JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 20.89.48.223

20.89.48.223 was found in our database!

This IP was reported 149 times. Confidence of Abuse is 100%: ?

100%

ISP	Microsoft Corporation
Usage Type	Data Center/Web Hosting/Transit
ASN	AS8075
Domain Name	microsoft.com
Country	🇯🇵 Japan
City	Tokyo, Tokyo

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 20.89.48.223

Whois 20.89.48.223

IP Abuse Reports for 20.89.48.223:

This IP address has been reported a total of 149 times from 118 distinct sources. 20.89.48.223 was first reported on June 28th 2026, and the most recent report was 3 days ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇬🇧 openstrike.co.uk	2026-06-30 05:14:36 (3 days ago)	8 attacks on Alfa URLs, ACME URLs: GET /wp-includes/ALFA_DATA/alfacgiapi/perl.alfa HTTP/1.1 GET /.we ... show more 8 attacks on Alfa URLs, ACME URLs: GET /wp-includes/ALFA_DATA/alfacgiapi/perl.alfa HTTP/1.1 GET /.well-known/acme-challenge/admin.php HTTP/1.1 show less	Hacking Web App Attack
🇳🇱 Site.eu	2026-06-30 01:17:05 (3 days ago)	Excessive multi-domain requests	Brute-Force
🇫🇷 SpaceHost-Server	2026-06-29 22:37:36 (3 days ago)		Brute-Force Web App Attack
Anonymous	2026-06-29 20:04:51 (3 days ago)	Blocked by FortiWeb WAF ML threat detection. ML probability: 99%, Country: JP, Attack patterns: Word ... show more Blocked by FortiWeb WAF ML threat detection. ML probability: 99%, Country: JP, Attack patterns: WordPress scanning, Webshell probing show less	Bad Web Bot Web App Attack
🇧🇪 Ivo Vynckier	2026-06-29 14:45:00 (3 days ago)	20.89.48.223 - - [29/Jun/2026:00:36:14 +0200] "GET /inputs.php HTTP/1.1" 404 47 "-" "Mozilla/5.0 (Wi ... show more 20.89.48.223 - - [29/Jun/2026:00:36:14 +0200] "GET /inputs.php HTTP/1.1" 404 47 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.89.48.223 - - [29/Jun/2026:00:36:14 +0200] "GET /admin.php HTTP/1.1" 404 47 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.89.48.223 - - [29/Jun/2026:00:36:15 +0200] "GET /goods.php HTTP/1.1" 404 47 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" show less	Web App Attack
🇩🇪 dispaisyenterprises	2026-06-29 12:59:47 (4 days ago)	Triggered Cloudflare WAF (firewallManaged) from JP. Action: BLOCK \| Protocol: HTTP/1.1 (GET) \| Endpo ... show more Triggered Cloudflare WAF (firewallManaged) from JP. Action: BLOCK \| Protocol: HTTP/1.1 (GET) \| Endpoint: /wp-config.php \| UA: Empty string • Reported by DisPaisy Enterprises (dispaisy.systems) show less	Bad Web Bot
🇩🇪 mondor.ro	2026-06-29 12:56:13 (4 days ago)	Cluster member 148.251.176.225 (DE/Germany/antares.webyouridea.ro) said, TEMPDENY 20.89.48.223, Reas ... show more Cluster member 148.251.176.225 (DE/Germany/antares.webyouridea.ro) said, TEMPDENY 20.89.48.223, Reason:[20.89.48.223 (JP/Japan/-), more than 60 Apache 404 hits in the last 3600 secs]; Ports: 80,443; Direction: in; Trigger: LF_CLUSTER; Logs: show less	Port Scan
🇪🇸 loadsoporte	2026-06-29 12:47:47 (4 days ago)	RdpGuard detected brute-force attempt on HTTP	Brute-Force
