Dashboard›🇳🇴 Norway›20.100.192.217

THREAT REPORT

IP Threat Report
20.100.192.217

ABUSE.MOM — BEHAVE OR GET EXPOSED

Generated: 2026-05-30 07:14:42

First seen: 2026-02-17 21:35:04

Last seen: 2026-02-24 21:00:05

Geolocation & Classification

IP Address

20.100.192.217

Type

Hosting

Country

🇳🇴 Norway

City

Lorenskog

ISP

Microsoft Corporation

Organization

Microsoft Azure Cloud (norwaye)

Autonomous System

AS8075 Microsoft Corporation

Hit Count

172

Detection Signatures

Signature	Description	Points
UA suspicious (short/empty)	Behavioral anomaly detected by automated analysis	+15
Danger strong hits: 2	High-risk paths: shells, RCE vectors, exploits	+50
Danger medium hits: 10	Medium-risk: admin panels, config files	+60
404 ratio 40-60%	Majority of requests returned 404 — enumeration	+15
Probe pattern 302->404 same path	Behavioral anomaly detected by automated analysis	+20
Burst: 9 req / 2s	Abnormally fast request rate — automated scanning	+35
Burst: 10 req / 10s	Abnormally fast request rate — automated scanning	+35
Danger strong hits: 1	High-risk paths: shells, RCE vectors, exploits	+25
Danger medium hits: 1	Medium-risk: admin panels, config files	+10
Danger medium hits: 9	Medium-risk: admin panels, config files	+60
Burst: 12 req / 2s	Abnormally fast request rate — automated scanning	+35
Burst: 14 req / 10s	Abnormally fast request rate — automated scanning	+35
Danger strong hits: 12	High-risk paths: shells, RCE vectors, exploits	+100
Danger medium hits: 40	Medium-risk: admin panels, config files	+60
Burst: 50 req / 2s	Abnormally fast request rate — automated scanning	+35
Burst: 60 req / 10s	Abnormally fast request rate — automated scanning	+35
Burst: 52 req / 2s	Abnormally fast request rate — automated scanning	+35
Danger strong hits: 8	High-risk paths: shells, RCE vectors, exploits	+100
Burst: 37 req / 2s	Abnormally fast request rate — automated scanning	+35
Burst: 40 req / 10s	Abnormally fast request rate — automated scanning	+35
Burst: 53 req / 2s	Abnormally fast request rate — automated scanning	+35
Danger medium hits: 2	Medium-risk: admin panels, config files	+20
Danger strong hits: 4	High-risk paths: shells, RCE vectors, exploits	+100
Danger medium hits: 3	Medium-risk: admin panels, config files	+30
Danger strong hits: 16	High-risk paths: shells, RCE vectors, exploits	+100
Danger medium hits: 60	Medium-risk: admin panels, config files	+60
Burst: 68 req / 10s	Abnormally fast request rate — automated scanning	+35
Burst: 51 req / 2s	Abnormally fast request rate — automated scanning	+35
Burst: 59 req / 10s	Abnormally fast request rate — automated scanning	+35
Burst: 56 req / 2s	Abnormally fast request rate — automated scanning	+35
Burst: 38 req / 2s	Abnormally fast request rate — automated scanning	+35
Burst: 54 req / 2s	Abnormally fast request rate — automated scanning	+35
Burst: 39 req / 2s	Abnormally fast request rate — automated scanning	+35
Burst: 55 req / 2s	Abnormally fast request rate — automated scanning	+35
Burst: 64 req / 2s	Abnormally fast request rate — automated scanning	+35
Burst: 80 req / 10s	Abnormally fast request rate — automated scanning	+35
Danger medium hits: 20	Medium-risk: admin panels, config files	+60
404 ratio >= 60%	Majority of requests returned 404 — enumeration	+25
Burst: 20 req / 2s	Abnormally fast request rate — automated scanning	+35
Burst: 20 req / 10s	Abnormally fast request rate — automated scanning	+35
Burst: 49 req / 2s	Abnormally fast request rate — automated scanning	+35
Burst: 36 req / 2s	Abnormally fast request rate — automated scanning	+35
Danger medium hits: 59	Medium-risk: admin panels, config files	+60
Burst: 48 req / 2s	Abnormally fast request rate — automated scanning	+35
Burst: 72 req / 10s	Abnormally fast request rate — automated scanning	+35
Burst: 57 req / 2s	Abnormally fast request rate — automated scanning	+35
Danger strong hits: 3	High-risk paths: shells, RCE vectors, exploits	+75
Burst: 35 req / 2s	Abnormally fast request rate — automated scanning	+35
Burst: 65 req / 2s	Abnormally fast request rate — automated scanning	+35
Danger medium hits: 249	Medium-risk: admin panels, config files	+60
Burst: 46 req / 2s	Abnormally fast request rate — automated scanning	+35
Burst: 146 req / 10s	Abnormally fast request rate — automated scanning	+35
Danger medium hits: 250	Medium-risk: admin panels, config files	+60
