JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 20.89.249.5

20.89.249.5 was found in our database!

This IP was reported 143 times. Confidence of Abuse is 100%: ?

100%

ISP	Microsoft Corporation
Usage Type	Data Center/Web Hosting/Transit
ASN	AS8075
Domain Name	microsoft.com
Country	🇯🇵 Japan
City	Osaka, Osaka

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 20.89.249.5

Whois 20.89.249.5

IP Abuse Reports for 20.89.249.5:

This IP address has been reported a total of 143 times from 122 distinct sources. 20.89.249.5 was first reported on July 9th 2026, and the most recent report was 1 hour ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇧🇷 Peregrine	2026-07-11 03:11:53 (1 hour ago)	Fail2Ban Jail s2: tomcat-honeypot \| Evidence: 20.89.249.5 172.64.215.11 - - [09/Jul/2026:17:35:09 -0 ... show more Fail2Ban Jail s2: tomcat-honeypot \| Evidence: 20.89.249.5 172.64.215.11 - - [09/Jul/2026:17:35:09 -0300] "GET /wk/index.php HTTP/1.1" 404 414 20.89.249.5 172.64.215.64 - - [09/Jul/2026:17:35:10 -0300] "GET /inputs.php HTTP/1.1" 404 414 20.89.249.5 172.64.215.11 - - [09/Jul/2026:17:35:10 -0300] "GET /ioxi-o.php HTTP/1.1" 404 414 show less	Bad Web Bot
Anonymous	2026-07-10 17:04:47 (12 hours ago)	Blocked by FortiWeb WAF ML threat detection. ML probability: 99%, Country: JP, Attack patterns: Word ... show more Blocked by FortiWeb WAF ML threat detection. ML probability: 99%, Country: JP, Attack patterns: WordPress scanning show less	Bad Web Bot Web App Attack
🇬🇧 openstrike.co.uk	2026-07-10 05:13:36 (23 hours ago)	82 attacks on PHP URLs: GET /wp-content/plugins/index.php HTTP/1.1	Web App Attack
🇲🇽 octageeks.com	2026-07-10 04:18:28 (1 day ago)	Wordpress malicious attack:[octaflood]	Web App Attack
🇬🇧 andypiper	2026-07-10 01:02:34 (1 day ago)	CrowdSec ban for AbuseIPDB Top List	Brute-Force Web App Attack
🇬🇧 OptimusGO	2026-07-10 00:29:09 (1 day ago)	Malicious activity detected: web_attack Server: commstackbc (185.127.18.66) Attack: web_attack Time ... show more Malicious activity detected: web_attack Server: commstackbc (185.127.18.66) Attack: web_attack Timestamp: 2026-07-10 01:29:08 UTC Log evidence: 20.89.249.5 - - [10/Jul/2026:01:27:35 +0100] "GET /wp-content/plugins/hellopress/wp_filemanager.php HTTP/1.1" 404 146 "-" "-" 07/10/2026-01:29:07.900412 [] [1:9000060:2] AUTONOMOUS Long-term Reconnaissance [] [Classification: (null)] [Priority: 2] {TCP} 20.89.249.5:37452 -> 185.127.18.66:80 show less	Port Scan Brute-Force
🇺🇸 WizardsToolkit	2026-07-10 00:29:04 (1 day ago)	attempted to access	Web App Attack
