JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

20.48.89.150

Recent Activity

Abuse Confidence Score

100% Critical

180 reports

156 reporters · latest 1 hour ago

ISP: Microsoft Corporation
Usage Type: Data Center/Web Hosting/Transit
ASN: AS8075
Domain Name: microsoft.com
Country: 🇯🇵 Japan
City: Tokyo, Tokyo

ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report Whois

Example preview

Account required for the enhanced features Log in Sign up

Abuse Reports

Export reports CSV

Total reports

180 from 156 distinct reporters

First reported

November 13th 2026

Most recent report

1 hour ago

Last 60 days

Top reporter locations 🇩🇪 Germany 44 🇺🇸 United States of America 42 🇫🇷 France 22

Most common categories Web App Attack 143 Bad Web Bot 56 Brute-Force 44 Hacking 40 Port Scan 16

Recent reports We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇦🇲 arm osint	2026-11-14 06:38:38 UTC · (1 hour ago)	Automated web vulnerability scanning: 335 HTTP 4xx probes for sensitive paths (/.well-known/, /.well-known/acme-challenge/about.php, /.well-known/acme-challenge/admin.php, /.well-known/acme-challenge/index.php). Detected by Wazuh HIDS rule 31151 on a ... show more Automated web vulnerability scanning: 335 HTTP 4xx probes for sensitive paths (/.well-known/, /.well-known/acme-challenge/about.php, /.well-known/acme-challenge/admin.php, /.well-known/acme-challenge/index.php). Detected by Wazuh HIDS rule 31151 on a self-hosted web server. show less	Web App Attack Brute-Force
🇬🇧 openstrike.co.uk	2026-11-14 06:17:00 UTC · (1 hour ago)	97 attacks on PHP URLs, ACME URLs: GET /wp-content/plugins/fix/up.php HTTP/1.1 GET /.well-known/acme-challenge/about.php HTTP/1.1	Web App Attack
🇸🇪 vaia.cloud	2026-11-14 06:00:02 UTC · (1 hour ago)	crowdsecurity/http-admin-interface-probing	Brute-Force Web App Attack
🇩🇪 hchristo	2026-11-14 05:29:38 UTC · (2 hours ago)	[Sat Nov 14 06:29:35.917701 2026] [proxy_fcgi:error] [pid 60471:tid 60613] [remote 20.48.89.150:24786] AH01071: Got error 'Primary script unknown', referer: http://bewerbungsvorlagen.info/lock360.php [Sat Nov 14 06:29:36.399277 2026] [proxy_fcgi:erro ... show more [Sat Nov 14 06:29:35.917701 2026] [proxy_fcgi:error] [pid 60471:tid 60613] [remote 20.48.89.150:24786] AH01071: Got error 'Primary script unknown', referer: http://bewerbungsvorlagen.info/lock360.php [Sat Nov 14 06:29:36.399277 2026] [proxy_fcgi:error] [pid 60471:tid 60506] [remote 20.48.89.150:24786] AH01071: Got error 'Primary script unknown', referer: http://bewerbungsvorlagen.info/flower.php [Sat Nov 14 06:29:36.886642 2026] [proxy_fcgi:error] [pid 60471:tid 60512] [remote 20.48.89.150:24786] AH01071: Got error 'Primary script unknown', referer: http://bewerbungsvorlagen.info/13.php [Sat Nov 14 06:29:37.372604 2026] [proxy_fcgi:error] [pid 60471:tid 60509] [remote 20.48.89.150:24786] AH01071: Got error 'Primary script unknown', referer: http://bewerbungsvorlagen.info/wp-content.php.php [Sat Nov 14 06:29:37.865780 2026] [proxy_fcgi:error] [pid 60471:tid 60515] [remote 20.48.89.150:24786] AH01071: Got error 'Primary script unknown', referer: http://bewerbungsvorlagen.info/link.php ... show less	Brute-Force
🇩🇪 4server	2026-11-14 04:46:54 UTC · (3 hours ago)	[SatNov1405:46:52.0417572026][security2:error][pid3713363:tid3713411][client20.48.89.150:0]ModSecurity:Accessdeniedwithcode403\(phase1\).Stringmatch\"/xmlrpc.php\"atREQUEST_URI.[file\"/etc/apache2/conf.d/modsec_custom_rules.conf\"][line\"170\"][id\"9 ... show more [SatNov1405:46:52.0417572026][security2:error][pid3713363:tid3713411][client20.48.89.150:0]ModSecurity:Accessdeniedwithcode403\(phase1\).Stringmatch\"/xmlrpc.php\"atREQUEST_URI.[file\"/etc/apache2/conf.d/modsec_custom_rules.conf\"][line\"170\"][id\"960024\"][msg\"XML-RPCdisabled\"][hostname\"gmint.ch\"][uri\"/xmlrpc.php\"][unique_id\"avfnvCFmqJ5stRVAzgOR5gAAAEs\"] show less	Port Scan Brute-Force Web App Attack
