JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 20.239.48.157

20.239.48.157 was found in our database!

This IP was reported 170 times. Confidence of Abuse is 100%: ?

100%

ISP	Microsoft Corporation
Usage Type	Data Center/Web Hosting/Transit
ASN	AS8075
Domain Name	microsoft.com
Country	🇭🇰 Hong Kong
City	Hong Kong

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 20.239.48.157

Whois 20.239.48.157

IP Abuse Reports for 20.239.48.157:

This IP address has been reported a total of 170 times from 149 distinct sources. 20.239.48.157 was first reported on July 8th 2026, and the most recent report was 56 seconds ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇺🇦 URAN Publishing Service	2026-07-08 14:36:11 (56 seconds ago)	20.239.48.157 - - [08/Jul/2026:17:36:10 +0300] "GET /wp-content/plugins/hellopress/wp_filemanager.ph ... show more 20.239.48.157 - - [08/Jul/2026:17:36:10 +0300] "GET /wp-content/plugins/hellopress/wp_filemanager.php HTTP/1.1" 404 702 "-" "-" ... show less	Web App Attack
🇩🇪 AetherFox	2026-07-08 14:35:59 (1 minute ago)	AetherFox VoidGuard detected: [Wed Jul 08 14:35:58.413368 2026] [authz_core:error] [pid 4155082:tid ... show more AetherFox VoidGuard detected: [Wed Jul 08 14:35:58.413368 2026] [authz_core:error] [pid 4155082:tid 4155090] [client 20.239.48.157:60964] AH01630: client denied by server configuration: proxy:https://hq.draconigen.net.dedivirt4209.your-server.de/adminfuns.php [Wed Jul 08 14:35:58.413551 2026] [authz_core:error] [pid 4155082:tid 4155090] [client 20.239.48.157:60964] AH01630: client denied by server configuration: /var/www/html/ERRORpages/403.html [Wed Jul 08 14:35:58.622296 2026] [authz_core:error] [pid 4155082:tid 4155107] [client 20.239.48.157:60964] AH01630: client denied by server configuration: proxy:https://hq.draconigen.net.dedivirt4209.your-server.de/file.php [Wed Jul 08 14:35:58.622474 2026] [authz_core:error] [pid 4155082:tid 4155107] [client 20.239.48.157:60964] AH01630: client denied by server configuration: /var/www/html/ERRORpages/403.html [Wed Jul 08 14:35:58.850880 2026] [authz_core:error] [pid 4155082:tid 4155093] [client 20.239.48.157:60964] AH01630 ... show less	Bad Web Bot Web App Attack
Anonymous	2026-07-08 14:31:15 (5 minutes ago)	(PERMBLOCK) 20.239.48.157 (HK/Hong Kong/-) has had more than 4 temp blocks in the last 86400 secs; P ... show more (PERMBLOCK) 20.239.48.157 (HK/Hong Kong/-) has had more than 4 temp blocks in the last 86400 secs; Ports: *; Direction: inout; Trigger: LF_PERMBLOCK_COUNT; Logs: show less	Port Scan
🇩🇪 Skyrider	2026-07-08 14:27:54 (9 minutes ago)	Nginx: HTTP 4xx probe/scan attempts. Automated fail2ban report.	Bad Web Bot Web App Attack
🇳🇱 Brict IT	2026-07-08 14:27:18 (9 minutes ago)		Bad Web Bot Web App Attack
🇵🇱 strefapi_com	2026-07-08 14:26:21 (10 minutes ago)	Brute-force, web ...	Hacking Brute-Force Web App Attack
🇩🇪 nyt	2026-07-08 14:25:16 (11 minutes ago)	Hacking, Web App Attack, suspicious: Web Shell Upload	Hacking Web App Attack
Anonymous	2026-07-08 14:25:11 (11 minutes ago)	Automatically blocked after 21 security events. Observed repeated web application attack probes. Sou ... show more Automatically blocked after 21 security events. Observed repeated web application attack probes. Source: Cloudflare security controls. show less	Hacking Web App Attack
🇩🇪 roxyapi	2026-07-08 14:24:01 (13 minutes ago)	Honeypot: automated vulnerability scan / web app attack. Last probe: GET /admin.php	Web App Attack Bad Web Bot
🇱🇻 garmtech.com	2026-07-08 14:21:32 (15 minutes ago)	Attempted access to sensitive endpoint (/wp-admin/network/index.php) detected. Automated scan or una ... show more Attempted access to sensitive endpoint (/wp-admin/network/index.php) detected. Automated scan or unauthorized probing. show less	Web App Attack
🇬🇷 setupgr	2026-07-08 14:20:14 (16 minutes ago)	(mod_security) mod_security (id:1000001) triggered by 20.239.48.157 (HK/Hong Kong/Kowloon/Hong Kong/ ... show more (mod_security) mod_security (id:1000001) triggered by 20.239.48.157 (HK/Hong Kong/Kowloon/Hong Kong/-/[AS8075 MICROSOFT-CORP-MSN-AS-BLOCK]): 1 in the last 86400 secs (CF_ENABLE); Ports: *; Direction: inout; Trigger: LF_MODSEC; Logs: [Wed Jul 08 17:20:11.901761 2026] [security2:error] [pid 1878039:tid 1878089] [client 20.239.48.157:64995] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/about.php" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec/modsec2.user.conf"] [line "103"] [id "1000001"] [msg "Bad file blocked: /about.php"] [severity "CRITICAL"] [tag "security"] [hostname "mail.ions.gr"] [uri "/about.php"] [unique_id "ak5cm_C2BFVhNwXXHkEo3AAAARU"] show less	Port Scan
🇧🇾 lns.bz	2026-07-08 14:18:43 (18 minutes ago)	Too many 404 requests [BY]	Web App Attack
🇬🇧 Swiptly	2026-07-08 14:15:43 (21 minutes ago)	Excessive 403/404/405 PHP/CMS errors from scanning or broken bots ...	Web App Attack
Anonymous	2026-07-08 14:04:34 (32 minutes ago)	(wordpress) Failed login wp-login.php or xmlrpc.php	Web App Attack
🇨🇭 blinx	2026-07-08 14:03:21 (33 minutes ago)	Suspicious activity detected by Modsecurity	Web Spam Port Scan Hacking Bad Web Bot Web App Attack

Showing 1 to 15 of 170 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇻🇳 180.93.0.112

🇩🇪 167.94.146.73

🇱🇹 45.227.254.170

🇦🇲 178.160.211.25

🇧🇷 177.152.21.49

🇰🇷 118.37.214.187

🇺🇸 5.56.24.71

🇳🇱 195.178.110.137

🇺🇦 195.49.128.211

🇳🇱 193.25.217.42

🇵🇱 176.53.159.38

🇵🇰 103.66.148.82

🇮🇷 2.189.5.142

🇺🇸 2602:80d:1007::59

🇮🇳 171.61.22.56

🇮🇹 95.234.93.103

🇮🇷 91.133.191.124

🇺🇸 64.44.61.101

🇷🇺 46.254.17.143

🇺🇸 18.191.226.142