🇩🇪 macrob	2026-07-10 00:27:01 (1 day ago)	2026/07/10 00:26:57 [error] 2488218#2488218: 363963664 access forbidden by rule, client: 20.89.249. ... show more 2026/07/10 00:26:57 [error] 2488218#2488218: 363963664 access forbidden by rule, client: 20.89.249.5, server: finami.mx, request: "GET /admin.php HTTP/2.0", host: "finami.mx" 2026/07/10 00:26:57 [error] 2488217#2488217: 363965389 access forbidden by rule, client: 20.89.249.5, server: finami.mx, request: "GET /wp-content/uploads/index.php HTTP/2.0", host: "finami.mx" 2026/07/10 00:27:00 [error] 2488217#2488217: 363965389 access forbidden by rule, client: 20.89.249.5, server: finami.mx, request: "GET /wp-admin/user/index.php HTTP/2.0", host: "finami.mx" ... show less	Web App Attack
🇩🇪 Philister11	2026-07-10 00:21:08 (1 day ago)	CrowdSec: crowdsecurity/http-probing (JP/AS8075)	Web App Attack Hacking
🇧🇷 Peregrine	2026-07-10 00:11:53 (1 day ago)	Fail2Ban ct101 Jail: tomcat-404 \| Evidence: 20.89.249.5 141.101.86.69 - - [09/Jul/2026:21:11:49 -030 ... show more Fail2Ban ct101 Jail: tomcat-404 \| Evidence: 20.89.249.5 141.101.86.69 - - [09/Jul/2026:21:11:49 -0300] "GET /function/function.php HTTP/1.1" 404 18193 20.89.249.5 141.101.86.69 - - [09/Jul/2026:21:11:50 -0300] "GET /rip.php HTTP/1.1" 404 18193 20.89.249.5 141.101.86.69 - - [09/Jul/2026:21:11:50 -0300] "GET /admin.php HTTP/1.1" 404 18193 20.89.249.5 141.101.86.69 - - [09/Jul/2026:21:11:50 -0300] "GET /wp-content/uploads/index.php HTTP/1.1" 404 18193 20.89.249.5 141.101.86.69 - - [09/Jul/2026:21:11:51 -0300] "GET /cache.php HTTP/1.1" 404 18193 show less	Bad Web Bot Web App Attack
🇩🇪 Skyrider	2026-07-10 00:01:16 (1 day ago)	crowdsecurity/http-backdoors-attempts	Web App Attack
Anonymous	2026-07-09 23:25:54 (1 day ago)	(PERMBLOCK) 20.89.249.5 (JP/Japan/-) has had more than 4 temp blocks in the last 86400 secs; Ports: ... show more (PERMBLOCK) 20.89.249.5 (JP/Japan/-) has had more than 4 temp blocks in the last 86400 secs; Ports: *; Direction: inout; Trigger: LF_PERMBLOCK_COUNT; Logs: show less	Port Scan
🇳🇱 i-turnradio.nl	2026-07-09 23:21:59 (1 day ago)	2026-07-10 @ 01:21:58 (CET) ~ Blocked for trying to access: /wp-content/plugins/hellopress/wp_filema ... show more 2026-07-10 @ 01:21:58 (CET) ~ Blocked for trying to access: /wp-content/plugins/hellopress/wp_filemanager.php show less	Web App Attack
🇩🇪 MBombeck	2026-07-09 23:18:42 (1 day ago)	Fail2Ban/traefik-botsearch on apps-01: banned after 5 failures	Web App Attack
🇫🇷 SpaceHost-Server	2026-07-09 22:28:24 (1 day ago)		Brute-Force Web App Attack

Showing 1 to 15 of 143 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇧🇷 191.242.219.152

🇩🇪 162.158.95.200

🇰🇷 115.178.75.243

🇺🇸 91.230.168.142

🇳🇱 52.102.161.21

🇧🇪 34.140.139.194

🇮🇪 4.210.91.174

🇬🇧 193.163.125.38

🇧🇬 79.124.56.238

🇩🇪 69.5.169.106

🇩🇪 69.5.169.38

🇺🇸 64.62.156.183

🇸🇬 43.106.9.100

🇺🇸 24.185.42.154

🇺🇸 216.218.206.70

🇨🇳 183.198.57.93

🇰🇷 121.152.152.177

🇰🇷 121.133.204.254

🇻🇳 116.110.7.11

🇻🇳 116.110.6.236