JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 20.203.243.252

20.203.243.252 was found in our database!

This IP was reported 139 times. Confidence of Abuse is 100%: ?

100%

ISP	Microsoft Corporation
Usage Type	Data Center/Web Hosting/Transit
ASN	AS8075
Domain Name	microsoft.com
Country	🇨🇭 Switzerland
City	Zurich, Zurich

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 20.203.243.252

Whois 20.203.243.252

IP Abuse Reports for 20.203.243.252:

This IP address has been reported a total of 139 times from 121 distinct sources. 20.203.243.252 was first reported on July 24th 2026, and the most recent report was 1 hour ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇬🇧 openstrike.co.uk	2026-07-26 05:14:02 (1 hour ago)	91 attacks on PHP URLs: GET /php.php HTTP/1.1	Web App Attack
🇲🇽 octageeks.com	2026-07-26 04:07:18 (2 hours ago)	Wordpress malicious attack:[octablocked]	Web App Attack
🇳🇱 Site.eu	2026-07-25 23:55:18 (6 hours ago)	Excessive multi-domain requests	Brute-Force
Anonymous	2026-07-25 18:05:08 (12 hours ago)	Blocked by FortiWeb WAF ML threat detection. ML probability: 99%, Country: CH, Attack patterns: Word ... show more Blocked by FortiWeb WAF ML threat detection. ML probability: 99%, Country: CH, Attack patterns: WordPress scanning, Webshell probing show less	Bad Web Bot Web App Attack
🇹🇭 thaizone.com	2026-07-25 15:44:31 (14 hours ago)	Hacking attempts against websites (D1) #2	Web App Attack Hacking
🇩🇪 4server	2026-07-25 15:07:51 (15 hours ago)	[SatJul2517:07:45.9895392026][security2:error][pid115449:tid115556][client20.203.243.252:0]ModSecuri ... show more [SatJul2517:07:45.9895392026][security2:error][pid115449:tid115556][client20.203.243.252:0]ModSecurity:Accessdeniedwithcode403$phase1$.Patternmatch\"\^/wp-content/uploads/.\*\\\\\\\\.$php\\|phtml\\|phar\\|php3\\|php4\\|php5\\|php7$\$\"atREQUEST_URI.[file\"/etc/apache2/conf.d/modsec_custom_rules.conf\"][line\"395\"][id\"1101018\"][msg\"PHPexecutionfromuploads\"][hostname\"gm-swiss.ch\"][uri\"/wp-content/uploads/min.php\"][unique_id\"amTRQeBbhZyBbbm79GdVlAAAANU\"] show less	Port Scan Brute-Force Web App Attack
🇫🇮 Christopher Hughes	2026-07-25 15:03:41 (15 hours ago)	[Sat Jul 25 16:03:40.909787 2026] [proxy_fcgi:error] [pid 2191578:tid 139826149979712] [client 20.20 ... show more [Sat Jul 25 16:03:40.909787 2026] [proxy_fcgi:error] [pid 2191578:tid 139826149979712] [client 20.203.243.252:8597] AH01071: Got error 'Primary script unknown' [Sat Jul 25 16:03:41.023495 2026] [proxy_fcgi:error] [pid 2191578:tid 139826108016192] [client 20.203.243.252:8597] AH01071: Got error 'Primary script unknown' [Sat Jul 25 16:03:41.061991 2026] [proxy_fcgi:error] [pid 2191578:tid 139826418415168] [client 20.203.243.252:8597] AH01071: Got error 'Primary script unknown' [Sat Jul 25 16:03:41.125408 2026] [proxy_fcgi:error] [pid 2191578:tid 139825193670208] [client 20.203.243.252:8597] AH01071: Got error 'Primary script unknown' [Sat Jul 25 16:03:41.163572 2026] [proxy_fcgi:error] [pid 2191578:tid 139826401629760] [client 20.203.243.252:8597] AH01071: Got error 'Primary script unknown' ... show less	Web App Attack
