JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

20.194.5.96

Recent Activity

Abuse confidence score ?

100% Critical

995 reports

475 reporters · latest 5 minutes ago

ISP	Microsoft Corporation
Usage Type	Data Center/Web Hosting/Transit
ASN	AS8075
Domain Name	microsoft.com
Country	🇰🇷 Korea (the Republic of)
City	Seoul, Seoul

ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report Whois

Reports Activity

Example preview

Report Categories (Last 60 Days)

Example preview

Top Reporter Countries (Last 60 Days)

Example preview

Account required for the enhanced features Log in Sign up

IP Abuse Reports for 20.194.5.96

This IP address has been reported a total of 995 times from 475 distinct sources. 20.194.5.96 was first reported on September 26th 2026, and the most recent report was 5 minutes ago. In the last 60 days, the top reporter locations were: Germany with 248 reports; United States of America with 210 reports; France with 104 reports. The most common categories in these recent reports were: Web App Attack 762 times; Brute-Force 261 times; Bad Web Bot 235 times; Hacking 208 times; Port Scan 67 times; Other 170 times.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇩🇪 hchristo	2026-09-30 04:14:17 (5 minutes ago)	[Wed Sep 30 06:14:14.843401 2026] [proxy_fcgi:error] [pid 32736:tid 32809] [client 20.194.5.96:56810 ... show more [Wed Sep 30 06:14:14.843401 2026] [proxy_fcgi:error] [pid 32736:tid 32809] [client 20.194.5.96:56810] AH01071: Got error 'Primary script unknown' [Wed Sep 30 06:14:15.292518 2026] [proxy_fcgi:error] [pid 32736:tid 32810] [client 20.194.5.96:56810] AH01071: Got error 'Primary script unknown' [Wed Sep 30 06:14:15.752549 2026] [proxy_fcgi:error] [pid 32736:tid 32826] [client 20.194.5.96:56810] AH01071: Got error 'Primary script unknown' [Wed Sep 30 06:14:16.242556 2026] [proxy_fcgi:error] [pid 32736:tid 32798] [client 20.194.5.96:56810] AH01071: Got error 'Primary script unknown' [Wed Sep 30 06:14:16.702168 2026] [proxy_fcgi:error] [pid 32736:tid 32832] [client 20.194.5.96:56810] AH01071: Got error 'Primary script unknown' ... show less	Brute-Force
🇫🇷 LRNP	2026-09-30 04:14:17 (5 minutes ago)	mirror2.urbanterror.info:443 20.194.5.96 - - [30/Sep/2026:04:14:12 +0000] "GET /wp-content/plugins/h ... show more mirror2.urbanterror.info:443 20.194.5.96 - - [30/Sep/2026:04:14:12 +0000] "GET /wp-content/plugins/hellopress/wp_filemanager.php HTTP/1.1" 404 146 "-" "-" mirror2.urbanterror.info:443 20.194.5.96 - - [30/Sep/2026:04:14:13 +0000] "GET /this_is_a_new_hello_world.php HTTP/1.1" 404 146 "-" "-" mirror2.urbanterror.info:443 20.194.5.96 - - [30/Sep/2026:04:14:13 +0000] "GET /adminfuns.php HTTP/1.1" 404 146 "-" "-" mirror2.urbanterror.info:443 20.194.5.96 - - [30/Sep/2026:04:14:14 +0000] "GET //av.php HTTP/1.1" 404 146 "-" "-" mirror2.urbanterror.info:443 20.194.5.96 - - [30/Sep/2026:04:14:15 +0000] "GET /dex.php HTTP/1.1" 404 146 "-" "-" mirror2.urbanterror.info:443 20.194.5.96 - - [30/Sep/2026:04:14:15 +0000] "GET /chosen.php HTTP/1.1" 404 146 "-" "-" mirror2.urbanterror.info:443 20.194.5.96 - - [30/Sep/2026:04:14:16 +0000] "GET /radio.php HTTP/1.1" 404 146 "-" "-" mirror2.urbanterror.info:443 20.194.5.96 - - [30/Sep/2026:04:14:16 +0000] "GET /wp_blog_footer.php HTTP/1.1" 404 146 "-" "-" mir ... show less	Bad Web Bot Web App Attack