Burst: 151 req / 10s	Abnormally fast request rate — automated scanning	+35
Burst: 174 req / 10s	Abnormally fast request rate — automated scanning	+35
Danger medium hits: 36	Medium-risk: admin panels, config files	+60
Burst: 42 req / 2s	Abnormally fast request rate — automated scanning	+35
Burst: 54 req / 10s	Abnormally fast request rate — automated scanning	+35
Burst: 36 req / 10s	Abnormally fast request rate — automated scanning	+35
Burst: 47 req / 2s	Abnormally fast request rate — automated scanning	+35
Danger medium hits: 54	Medium-risk: admin panels, config files	+60
Burst: 43 req / 2s	Abnormally fast request rate — automated scanning	+35
Danger medium hits: 35	Medium-risk: admin panels, config files	+60
Burst: 53 req / 10s	Abnormally fast request rate — automated scanning	+35
Burst: 45 req / 2s	Abnormally fast request rate — automated scanning	+35
Burst: 41 req / 2s	Abnormally fast request rate — automated scanning	+35
Burst: 58 req / 2s	Abnormally fast request rate — automated scanning	+35
Burst: 29 req / 2s	Abnormally fast request rate — automated scanning	+35
Burst: 34 req / 2s	Abnormally fast request rate — automated scanning	+35
Danger medium hits: 6	Medium-risk: admin panels, config files	+60
Burst: 8 req / 2s	Abnormally fast request rate — automated scanning	+35
Danger medium hits: 28	Medium-risk: admin panels, config files	+60
Burst: 42 req / 10s	Abnormally fast request rate — automated scanning	+35
Burst: 40 req / 2s	Abnormally fast request rate — automated scanning	+35
Danger medium hits: 42	Medium-risk: admin panels, config files	+60
Burst: 32 req / 2s	Abnormally fast request rate — automated scanning	+35
Burst: 27 req / 2s	Abnormally fast request rate — automated scanning	+35
Burst: 28 req / 10s	Abnormally fast request rate — automated scanning	+35
Danger medium hits: 14	Medium-risk: admin panels, config files	+60
Burst: 5 req / 2s	Abnormally fast request rate — automated scanning	+35
Burst: 41 req / 10s	Abnormally fast request rate — automated scanning	+35
Burst: 33 req / 2s	Abnormally fast request rate — automated scanning	+35
Burst: 28 req / 2s	Abnormally fast request rate — automated scanning	+35
Burst: 15 req / 2s	Abnormally fast request rate — automated scanning	+35
Burst: 56 req / 10s	Abnormally fast request rate — automated scanning	+35
Danger medium hits: 38	Medium-risk: admin panels, config files	+60
Burst: 38 req / 10s	Abnormally fast request rate — automated scanning	+35
Burst: 57 req / 10s	Abnormally fast request rate — automated scanning	+35
Burst: 14 req / 2s	Abnormally fast request rate — automated scanning	+35
Burst: 48 req / 10s	Abnormally fast request rate — automated scanning	+35
Burst: 49 req / 10s	Abnormally fast request rate — automated scanning	+35
Burst: 51 req / 10s	Abnormally fast request rate — automated scanning	+35
Danger medium hits: 57	Medium-risk: admin panels, config files	+60
Burst: 75 req / 10s	Abnormally fast request rate — automated scanning	+35
Burst: 37 req / 10s	Abnormally fast request rate — automated scanning	+35
Burst: 52 req / 10s	Abnormally fast request rate — automated scanning	+35
Burst: 47 req / 10s	Abnormally fast request rate — automated scanning	+35
Burst: 13 req / 2s	Abnormally fast request rate — automated scanning	+35
Burst: 50 req / 10s	Abnormally fast request rate — automated scanning	+35
Danger medium hits: 114	Medium-risk: admin panels, config files	+60
Danger medium hits: 171	Medium-risk: admin panels, config files	+60
Danger medium hits: 113	Medium-risk: admin panels, config files	+60
Danger medium hits: 168	Medium-risk: admin panels, config files	+60
Danger medium hits: 111	Medium-risk: admin panels, config files	+60
Danger medium hits: 112	Medium-risk: admin panels, config files	+60
Burst: 158 req / 10s	Abnormally fast request rate — automated scanning	+35
Danger medium hits: 30	Medium-risk: admin panels, config files	+60
Burst: 30 req / 10s	Abnormally fast request rate — automated scanning	+35
Danger medium hits: 32	Medium-risk: admin panels, config files	+60
Burst: 44 req / 2s	Abnormally fast request rate — automated scanning	+35
Burst: 45 req / 10s	Abnormally fast request rate — automated scanning	+35

Σ = 4705

Observed Activity

Reconstructed HTTP requests from server access logs. Target domains redacted for security.

