attack patterns: Word ... show more Blocked by FortiWeb WAF ML threat detection. ML probability: 99%, Country: BR, Attack patterns: WordPress scanning show less	Bad Web Bot Web App Attack
🇸🇪 EmK530	2026-07-14 19:25:26 (11 hours ago)	URL flagged by RegEx: /wp-content/plugins/twenty/login.php	Web App Attack
🇮🇹 mediarama.com	2026-07-14 19:20:15 (11 hours ago)	Banned by Fail2Ban	Web App Attack
Anonymous	2026-07-14 19:18:37 (11 hours ago)	Ports: *; Direction: 0; Trigger: CT_LIMIT	Brute-Force SSH
🇦🇺 aranguren.org	2026-07-14 19:05:50 (11 hours ago)	20.197.198.154 - - [15/Jul/2026:05:05:49 +1000] "GET /wp-content/themes/seotheme/db.php?u HTTP/1.1" ... show more 20.197.198.154 - - [15/Jul/2026:05:05:49 +1000] "GET /wp-content/themes/seotheme/db.php?u HTTP/1.1" 404 1102 "www.google.com" "Mozlila/5.0 (Linux; Android 7.0; SM-G892A Bulid/NRD90M; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/60.0.3112.107 Moblie Safari/537.36" 20.197.198.154 - - [15/Jul/2026:05:05:49 +1000] "POST /wp-plain.php HTTP/1.1" 404 16 "www.google.com" "Mozilla/5.0 (Linux; Android 7.0; SM-G892A Bulid/NRD90M; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/60.0.3112.107 Moblie Safari/537.36" 20.197.198.154 - - [15/Jul/2026:05:05:49 +1000] "GET /wp-content/plugins/apikey/apikey.php?test=hello HTTP/1.1" 404 989 "-" "Mozlila/5.0 (Linux; Android 7.0; SM-G892A Bulid/NRD90M; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/60.0.3112.107 Moblie Safari/537.36" 20.197.198.154 - - [15/Jul/2026:05:05:49 +1000] "GET /vdcqouzv.php?Fox=d3wL7 HTTP/1.1" 404 16 "www.google.com" "Mozilla/5.0 (Linux; Android 7.0; SM-G892A Bulid/NRD90M; wv) AppleWebKit ... show less	Bad Web Bot
🇩🇪 Nevermind	2026-07-14 19:02:33 (11 hours ago)	20.197.198.154 - - [14/Jul/2026:21:02:32 +0200] "GET /admin.php HTTP/1.1" 404 142 "-" "Mozilla/5.0 ( ... show more 20.197.198.154 - - [14/Jul/2026:21:02:32 +0200] "GET /admin.php HTTP/1.1" 404 142 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.197.198.154 - - [14/Jul/2026:21:02:32 +0200] "GET /inputs.php HTTP/1.1" 404 142 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.197.198.154 - - [14/Jul/2026:21:02:32 +0200] "GET /file.php HTTP/1.1" 404 142 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.197.198.154 - - [14/Jul/2026:21:02:32 +0200] "GET /goods.php HTTP/1.1" 404 142 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" ... show less	Web App Attack
🇪🇸 alferez	2026-07-14 19:01:22 (11 hours ago)	Searching hacked php files	Hacking Exploited Host Web App Attack
🇧🇪 voormedia	2026-07-14 19:00:24 (11 hours ago)	Accessed trap at '/admin.php'	Web App Attack
🇬🇧 Shadymint	2026-07-14 18:59:34 (11 hours ago)	cms login attempt from IP marked as abusive	Web App Attack

Showing 1 to 15 of 446 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇫🇮 147.185.133.108

🇺🇸 143.42.0.20

🇦🇺 2404:6800:4006:1002::122

🇬🇧 217.146.80.116

🇺🇸 216.25.89.79

🇳🇱 160.119.76.64

🇺🇸 143.110.239.2

🇺🇸 135.237.126.220

🇺🇸 66.132.186.173

🇧🇷 45.163.145.2

🇨🇳 223.91.89.96

🇧🇷 205.210.31.244

🇩🇪 194.164.59.59

🇺🇸 192.178.65.22

🇨🇳 183.66.166.30

🇦🇷 181.44.129.99

🇵🇱 176.53.159.197

🇦🇺 168.144.169.151

🇺🇸 162.216.149.88

🇩🇪 154.196.71.236