JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 20.203.148.31

20.203.148.31 was found in our database!

This IP was reported 310 times. Confidence of Abuse is 100%: ?

100%

ISP	Microsoft Corporation
Usage Type	Data Center/Web Hosting/Transit
ASN	AS8075
Domain Name	microsoft.com
Country	🇨🇭 Switzerland
City	Zurich, Zurich

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 20.203.148.31

Whois 20.203.148.31

IP Abuse Reports for 20.203.148.31:

This IP address has been reported a total of 310 times from 192 distinct sources. 20.203.148.31 was first reported on July 30th 2026, and the most recent report was 8 minutes ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇺🇸 antlac1	2026-07-31 19:44:37 (8 minutes ago)	crowdsecurity/http-admin-interface-probing	Brute-Force Web App Attack
🇬🇧 blik2108	2026-07-31 19:37:13 (15 minutes ago)	20.203.148.31 - - [31/Jul/2026:19:37:11 +0000] "GET /pDPTEa.php HTTP/1.1" 404 3431 "-" "Mozilla/5.0 ... show more 20.203.148.31 - - [31/Jul/2026:19:37:11 +0000] "GET /pDPTEa.php HTTP/1.1" 404 3431 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" "-" 20.203.148.31 - - [31/Jul/2026:19:37:11 +0000] "GET /wp-includes/blocks/file/ HTTP/1.1" 404 3431 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" "-" 20.203.148.31 - - [31/Jul/2026:19:37:11 +0000] "GET /zacosmall.php HTTP/1.1" 404 3431 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" "-" 20.203.148.31 - - [31/Jul/2026:19:37:11 +0000] "GET /Util/PHP/eval-stdin.php HTTP/1.1" 404 3431 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" "-" 20.203.148.31 - - [31/Jul/2026:19:37:11 +0000] "GET /wp-content/upgrade/autoload_classmap.php HTTP/1.1" 404 3431 "-" "Mozilla/5.0 (Windows NT 10.0; Wi ... show less	Web App Attack
🇳🇴 Abuse Buster	2026-07-31 19:34:07 (18 minutes ago)	20.203.148.31 - [31/Jul/2026:21:34:04 +0200] "GET /2.php HTTP/2.0" 404 36 "-" "Mozilla/5.0 (Windows ... show more 20.203.148.31 - [31/Jul/2026:21:34:04 +0200] "GET /2.php HTTP/2.0" 404 36 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.203.148.31 - [31/Jul/2026:21:34:05 +0200] "GET /wp-admin/includes/mar.php HTTP/2.0" 404 36 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.203.148.31 - [31/Jul/2026:21:34:05 +0200] "GET /wp-includes/blocks/post-author/ HTTP/2.0" 404 1843 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" ... show less	Web App Attack
🇹🇭 thaizone.com	2026-07-31 19:32:37 (20 minutes ago)	Hacking attempts against websites (D1) #4	Web App Attack Hacking
🇩🇰 HostingGroup	2026-07-31 19:11:53 (40 minutes ago)	Automated malicious activity (404 Flood) detected and blocked at the CDN edge by NordicCDN Shield. O ... show more Automated malicious activity (404 Flood) detected and blocked at the CDN edge by NordicCDN Shield. Offenses: 3. First blocked: 2026-07-31. show less	Bad Web Bot Web App Attack
