JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 20.203.149.189

20.203.149.189 was found in our database!

This IP was reported 882 times. Confidence of Abuse is 100%: ?

100%

ISP	Microsoft Corporation
Usage Type	Data Center/Web Hosting/Transit
ASN	AS8075
Domain Name	microsoft.com
Country	🇨🇭 Switzerland
City	Zurich, Zurich

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 20.203.149.189

Whois 20.203.149.189

IP Abuse Reports for 20.203.149.189:

This IP address has been reported a total of 882 times from 296 distinct sources. 20.203.149.189 was first reported on August 3rd 2026, and the most recent report was 1 day ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇫🇷 Catalin Negru	2026-08-27 16:05:56 (1 day ago)	Recidive ban by fail2ban on server.blackbit.ro	Brute-Force
🇫🇷 Catalin Negru	2026-08-26 09:22:55 (2 days ago)	Recidive ban by fail2ban on server.blackbit.ro	Brute-Force
🇩🇪 ghostwarriors	2026-08-23 16:51:20 (5 days ago)	Webpage scraping	Brute-Force Bad Web Bot Web App Attack
🇩🇪 arnisolutions	2026-08-19 12:03:01 (1 week ago)	Vulnerability scanning (requests for admin panels, shells, backup files etc.) against a production s ... show more Vulnerability scanning (requests for admin panels, shells, backup files etc.) against a production server. Observed on 6 day(s) between 2026-08-14 and 2026-08-18 (UTC). show less	Web App Attack Hacking
Anonymous	2026-08-16 19:48:05 (1 week ago)	$f2bV_matches	Brute-Force
🇬🇧 thetomtaylor.co.uk	2026-08-16 02:08:01 (1 week ago)	Fail2Ban - [NGINX]WordPress Logins Sniffings on nginx-wordpress-sniffer ... [ice01,ice02,wa01,wa02]	Bad Web Bot Web App Attack
🇬🇧 thetomtaylor.co.uk	2026-08-16 01:07:02 (1 week ago)	Fail2Ban - [NGINX]WordPress Logins Sniffings on nginx-wordpress-sniffer ... [mx02]	Bad Web Bot Web App Attack
🇮🇳 evicky2002	2026-08-14 06:00:12 (2 weeks ago)	Confirmed malicious by STILWaters CTI platform (score=100, sources=1)	Hacking Brute-Force SSH
🇧🇷 Peregrine	2026-08-13 03:14:55 (2 weeks ago)	Fail2Ban ct101 Jail: tomcat-honeypot \| Evidence: 20.203.149.189 162.158.217.69 - - [10/Aug/2026:04:3 ... show more Fail2Ban ct101 Jail: tomcat-honeypot \| Evidence: 20.203.149.189 162.158.217.69 - - [10/Aug/2026:04:33:37 -0300] "GET /wk/index.php HTTP/1.1" 404 18193 show less	Bad Web Bot
🇧🇷 Peregrine	2026-08-12 03:14:51 (2 weeks ago)	Fail2Ban ct101 Jail: tomcat-honeypot \| Evidence: 20.203.149.189 162.158.217.69 - - [10/Aug/2026:04:3 ... show more Fail2Ban ct101 Jail: tomcat-honeypot \| Evidence: 20.203.149.189 162.158.217.69 - - [10/Aug/2026:04:33:37 -0300] "GET /wk/index.php HTTP/1.1" 404 18193 show less	Bad Web Bot
🇧🇷 Peregrine	2026-08-11 03:11:58 (2 weeks ago)	Fail2Ban ct101 Jail: tomcat-404 \| Evidence: 20.203.149.189 162.158.217.69 - - [10/Aug/2026:04:33:38 ... show more Fail2Ban ct101 Jail: tomcat-404 \| Evidence: 20.203.149.189 162.158.217.69 - - [10/Aug/2026:04:33:38 -0300] "GET /aa.php HTTP/1.1" 404 18193 20.203.149.189 162.158.217.145 - - [10/Aug/2026:04:33:38 -0300] "GET /w.php HTTP/1.1" 404 18193 20.203.149.189 162.158.217.69 - - [10/Aug/2026:04:33:39 -0300] "GET /admin.php HTTP/1.1" 404 18193 20.203.149.189 162.158.217.145 - - [10/Aug/2026:04:33:39 -0300] "GET /wp-content/themes/admin.php HTTP/1.1" 404 18193 20.203.149.189 162.158.217.69 - - [10/Aug/2026:04:33:39 -0300] "GET /m.php HTTP/1.1" 404 18193 show less	Bad Web Bot Web App Attack
🇩🇪 SiyCah	2026-08-11 03:00:02 (2 weeks ago)	IP banned by fail2ban; banned in jail apache-auth. Report generated by fail2abuseipdb.	Hacking Brute-Force Web App Attack
🇨🇳 primal	2026-08-10 23:13:11 (2 weeks ago)	Automated attack traffic against a WordPress site: WordPress xmlrpc.php attack (2x); webshell/backdo ... show more Automated attack traffic against a WordPress site: WordPress xmlrpc.php attack (2x); webshell/backdoor probe (1x); CDN web firewall rule triggered (1x). Blocked by CDN/WAF/application security layers. Total 4 hits in last 30 days. show less	Brute-Force Exploited Host Web App Attack
🇺🇸 SX Communications	2026-08-10 22:58:53 (2 weeks ago)	Web vulnerability scanning / probing from 20.203.149.189: automated requests for CMS admin paths, lo ... show more Web vulnerability scanning / probing from 20.203.149.189: automated requests for CMS admin paths, login endpoints, xmlrpc, and common scanner fingerprints over HTTPS. 15 hits; paths: /room.php, /alfa-rex.php, /colors.php, /contentloader1.php, /v4.php. show less	Port Scan Hacking Web App Attack
🇪🇸 el-brujo	2026-08-10 22:17:32 (2 weeks ago)	20.203.149.189 - - [11/Aug/2026:00:17:28 +0200] "GET /meta.php HTTP/2.0" 404 36 "-" "Mozilla/5.0 (Wi ... show more 20.203.149.189 - - [11/Aug/2026:00:17:28 +0200] "GET /meta.php HTTP/2.0" 404 36 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.203.149.189 - - [11/Aug/2026:00:17:28 +0200] "GET /yindu.php HTTP/2.0" 404 36 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.203.149.189 - - [11/Aug/2026:00:17:29 +0200] "GET /randkeyword.php HTTP/2.0" 404 36 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.203.149.189 - - [11/Aug/2026:00:17:29 +0200] "GET /hehe.php HTTP/2.0" 404 36 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.203.149.189 - - [11/Aug/2026:00:17:29 +0200] "GET /user.php HTTP/2.0" 404 36 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20 ... show less	DDoS Attack Hacking

Showing 1 to 15 of 882 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇨🇱 186.103.169.12

🇺🇸 162.0.229.50

🇻🇳 103.48.192.48

🇫🇷 91.196.152.174

🇳🇱 91.92.40.108

🇳🇱 185.242.226.58

🇺🇸 152.32.206.181

🇫🇮 147.185.133.45

🇨🇦 20.104.18.15

🇺🇸 185.251.19.170

🇰🇷 123.58.200.120

🇱🇹 62.60.130.242

🇩🇪 43.228.157.9

🇺🇸 172.191.239.155

🇮🇩 34.50.107.223

🇸🇬 47.82.11.190

🇩🇪 43.131.17.204

🇲🇽 38.22.170.10

🇹🇷 82.153.241.30

🇳🇱 45.148.10.141