Anonymous	2026-06-29 12:36:18 (4 days ago)	(caddyscan) Scanner path probe from 20.89.48.223 (JP/Japan/-): 5 in the last 3600 secs; Ports: ; Di ... show more (caddyscan) Scanner path probe from 20.89.48.223 (JP/Japan/-): 5 in the last 3600 secs; Ports: ; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: [REDACTED] 200 2627 20.89.48.223 - - [29/Jun/2026:12:35:56 +0000] "GET /cgi-bin/wp-login.php HTTP/1.1" [REDACTED] 200 2627 20.89.48.223 - - [29/Jun/2026:12:35:57 +0000] "GET /wp-admin/images/cloud.php HTTP/1.1" [REDACTED] 200 2627 20.89.48.223 - - [29/Jun/2026:12:35:58 +0000] "GET /wp-admin/css/about.php HTTP/1.1" [REDACTED] 200 2627 20.89.48.223 - - [29/Jun/2026:12:36:13 +0000] "GET /wp-includes/images/wp-login.php HTTP/1.1" [REDACTED] 200 2627 20.89.48.223 - - [29/Jun/2026:12:36:17 +0000] "GET /wp-admin/images/index.php HTTP/1.1" show less	Port Scan
🇩🇪 Ba-Yu	2026-06-29 12:18:56 (4 days ago)	WordPress hacking/exploits/scanning	Web Spam Hacking Brute-Force Exploited Host Web App Attack
🇮🇩 Burayot	2026-06-29 12:16:49 (4 days ago)	LF_MODSEC: (mod_security) mod_security (id:1000001) triggered by 20.89.48.223 (JP/Japan/-): 2 in the ... show more LF_MODSEC: (mod_security) mod_security (id:1000001) triggered by 20.89.48.223 (JP/Japan/-): 2 in the last 3600 secs show less	Web App Attack
🇩🇪 LRob	2026-06-29 12:15:11 (4 days ago)	Repeated attacks detected by Fail2Ban in recidive jail	Hacking
🇫🇷 Campus France	2026-06-29 12:13:59 (4 days ago)	[Mon Jun 29 14:13:56.525644 2026] [php:error] [pid 148783] [client 20.89.48.223:24484] script '/var/ ... show more [Mon Jun 29 14:13:56.525644 2026] [php:error] [pid 148783] [client 20.89.48.223:24484] script '/var/www/html/campus-perpignan/this_is_a_new_hello_world.php' not found or unable to stat [Mon Jun 29 14:13:56.973218 2026] [php:error] [pid 148783] [client 20.89.48.223:24484] script '/var/www/html/campus-perpignan/alfa.php' not found or unable to stat [Mon Jun 29 14:13:57.789709 2026] [php:error] [pid 148783] [client 20.89.48.223:24484] script '/var/www/html/campus-perpignan/classwithtostring.php' not found or unable to stat [Mon Jun 29 14:13:58.840163 2026] [php:error] [pid 148783] [client 20.89.48.223:24484] script '/var/www/html/campus-perpignan/lock360.php' not found or unable to stat [Mon Jun 29 14:13:59.327786 2026] [php:error] [pid 148783] [client 20.89.48.223:24484] script '/var/www/html/campus-perpignan/flower.php' not found or unable to stat ... show less	Brute-Force Web App Attack
🇳🇱 Mangelot Hosting	2026-06-29 11:47:26 (4 days ago)	(PERMBLOCK) 20.89.48.223 (JP/Japan/-) has had more than 4 temp blocks in the last 86400 secs; Ports: ... show more (PERMBLOCK) 20.89.48.223 (JP/Japan/-) has had more than 4 temp blocks in the last 86400 secs; Ports: *; Direction: inout; Trigger: LF_PERMBLOCK_COUNT; Logs: show less	Port Scan
🇺🇸 TPI-Abuse	2026-06-29 11:43:57 (4 days ago)	(mod_security) mod_security (id:210492) triggered by 20.89.48.223 (-): 1 in the last 300 secs; Ports ... show more (mod_security) mod_security (id:210492) triggered by 20.89.48.223 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jun 29 07:43:51.885754 2026] [security2:error] [pid 6270:tid 6270] [client 20.89.48.223:40260] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "alphadyne.com"] [uri "/wp-config.php"] [unique_id "akJad_4qh38qIOikPJ5ungAAAAk"] show less	Brute-Force Bad Web Bot Web App Attack

Showing 1 to 15 of 149 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇹🇼 211.22.25.205

🇫🇮 147.185.133.208

🇨🇳 122.224.205.42

🇺🇸 216.126.239.17

🇹🇷 212.156.112.186

🇧🇷 187.0.35.73

🇺🇸 174.137.133.49

🇮🇳 152.70.75.102

🇭🇰 104.208.72.142

🇰🇪 196.207.177.56

🇧🇷 187.35.58.174

🇫🇮 147.185.133.31

🇻🇳 103.77.240.247

🇩🇪 85.214.154.50

🇳🇱 45.148.10.67

🇩🇪 45.66.228.234

🇩🇪 43.228.157.10

🇷🇺 5.250.232.106

🇬🇧 2a06:4880:2000::2f

🇺🇸 198.98.56.205