🇫🇮 Christopher Hughes	2026-07-31 19:09:49 (43 minutes ago)	[Fri Jul 31 20:09:49.023323 2026] [proxy_fcgi:error] [pid 2423091:tid 139826519062080] [client 20.20 ... show more [Fri Jul 31 20:09:49.023323 2026] [proxy_fcgi:error] [pid 2423091:tid 139826519062080] [client 20.203.148.31:60824] AH01071: Got error 'Primary script unknown' [Fri Jul 31 20:09:49.062005 2026] [proxy_fcgi:error] [pid 2423091:tid 139825428534848] [client 20.203.148.31:60824] AH01071: Got error 'Primary script unknown' [Fri Jul 31 20:09:49.100662 2026] [proxy_fcgi:error] [pid 2423091:tid 139826267412032] [client 20.203.148.31:60824] AH01071: Got error 'Primary script unknown' [Fri Jul 31 20:09:49.199619 2026] [proxy_fcgi:error] [pid 2423091:tid 139825478891072] [client 20.203.148.31:60824] AH01071: Got error 'Primary script unknown' [Fri Jul 31 20:09:49.274039 2026] [proxy_fcgi:error] [pid 2423091:tid 139826544240192] [client 20.203.148.31:60824] AH01071: Got error 'Primary script unknown' ... show less	Web App Attack
🇩🇪 ramazan	2026-07-31 18:59:09 (53 minutes ago)	Fail2Ban: nginx-4xx \| Failures: 10 \| Log: /Util/PHP/eval-stdin.php /error_log.php /libraries/legacy/ ... show more Fail2Ban: nginx-4xx \| Failures: 10 \| Log: /Util/PHP/eval-stdin.php /error_log.php /libraries/legacy/ /pDPTEa.php /upgrade.php show less	Web App Attack Hacking
🇫🇷 Baking333	2026-07-31 18:55:43 (57 minutes ago)	[redacted] 20.203.148.31 - - [31/Jul/2026:19:55:30 +0100] "GET /[redacted] HTTP/1.1" 307 418 "-" "Mo ... show more [redacted] 20.203.148.31 - - [31/Jul/2026:19:55:30 +0100] "GET /[redacted] HTTP/1.1" 307 418 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" [redacted] 20.203.148.31 - - [31/Jul/2026:19:55:42 +0100] "GET /[redacted] HTTP/1.1" 307 418 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" show less	Bad Web Bot Web App Attack
Anonymous	2026-07-31 18:46:47 (1 hour ago)	20.203.148.31 - - [31/Jul/2026:20:41:49 +0200] "GET /json.php HTTP/1.1" 404 4886 "-" "Mozilla/5.0 (W ... show more 20.203.148.31 - - [31/Jul/2026:20:41:49 +0200] "GET /json.php HTTP/1.1" 404 4886 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.203.148.31 - - [31/Jul/2026:20:41:49 +0200] "GET /mini.php HTTP/1.1" 404 360 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.203.148.31 - - [31/Jul/2026:20:41:49 +0200] "GET /chosen.php HTTP/1.1" 404 360 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.203.148.31 - - [31/Jul/2026:20:41:49 +0200] "GET /kj.php HTTP/1.1" 404 360 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.203.148.31 - - [31/Jul/2026:20:41:49 +0200] "GET /wp-files.php HTTP/1.1" 404 360 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.20 ... show less	DDoS Attack
🇩🇪 Blexyel	2026-07-31 18:41:30 (1 hour ago)	20.203.148.31 - - [31/Jul/2026:20:41:29 +0200] "GET /css/wp-login.php HTTP/1.1" 404 548 "-" "Mozilla ... show more 20.203.148.31 - - [31/Jul/2026:20:41:29 +0200] "GET /css/wp-login.php HTTP/1.1" 404 548 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" ... show less	Brute-Force Web App Attack
🇩🇪 hidemail.app	2026-07-31 18:33:46 (1 hour ago)	Automated scan for exposed config/secret files and known web exploits (e.g. /.env, RCE probes); auto ... show more Automated scan for exposed config/secret files and known web exploits (e.g. /.env, RCE probes); auto-banned by fail2ban. show less	Web App Attack Hacking