🇩🇪 lightaffaire	2026-09-30 04:12:06 (7 minutes ago)	Sep 30 06:12:04 declico.com 20.194.5.96 - - [30/Sep/2026:06:12:04 +0200] "GET /wp-content/plugins/he ... show more Sep 30 06:12:04 declico.com 20.194.5.96 - - [30/Sep/2026:06:12:04 +0200] "GET /wp-content/plugins/hellopress/wp_filemanager.php HTTP/1.1" 403 0 "-" "-" 0.000426183 ... show less	Bad Web Bot Web App Attack
🇬🇧 Apache	2026-09-30 04:11:25 (8 minutes ago)	(PERMBLOCK) 20.194.5.96 (KR/South Korea/-) has had more than 4 temp blocks in the last 86400 secs	Brute-Force
🇫🇮 botwork.se	2026-09-30 04:09:36 (9 minutes ago)	{"level":"info","ts":"2026-09-30T04:08:31Z","logger":"http.log.access.log4","msg":"handled request", ... show more {"level":"info","ts":"2026-09-30T04:08:31Z","logger":"http.log.access.log4","msg":"handled request","request":{"remote_ip":"20.194.5.96","remote_port":"51051","client_ip":"20.194.5.96","proto":"HTTP/1.1","method":"GET","host":"code.botwork.se","uri":"/adminfuns.php","headers":{"Cookie":["REDACTED"]},"tls":{"resumed":false,"version":772,"cipher_suite":4865,"proto":"","server_name":"code.botwork.se","ech":false}},"bytes_read":0,"user_id":"","duration":0.003562279,"size":11,"status":404,"resp_headers":{"X-Frame-Options":["SAMEORIGIN"],"Content-Length":["11"],"Via":["1.1 Caddy"],"Permissions-Policy":["interest-cohort=()"],"Referrer-Policy":["strict-origin-when-cross-origin"],"X-Content-Type-Options":["nosniff","nosniff"],"Content-Security-Policy":["default-src 'self' https://.botwork.se:443 https://googletagmanager.com:443 https://.google-analytics.com:443 data:; style-src 'self' 'unsafe-inline'; script-src 'self' https://www.googletagmanager.com:443 https://*.google-analytics.com:443 'u ... show less	Web App Attack
🇺🇸 nasset	2026-09-30 04:09:02 (10 minutes ago)	20.194.5.96 - - [29/Sep/2026:21:08:59 -0700] "GET /zoo2.php HTTP/1.1" 403 584 "-" "-" 20.194.5.96 - ... show more 20.194.5.96 - - [29/Sep/2026:21:08:59 -0700] "GET /zoo2.php HTTP/1.1" 403 584 "-" "-" 20.194.5.96 - - [29/Sep/2026:21:09:00 -0700] "GET /zoo1.php?p= HTTP/1.1" 403 584 "-" "-" 20.194.5.96 - - [29/Sep/2026:21:09:01 -0700] "GET /class-ajax.php HTTP/1.1" 403 584 "-" "-" 20.194.5.96 - - [29/Sep/2026:21:09:01 -0700] "GET /gm.php HTTP/1.1" 403 584 "-" "-" 20.194.5.96 - - [29/Sep/2026:21:09:01 -0700] "GET /class-wp-site-list.php HTTP/1.1" 403 584 "-" "-" ... show less	Bad Web Bot Web App Attack
