JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 20.53.249.197

20.53.249.197 was found in our database!

This IP was reported 478 times. Confidence of Abuse is 100%: ?

100%

ISP	Microsoft Corporation
Usage Type	Data Center/Web Hosting/Transit
ASN	AS8075
Domain Name	microsoft.com
Country	🇦🇺 Australia
City	Sydney, New South Wales

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 20.53.249.197

Whois 20.53.249.197

IP Abuse Reports for 20.53.249.197:

This IP address has been reported a total of 478 times from 194 distinct sources. 20.53.249.197 was first reported on October 19th 2026, and the most recent report was 56 minutes ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇩🇪 4server	2026-10-23 16:27:43 (56 minutes ago)	[FriOct2318:27:40.5593042026][security2:error][pid2814895:tid2814991][client20.53.249.197:0]ModSecur ... show more [FriOct2318:27:40.5593042026][security2:error][pid2814895:tid2814991][client20.53.249.197:0]ModSecurity:Accessdeniedwithcode403$phase1$.Patternmatch\"\^/wp-content/uploads/.\*\\\\\\\\.$php\\|phtml\\|phar\\|php3\\|php4\\|php5\\|php7$\$\"atREQUEST_URI.[file\"/etc/apache2/conf.d/modsec_custom_rules.conf\"][line\"395\"][id\"1101018\"][msg\"PHPexecutionfromuploads\"][hostname\"alessandrolucchini.ch\"][uri\"/wp-content/uploads/index.php\"][unique_id\"atuK_HmQx5rCoi55FK_KhQAAAUg\"] show less	Port Scan Brute-Force Web App Attack
🇵🇱 strefapi_com	2026-10-23 16:10:25 (1 hour ago)	Brute-force, web ...	Hacking Brute-Force Web App Attack
🇩🇪 usc-IPDB	2026-10-23 16:06:45 (1 hour ago)	20.53.249.197 - - [23/Oct/2026:18:06:44 +0200] "GET /wk/index.php HTTP/1.1" 404 181 "-" "Mozilla/5.0 ... show more 20.53.249.197 - - [23/Oct/2026:18:06:44 +0200] "GET /wk/index.php HTTP/1.1" 404 181 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.53.249.197 - - [23/Oct/2026:18:06:44 +0200] "GET /inputs.php HTTP/1.1" 404 181 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.53.249.197 - - [23/Oct/2026:18:06:44 +0200] "GET /ioxi-o.php HTTP/1.1" 404 181 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" ... show less	Port Scan
🇩🇪 tikket	2026-10-23 15:33:07 (1 hour ago)	Automated honeypot report: fail2ban 'caddy-honeypot' ban. Source probed honeypot/recon endpoints on ... show more Automated honeypot report: fail2ban 'caddy-honeypot' ban. Source probed honeypot/recon endpoints on void.xn--q9jyb4c. show less	Bad Web Bot Web App Attack
🇵🇱 sledzik1984	2026-10-23 15:28:04 (1 hour ago)	20.53.249.197 - - [23/Oct/2026:17:27:59 +0200] "GET /wk/index.php HTTP/1.1" 404 188 "-" "Mozilla/5.0 ... show more 20.53.249.197 - - [23/Oct/2026:17:27:59 +0200] "GET /wk/index.php HTTP/1.1" 404 188 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.53.249.197 - - [23/Oct/2026:17:28:01 +0200] "GET /function/function.php HTTP/1.1" 404 188 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.53.249.197 - - [23/Oct/2026:17:28:03 +0200] "GET /wp-content/uploads/index.php HTTP/1.1" 404 188 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" ... show less	Web App Attack
🇳🇱 Site.eu	2026-10-23 14:51:53 (2 hours ago)	Excessive multi-domain requests	Brute-Force
🇫🇷 francoisunix	2026-10-23 14:21:50 (3 hours ago)	20.53.249.197 - - [23/Oct/2026:14:21:39 +0000] "GET /wp-login.php HTTP/1.0" 401 15722 "-" "Mozilla/5 ... show more 20.53.249.197 - - [23/Oct/2026:14:21:39 +0000] "GET /wp-login.php HTTP/1.0" 401 15722 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.53.249.197 - - [23/Oct/2026:14:21:45 +0000] "GET /wp-includes/ HTTP/1.0" 403 548 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.53.249.197 - - [23/Oct/2026:14:21:46 +0000] "GET /cgi-bin/ HTTP/1.0" 403 548 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.53.249.197 - - [23/Oct/2026:14:21:47 +0000] "GET /wp-admin/images/ HTTP/1.0" 403 548 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.53.249.197 - - [23/Oct/2026:14:21:48 +0000] "GET /wp-includes/html-api/ HTTP/1.0" 403 548 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120. ... show less	Web App Attack