🇩🇪 macrob	2026-07-31 18:32:44 (1 hour ago)	2026/07/31 18:32:41 [error] 3164441#3164441: 432610942 access forbidden by rule, client: 20.203.148 ... show more 2026/07/31 18:32:41 [error] 3164441#3164441: 432610942 access forbidden by rule, client: 20.203.148.31, server: binixo.ro, request: "GET /wp-includes/blocks/file/ HTTP/2.0", host: "www.binixo.ro" 2026/07/31 18:32:42 [error] 3164437#3164437: 432610954 access forbidden by rule, client: 20.203.148.31, server: binixo.ro, request: "GET /wp-content/upgrade/autoload_classmap.php HTTP/2.0", host: "www.binixo.ro" 2026/07/31 18:32:42 [error] 3164441#3164441: 432610942 access forbidden by rule, client: 20.203.148.31, server: binixo.ro, request: "GET /wp-content/plugins/baxa1.php HTTP/2.0", host: "www.binixo.ro" ... show less	Web App Attack
Anonymous	2026-07-31 18:22:26 (1 hour ago)	20.203.148.31 - - [31/Jul/2026:20:22:06 +0200] "GET /2.php HTTP/1.1" 404 34971 20.203.148.31 - - [31 ... show more 20.203.148.31 - - [31/Jul/2026:20:22:06 +0200] "GET /2.php HTTP/1.1" 404 34971 20.203.148.31 - - [31/Jul/2026:20:22:08 +0200] "GET /wp-json/wp/v/posts.php HTTP/1.1" 404 1646 20.203.148.31 - - [31/Jul/2026:20:22:09 +0200] "GET /wp-includes/pomo.php HTTP/1.1" 404 29868 20.203.148.31 - - [31/Jul/2026:20:22:11 +0200] "GET /dx.php HTTP/1.1" 404 29868 20.203.148.31 - - [31/Jul/2026:20:22:13 +0200] "GET /wp/wp-admin/includes/ HTTP/1.1" 404 31217 20.203.148.31 - - [31/Jul/2026:20:22:15 +0200] "GET /cgi-bin/cgi-bin/post.php7 HTTP/1.1" 404 31216 20.203.148.31 - - [31/Jul/2026:20:22:17 +0200] "GET /wp-includes/js/tinymce/themes/advanced.php HTTP/1.1" 404 29866 20.203.148.31 - - [31/Jul/2026:20:22:19 +0200] "GET /wp-includes/file.php HTTP/1.1" 404 29868 20.203.148.31 - - [31/Jul/2026:20:22:20 +0200] "GET /vhosts/function.php HTTP/1.1" 404 29867 20.203.148.31 - - [31/Jul/2026:20:22:22 +0200] "GET /mI35rZhMg1zJ1vuXdefault.php HTTP/1.1" 404 29868 ... show less	Web Spam Web App Attack
🇹🇷 eryilmaz	2026-07-31 18:16:20 (1 hour ago)	Automated attack blocked by eryilmaz WAF/defense engine (level 2, source: auto, path: /zacosmall.php ... show more Automated attack blocked by eryilmaz WAF/defense engine (level 2, source: auto, path: /zacosmall.php) show less	Web App Attack Hacking
Anonymous	2026-07-31 18:07:37 (1 hour ago)	Blocked by FortiWeb WAF ML threat detection. ML probability: 99%, Country: CH, Attack patterns: Word ... show more Blocked by FortiWeb WAF ML threat detection. ML probability: 99%, Country: CH, Attack patterns: WordPress scanning, Webshell probing, Backup file probing show less	Bad Web Bot Web App Attack

Showing 1 to 15 of 310 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇭🇰 199.45.155.74

🇫🇮 147.185.133.46

🇮🇪 130.195.213.195

🇨🇦 85.217.149.36

🇰🇿 2.133.4.22

🇸🇬 2a09:bac5:55f8:25cd::3c4:26

🇨🇳 2408:8214:1121:6130:2d6c:9ffb:f5f9:6de5

🇳🇱 213.176.26.19

🇨🇭 188.155.122.190

🇧🇷 177.72.78.147

🇫🇷 91.205.106.122

🇩🇪 64.89.163.251

🇺🇸 35.224.226.39

🇺🇸 35.196.250.241

🇺🇸 35.196.55.23

🇳🇱 34.141.184.57

🇺🇸 20.40.216.95

🇩🇪 2a12:bec4:1bb0:8e5::2

🇩🇪 195.63.24.246

🇺🇸 162.216.150.226