🇫🇷 regishoussin	2026-11-14 04:29:21 UTC · (3 hours ago)	Automated web scanning detected by Wazuh (rule 100180): repeated 400/404 errors from mass probing of admin/backdoor paths (e.g. wp-login.php, known CMS shell filenames) on an Apache web server, on 2026-11-14 04:29 UTC.	Bad Web Bot Web App Attack
🇺🇸 WizardsToolkit	2026-11-14 03:55:00 UTC · (4 hours ago)	tried to access forbidden files; attempted to access /system_log.php	Web App Attack
Anonymous	2026-11-14 03:09:03 UTC · (4 hours ago)	Bot / scanning and/or hacking attempts: GET /lv.php HTTP/2.0, GET /Sanskrit.php HTTP/2.0, GET /xmlrpc.php HTTP/2.0, GET /new.php HTTP/2.0, GET /wp-content/plugins/dummyyummy/wp-signup.php HTTP/2.0, GET /403.php HTTP/2.0, GET /gecko.php HTTP/2.0, GET ... show more Bot / scanning and/or hacking attempts: GET /lv.php HTTP/2.0, GET /Sanskrit.php HTTP/2.0, GET /xmlrpc.php HTTP/2.0, GET /new.php HTTP/2.0, GET /wp-content/plugins/dummyyummy/wp-signup.php HTTP/2.0, GET /403.php HTTP/2.0, GET /gecko.php HTTP/2.0, GET /NewFile.php HTTP/2.0, GET /f35.php HTTP/2.0, GET /admin.php HTTP/2.0 show less	Hacking Web App Attack
🇺🇸 valornode	2026-11-14 02:52:31 UTC · (5 hours ago)	Detected by CrowdSec on www.iambrayden.net-47d88224: CrowdSec: crowdsecurity/http-crawl-non_statics \| ASN: 8075 (MICROSOFT-CORP-MSN-AS-BLOCK) \| Country: JP \| Range: 20.48.0.0/12	Brute-Force SSH
🇸🇪 SkyDancer	2026-11-14 02:46:51 UTC · (5 hours ago)	Multiple unauthorized attempts to access using wrong credentials. Attack automatically blocked by SkyDancer Ai. EXT-SYS-Vx	Hacking Brute-Force SSH
🇺🇸 TPI-Abuse	2026-11-14 02:43:05 UTC · (5 hours ago)	(mod_security) mod_security (id:210492) triggered by 20.48.89.150 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 13 21:43:00.974016 2026] [security2:error] [pid 19965:tid 19965] [client 20.48.89.150:52811] Mod ... show more (mod_security) mod_security (id:210492) triggered by 20.48.89.150 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 13 21:43:00.974016 2026] [security2:error] [pid 19965:tid 19965] [client 20.48.89.150:52811] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "thebibleandscience.net"] [uri "/wp-config.php"] [unique_id "avfKtOhEVnbo5E9XeuL_QgAAAAI"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 Aurealize	2026-11-14 02:38:55 UTC · (5 hours ago)	Automated Sensitive File discovery attempt detected by a Cloudflare WAF custom rule. Path: /wp-fmfile.php.	Web App Attack Hacking
🇳🇱 e.fierstra	2026-11-14 02:33:57 UTC · (5 hours ago)	excessive HTTP 404 errors	Bad Web Bot
🇵🇫 www.gregorymariani.com	2026-11-14 02:30:10 UTC · (5 hours ago)		Web App Attack
🇺🇸 augustseo	2026-11-14 02:28:15 UTC · (5 hours ago)	19 exploit-probe requests, each answered 403 between 2026-11-14T02:28:15Z and 2026-11-14T02:28:15Z. Signatures: server-script x14, wordpress x5 Paths: /13.php /wi.php /403.php /alfa.php /link.php /input.php /flower.php /lock360.php User agent: Mozill ... show more 19 exploit-probe requests, each answered 403 between 2026-11-14T02:28:15Z and 2026-11-14T02:28:15Z. Signatures: server-script x14, wordpress x5 Paths: /13.php /wi.php /403.php /alfa.php /link.php /input.php /flower.php /lock360.php User agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Query strings omitted. Timestamp is the last hit observed. show less	Brute-Force Bad Web Bot Web App Attack

Showing 1 to 15 of 180 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown

Recently Reported IPs:

🇭🇰 223.197.146.158

🇳🇱 195.178.110.217

🇿🇦 152.110.155.64

🇹🇭 119.46.254.1

🇹🇭 202.29.220.106

🇹🇼 198.235.24.122

🇨🇴 190.108.78.119

🇨🇭 179.43.153.2

🇳🇱 93.123.109.82

🇺🇸 50.6.207.102

🇮🇷 2.189.86.115

🇺🇸 207.254.40.89

🇩🇪 164.92.137.137

🇺🇸 162.216.149.93

🇱🇻 136.169.23.104

🇹🇼 111.70.13.54

🇳🇱 109.160.32.179

🇷🇺 93.100.253.215

🇮🇹 84.220.97.8

🇺🇸 192.24.222.125