🇹🇷 eryilmaz	2026-09-30 04:02:09 (17 minutes ago)	Automated attack blocked by eryilmaz WAF/defense engine (level 3, source: auto, path: /adminfuns.php ... show more Automated attack blocked by eryilmaz WAF/defense engine (level 3, source: auto, path: /adminfuns.php) show less	Web App Attack Hacking
🇩🇪 Lunix	2026-09-30 03:53:46 (25 minutes ago)		Brute-Force Web App Attack
🇺🇸 chrisj	2026-09-30 03:48:07 (31 minutes ago)	[Wed Sep 30 03:48:06.127299 2026] [proxy_fcgi:error] [pid 14150:tid 14202] [client 20.194.5.96:56773 ... show more [Wed Sep 30 03:48:06.127299 2026] [proxy_fcgi:error] [pid 14150:tid 14202] [client 20.194.5.96:56773] AH01071: Got error 'Primary script unknown' [Wed Sep 30 03:48:06.537237 2026] [proxy_fcgi:error] [pid 14150:tid 14236] [client 20.194.5.96:56773] AH01071: Got error 'Primary script unknown' [Wed Sep 30 03:48:06.904431 2026] [proxy_fcgi:error] [pid 14150:tid 14220] [client 20.194.5.96:56773] AH01071: Got error 'Primary script unknown' ... show less	Brute-Force
Anonymous	2026-09-30 03:41:13 (38 minutes ago)	[Tue Sep 29 23:41:12.831936 2026] [php7:error] [pid 2660462] [client 20.194.5.96:16624] script '/var ... show more [Tue Sep 29 23:41:12.831936 2026] [php7:error] [pid 2660462] [client 20.194.5.96:16624] script '/var/www/llamadareal.com/this_is_a_new_hello_world.php' not found or unable to stat [Tue Sep 29 23:41:13.209898 2026] [php7:error] [pid 2660462] [client 20.194.5.96:16624] script '/var/www/llamadareal.com/adminfuns.php' not found or unable to stat ... show less	Brute-Force Web App Attack SSH
🇲🇾 Rizzy	2026-09-30 03:37:42 (41 minutes ago)	Multiple WAF Violations	Brute-Force Web App Attack
🇳🇿 realstuffie	2026-09-30 03:20:17 (59 minutes ago)	This IP was detected by CrowdSec triggering crowdsecurity/http-probing	Web App Attack Hacking
🇩🇪 v1nc	2026-09-30 03:18:38 (1 hour ago)	20.194.5.96 - - [30/Sep/2026:03:18:37 +0000] "GET /wp-content/plugins/hellopress/wp_filemanager.php ... show more 20.194.5.96 - - [30/Sep/2026:03:18:37 +0000] "GET /wp-content/plugins/hellopress/wp_filemanager.php HTTP/1.1" 404 146 "-" "-" ... show less	Hacking
🇫🇷 ✨	2026-09-30 03:17:19 (1 hour ago)	Rule : Security IP in black list	Port Scan Hacking Brute-Force
🇧🇷 Peregrine	2026-09-30 03:14:04 (1 hour ago)	Fail2Ban ct101 Jail: tomcat-honeypot \| Evidence: 20.194.5.96 141.101.84.136 - - [26/Sep/2026:18:36:3 ... show more Fail2Ban ct101 Jail: tomcat-honeypot \| Evidence: 20.194.5.96 141.101.84.136 - - [26/Sep/2026:18:36:37 -0300] "GET /wp-content/plugins/hellopress/wp_filemanager.php HTTP/1.1" 404 18193 show less	Bad Web Bot

Showing 1 to 15 of 995 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇺🇸 129.121.97.223

🇰🇷 210.95.118.186

🇮🇩 208.76.40.131

🇸🇬 161.118.198.164

🇮🇩 125.160.114.97

🇰🇿 94.141.231.222

🇲🇰 92.55.113.155

🇲🇰 77.29.196.170

🇺🇸 66.132.172.230

🇯🇵 47.74.17.14

🇬🇧 5.252.83.75

🇮🇳 223.226.137.24

🇳🇱 193.47.62.69

🇺🇸 172.174.5.146

🇺🇸 172.86.125.64

🇫🇮 155.212.39.118

🇧🇷 138.94.31.29

🇲🇽 93.152.80.96

🇬🇪 82.211.137.71

🇫🇷 62.171.150.249