[redacted]

GET

200

[redacted]

GET

/page

200

Requests shown: 2 · HTTP 404: 0 · Dangerous patterns: 0

* Typical request patterns for detected signatures. Actual target domains are redacted.

Timeline

2026-02-17 21:35:04

First malicious request detected

IP entered monitoring from server access logs

During observation

Multiple detection signatures triggered

UA suspicious (short/empty) (+15), Danger strong hits: 2 (+50), Danger medium hits: 10 (+60)

2026-02-24 21:00:05

Last malicious request observed

Total score reached: 280/100

Next cycle

IP blocked — all subsequent requests denied (HTTP 403)

Added to blocklist automatically

Network Provider

Microsoft Corporation

AS8075 · 🇳🇴 Norway

Recommendations

Actions taken & recommended

IP 20.100.192.217 is blocked at application level (HTTP 403)
Consider blocking at firewall level (iptables/CSF) to reduce server load
Report abuse to the network provider via their abuse contact
Ensure sensitive files (.env, .git, backups) are not accessible from the web

🤖 Bot Detection

Address UA spoofing from 20.100.192.217: maintain blocklist of known malicious UA strings, require consistent UA across sessions, implement TLS fingerprinting.

🔎 Path Enumeration Protection

Block scanning from 20.100.192.217: rate-limit 404 responses per IP, deploy a honeypot 404 page, ensure no backup files are web-accessible.

🌊 Flood / DDoS Mitigation

Implement limit_req_zone in nginx. Deploy CDN with DDoS protection. Configure SYN cookies and connection tracking to throttle 20.100.192.217.

Blacklist Status (DNSBL)

This IP was checked against major DNS-based blacklists used by mail servers and firewalls worldwide.

⛔ LISTED

Spamhaus ZEN

Checked: Spamhaus, SpamCop, Barracuda, SORBS, CBL, UCEProtect. Results may change over time.

Threat Analysis

20.100.192.217 has been assigned a threat score of 280/100 (Critical). This is a critical-level threat. Systems administrators should treat this IP as hostile and block all inbound connections without exception.

The following attack categories were identified:

User-Agent AnomalyPath EnumerationRequest Flooding

📊 Threat Analysis

20.100.192.217 is registered in Lorenskog, Norway, operating on the network of Microsoft Corporation. This IP first appeared in our threat feeds after triggering multiple behavioral detection signatures. Our sensors captured 172 malicious requests from this address across a 6-day span, reflecting a sustained attack cadence of ~28.7 requests per day. Operating from datacenter infrastructure, this IP is typical of addresses used in organized attack operations. Cloud and VPS providers are commonly exploited as launching platforms for automated scanning. The combination of 3 distinct attack vectors indicates a sophisticated, multi-pronged threat actor deploying automated tools that probe multiple attack surfaces simultaneously. At 280/100, this is an extremely high-risk address. All traffic should be considered hostile.

This IP belongs to a hosting or data center provider. Malicious traffic from hosting infrastructure often originates from compromised VPS instances, rented servers used for scanning campaigns, or abused free-tier cloud accounts. Hosting providers typically respond to abuse reports within 24-72 hours.

Related Threats

🇳🇴 Top threats from Norway

20.100.191.215 (280)20.100.195.34 (280)20.100.193.95 (280)51.120.79.113 (280)View all →

🏢 Same network: AS8075

74.241.249.229 (340)20.151.111.128 (308)4.182.24.88 (285)20.65.61.3 (283)4.205.39.97 (283)View all →

Security Intelligence

💡 HTTP Header Analysis for Threat Detection

Examining HTTP headers beyond User-Agent reveals attack tools and automated scripts. Missing standard headers, unusual ordering, non-standard values, and inconsistencies with claimed client identity all serve as reliable detection signals.

💡 Log Correlation and SIEM Integration

Correlating logs across web servers, firewalls, DNS, and authentication systems reveals attack patterns invisible in individual log sources. Modern SIEM platforms use statistical analysis to connect related events across time and systems.

🔍 Check Any IP Address

Share this report:

IP Threat Report20.100.192.217

⛔ Verdict: BLOCK