AbuseIPDB » 20.249.92.222

20.249.92.222 was found in our database!

This IP was reported 34 times. Confidence of Abuse is 0%: ?

ISP	Microsoft Corporation
Usage Type	Data Center/Web Hosting/Transit
Domain Name	microsoft.com
Country	Korea (the Republic of)
City	Seoul, Seoul-teukbyeolsi

IP info including ISP, Usage Type, and Location provided by IP2Location. Updated monthly.

Report 20.249.92.222

Whois 20.249.92.222

IP Abuse Reports for 20.249.92.222:

This IP address has been reported a total of 34 times from 25 distinct sources. 20.249.92.222 was first reported on May 20th 2024, and the most recent report was 3 months ago.

Old Reports: The most recent abuse report for this IP address is from 3 months ago. It is possible that this IP is no longer involved in abusive activities.

Reporter	IoA Timestamp in UTC	Comment	Categories
Linuxmalwarehuntingnl	2024-06-30 09:44:37 (3 months ago)	Unauthorized connection attempt	Brute-Force
Linuxmalwarehuntingnl	2024-06-30 09:40:59 (3 months ago)	Unauthorized connection attempt	Brute-Force
Kepler-1649c	2024-06-21 21:50:00 (3 months ago)	Spam	Email Spam Email Spam
Anonymous	2024-06-21 08:43:43 (3 months ago)	Jun 21 10:43:42 gollum postfix/smtpd[1756524]: NOQUEUE: reject: RCPT from unknown[20.249.92.222]: 55 ... show moreJun 21 10:43:42 gollum postfix/smtpd[1756524]: NOQUEUE: reject: RCPT from unknown[20.249.92.222]: 554 5.7.1 Service unavailable; Client host [20.249.92.222] blocked using zen.spamhaus.org; Listed by CSS, see https://check.spamhaus.org/query/ip/20.249.92.222 / Listed by XBL, see https://check.spamhaus.org/query/ip/20.249.92.222; from=<[email protected]> to=<[email protected]> proto=ESMTP helo=<zincirlivinc.com> ... show less	Email Spam Email Spam
zwh	2024-06-20 21:33:32 (3 months ago)	Attack for XMLRPC	Web App Attack Web App Attack
syokadmin	2024-06-20 06:32:00 (3 months ago)	(smtpauth) Failed SMTP AUTH login from 20.249.92.222 (KR/South Korea/-): 2 in the last 3600 secs	Brute-Force Brute-Force
Fusl	2024-06-20 06:31:10 (3 months ago)	from [email protected] to [email protected] size 434 auth CRAM-MD5 (dat ... show morefrom [email protected] to [email protected] size 434 auth CRAM-MD5 (data="[email protected] ea236000b08c2f9adf5d7a5f51b126c0") show less	Email Spam Email Spam
Anonymous	2024-06-20 06:16:51 (3 months ago)	Ports: 25,465,587; Direction: 0; Trigger: LF_DISTATTACK	Brute-Force Brute-Force SSH SSH
openstrike.co.uk	2024-06-20 06:15:53 (3 months ago)	10 packets to port 465	Brute-Force Brute-Force
final	2024-06-20 06:15:12 (3 months ago)	Jun 20 07:19:44 xxxxx postfix/smtpd[856143]: lost connection after RCPT from unknown[20.249.92.222]< ... show moreJun 20 07:19:44 xxxxx postfix/smtpd[856143]: lost connection after RCPT from unknown[20.249.92.222] Jun 20 07:35:53 xxxxx postfix/smtpd[856210]: lost connection after EHLO from unknown[20.249.92.222] Jun 20 08:10:36 xxxxx postfix/smtpd[856412]: lost connection after EHLO from unknown[20.249.92.222] Jun 20 08:15:11 xxxxx postfix/smtpd[856416]: NOQUEUE: reject: RCPT from unknown[20.249.92.222]: 550 5.7.1 <[email protected]>: Recipient address rejected: Your MTA is listed in too many DNSBLs; check http://www.robtex.com/rbl/20.249.92.222.html; from=<[email protected]> to=<[email protected]> proto=ESMTP helo=<palette-link.com> show less	Phishing Phishing Email Spam Email Spam Spoofing Spoofing
Anonymous	2024-06-20 04:58:30 (3 months ago)	$f2bV_matches	Email Spam Email Spam Hacking Hacking Brute-Force Brute-Force
no1.com.au	2024-06-20 04:27:00 (3 months ago)	SPAM	Email Spam Email Spam
TPI-Abuse	2024-06-20 03:45:29 (3 months ago)	(mod_security) mod_security (id:240335) triggered by 20.249.92.222 (-): 1 in the last 300 secs; Port ... show more(mod_security) mod_security (id:240335) triggered by 20.249.92.222 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jun 19 23:45:23.568267 2024] [security2:error] [pid 15211] [client 20.249.92.222:47466] [client 20.249.92.222] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 20.249.92.222 (+1 hits since last alert)\|www.3penguinsdesign.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "www.3penguinsdesign.com"] [uri "/xmlrpc.php"] [unique_id "ZnOl08nw6gILQtD1wFOPFgAAAAg"] show less	Brute-Force Brute-Force Bad Web Bot Bad Web Bot Web App Attack Web App Attack
TPI-Abuse	2024-06-20 03:20:46 (3 months ago)	(mod_security) mod_security (id:240335) triggered by 20.249.92.222 (-): 1 in the last 300 secs; Port ... show more(mod_security) mod_security (id:240335) triggered by 20.249.92.222 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jun 19 23:20:39.340882 2024] [security2:error] [pid 10408] [client 20.249.92.222:50770] [client 20.249.92.222] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 141.98.102.187 (0+1 hits since last alert)\|www.fltsiminc.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "www.fltsiminc.com"] [uri "/xmlrpc.php"] [unique_id "ZnOgB02Q4wsJvDNnODd6FAAAAAQ"] show less	Brute-Force Brute-Force Bad Web Bot Bad Web Bot Web App Attack Web App Attack
Anonymous	2024-06-20 01:05:28 (3 months ago)	postfix	Email Spam Email Spam