🇺🇸 Mehmet_The_Script_Kiddie	2026-07-25 13:54:30 (16 hours ago)	CloudFlare WAF REPORT: /1.php	Bad Web Bot Web App Attack
🇩🇪 Ba-Yu	2026-07-25 13:48:19 (16 hours ago)	WordPress bruteforce	Web Spam Hacking Brute-Force Exploited Host Web App Attack
🇮🇩 soc-yk	2026-07-25 13:30:11 (17 hours ago)	Type: suspicious_network_activity Risk: 82 Events: 62 Evidence: - Persistent suspicious network act ... show more Type: suspicious_network_activity Risk: 82 Events: 62 Evidence: - Persistent suspicious network activity detected - Repeated hostile operational behavior observed - Multi-event operational persistence identified - Threat escalation behavior observed show less	Port Scan Hacking
🇩🇪 macrob	2026-07-25 13:23:22 (17 hours ago)	2026/07/25 13:23:21 [error] 2300184#2300184: 410189098 access forbidden by rule, client: 20.203.243 ... show more 2026/07/25 13:23:21 [error] 2300184#2300184: 410189098 access forbidden by rule, client: 20.203.243.252, server: binixo.lk, request: "GET /admin.php HTTP/2.0", host: "binixo.lk" 2026/07/25 13:23:21 [error] 2300184#2300184: 410189097 access forbidden by rule, client: 20.203.243.252, server: binixo.lk, request: "GET /adminfuns.php HTTP/2.0", host: "binixo.lk" 2026/07/25 13:23:21 [error] 2300184#2300184: 410189102 access forbidden by rule, client: 20.203.243.252, server: binixo.lk, request: "GET /wp-admin/ HTTP/2.0", host: "binixo.lk" ... show less	Web App Attack
🇩🇪 ketovoila.pl	2026-07-25 13:09:10 (17 hours ago)	ketovoila.pl web app/PHP backdoor scan: hits=18; unique_paths=18; sample_paths=/155.php,/222.php,/66 ... show more ketovoila.pl web app/PHP backdoor scan: hits=18; unique_paths=18; sample_paths=/155.php,/222.php,/666.php; UA="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36"; window=2026-07-25T13:09:10Z..2026-07-25T13:09:10Z show less	Bad Web Bot Web App Attack
🇺🇸 gerensat	2026-07-25 12:48:24 (17 hours ago)	2026-07-25 09:48:24 \| /inputs.php \| [] \| Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.3 ... show more 2026-07-25 09:48:24 \| /inputs.php \| [] \| Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 show less	Web App Attack
🇩🇪 Lino Project	2026-07-25 12:27:36 (18 hours ago)	CrowdSec abuse IP report (host SRV-2) Scenario: crowdsecurity/http-probing	Hacking
🇫🇷 Thaliruth	2026-07-25 12:03:37 (18 hours ago)	20.203.243.252 - - [25/Jul/2026:14:03:37 +0200] "GET /admin.php HTTP/1.1" 404 635 "-" "Mozilla/5.0 ( ... show more 20.203.243.252 - - [25/Jul/2026:14:03:37 +0200] "GET /admin.php HTTP/1.1" 404 635 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" ... show less	Brute-Force Web App Attack

Showing 1 to 15 of 139 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇮🇳 223.181.122.44

🇩🇪 207.154.197.113

🇲🇽 187.191.36.106

🇨🇳 171.8.42.112

🇨🇦 165.227.39.235

🇬🇧 87.236.176.78

🇦🇺 65.254.93.170

🇹🇭 45.194.70.250

🇨🇳 42.51.13.91

🇸🇳 41.214.55.235

🇿🇦 41.193.100.133

🇬🇧 35.203.211.25

🇦🇴 193.163.125.60

🇬🇧 193.46.0.137

🇺🇸 192.177.105.31

🇩🇪 164.92.173.211

🇫🇮 147.185.133.149

🇫🇮 147.185.133.13

🇭🇰 118.193.45.134

🇮🇩 103.97.101.25