🇳🇱 Alt255	2026-10-23 14:02:12 (3 hours ago)	[ti-27al] Excessive 404 errors (web scanning): 25 suspicious requests detected by fail2ban jail apac ... show more [ti-27al] Excessive 404 errors (web scanning): 25 suspicious requests detected by fail2ban jail apache-404. Example: 20.53.249.197 - - [23/Oct/2026:16:01:47 +0200] "GET /inputs.php HTTP/1.1" 404 1987 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.53.249.197 - - [23/Oct/2026:16:01:48 +0200] "GET /ioxi-o.php HTTP/1.1" 404 1987 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.53.249.197 - - [23/Oct/2026:16:01:48 +0200] "GET /function/function.php HTTP/1.1" 404 1987 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.53.249.197 - - [23/Oct/2026:16:01:49 +0200] "GET /rip.php HTTP/1.1" 404 1987 "-" "Mozilla/5 ... show less	Bad Web Bot Web App Attack
🇺🇸 Steven Cohen	2026-10-23 14:00:02 (3 hours ago)	Blocked by GRVHulk. Path: /wp-login.php	Web App Attack
🇩🇪 Gwyneth Llewelyn	2026-10-23 13:24:49 (3 hours ago)	20.53.249.197 - - [23/Oct/2026:14:24:48 +0100] "GET /cgi-bin/ HTTP/1.1" 404 1006 "-" "Mozilla/5.0 (W ... show more 20.53.249.197 - - [23/Oct/2026:14:24:48 +0100] "GET /cgi-bin/ HTTP/1.1" 404 1006 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" show less	Bad Web Bot
🇺🇸 ctidrv	2026-10-23 12:58:14 (4 hours ago)	Honeypot detection. Threat score: 90/100. Collector: shell_trap. \| Request: GET /wp-content/uploads/ ... show more Honeypot detection. Threat score: 90/100. Collector: shell_trap. \| Request: GET /wp-content/uploads/index.php \| UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 \| rDNS: 20.53.249.197 \| Attacks detected: webshell \| Reasons: webshell_probe show less	Web App Attack Exploited Host
Anonymous	2026-10-23 12:15:38 (5 hours ago)	20.53.249.197 (AU/Australia/New South Wales/Sydney/-/[redacted]), more than 10 Apache 403 hits	Hacking
🇺🇸 epixian	2026-10-23 12:05:03 (5 hours ago)	Scraper posing as a browser: 73 page requests in 15 min, 2 redirected requests, 0 asset requests (pa ... show more Scraper posing as a browser: 73 page requests in 15 min, 2 redirected requests, 0 asset requests (page requests without loading any CSS/JS/images). UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 show less	Bad Web Bot
🇲🇾 Rizzy	2026-10-23 11:59:09 (5 hours ago)	Multiple WAF Violations	Brute-Force Web App Attack
🇦🇺 paulshipley.com.au	2026-10-23 11:41:33 (5 hours ago)	mareeshefford.com:443 20.53.249.197 - - [23/Oct/2026:22:41:31 +1100] "GET /inputs.php HTTP/1.1" 404 ... show more mareeshefford.com:443 20.53.249.197 - - [23/Oct/2026:22:41:31 +1100] "GET /inputs.php HTTP/1.1" 404 42850 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" ... show less	Web App Attack

Showing 1 to 15 of 478 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇳🇱 185.218.86.14

🇨🇳 175.0.61.167

🇺🇸 172.172.214.224

🇩🇪 167.94.146.67

🇦🇺 161.33.87.200

🇺🇸 34.72.198.95

🇻🇳 2402:800:62c7:bab8:55de:828f:fb0a:2f6a

🇰🇿 185.217.191.73

🇧🇬 185.18.231.30

🇺🇸 152.163.101.229

🇨🇳 112.86.225.21

🇰🇷 61.76.38.54

🇺🇸 52.167.144.142

🇩🇪 207.154.241.35

🇧🇷 177.137.117.236

🇨🇳 106.59.139.75

🇬🇧 78.153.140.237

🇱🇹 62.60.130.238

🇲🇾 59.153.151.178

🇫🇷 51.159.125.200