Dashboard›🇮🇳 India›20.197.26.46
ABUSE.MOM
THREAT REPORT

IP Threat Report
20.197.26.46

ABUSE.MOM — BEHAVE OR GET EXPOSED

Generated: 2026-10-24 17:06:14
First seen: 2026-10-03 09:16:50
Last seen: 2026-10-11 01:06:49
300

⛔ Verdict: BLOCK

This IP address has been classified as a source of malicious automated activity. Threat score: 300/100. Total malicious requests observed: 7755.

BURSTDANGER_PATHRATIO_404REDIRECT_PROBEREFERERUA_CHANGEDUA_SUS
01

Geolocation & Classification

IP Address
20.197.26.46
Type
Hosting
Country
🇮🇳 India
City
Pune
ISP
Microsoft Corporation
Organization
Microsoft Azure Cloud (centralindia)
Autonomous System
AS8075 Microsoft Corporation
Hit Count
7755
02

Detection Signatures

SignatureDescriptionPointsSeverity
404 ratio 40-60%Majority of requests returned 404 — enumeration+15
404 ratio >= 60%Majority of requests returned 404 — enumeration+25
Burst 119/10sAbnormally fast request rate — automated scanning+35
Burst 132/10sAbnormally fast request rate — automated scanning+35
Burst 14/2sAbnormally fast request rate — automated scanning+35
Burst 16/2sAbnormally fast request rate — automated scanning+35
Burst 17/2sAbnormally fast request rate — automated scanning+35
Burst 18/2sAbnormally fast request rate — automated scanning+35
Burst 19/2sAbnormally fast request rate — automated scanning+35
Burst 36/2sAbnormally fast request rate — automated scanning+35
Burst 37/2sAbnormally fast request rate — automated scanning+35
Burst 48/10sAbnormally fast request rate — automated scanning+35
Burst 49/10sAbnormally fast request rate — automated scanning+35
Burst 50/10sAbnormally fast request rate — automated scanning+35
Burst 51/10sAbnormally fast request rate — automated scanning+35
Burst 52/10sAbnormally fast request rate — automated scanning+35
Burst 53/10sAbnormally fast request rate — automated scanning+35
Burst 54/10sAbnormally fast request rate — automated scanning+35
Burst 55/10sAbnormally fast request rate — automated scanning+35
Burst 56/10sAbnormally fast request rate — automated scanning+35
Burst 57/10sAbnormally fast request rate — automated scanning+35
Burst 58/10sAbnormally fast request rate — automated scanning+35
Burst 59/10sAbnormally fast request rate — automated scanning+35
Burst 60/10sAbnormally fast request rate — automated scanning+35
Burst 62/10sAbnormally fast request rate — automated scanning+35
Burst 63/10sAbnormally fast request rate — automated scanning+35
Burst 64/10sAbnormally fast request rate — automated scanning+35
Burst 65/10sAbnormally fast request rate — automated scanning+35
Burst 66/10sAbnormally fast request rate — automated scanning+35
Burst 67/10sAbnormally fast request rate — automated scanning+35
Burst 68/10sAbnormally fast request rate — automated scanning+35
Danger medium hits: 1Medium-risk: admin panels, config files+10
Danger medium hits: 104Medium-risk: admin panels, config files+60
Danger medium hits: 114Medium-risk: admin panels, config files+60
Danger medium hits: 1149Medium-risk: admin panels, config files+60
Danger medium hits: 117Medium-risk: admin panels, config files+60
Danger medium hits: 126Medium-risk: admin panels, config files+60
Danger medium hits: 128Medium-risk: admin panels, config files+60
Danger medium hits: 130Medium-risk: admin panels, config files+60
Danger medium hits: 134Medium-risk: admin panels, config files+60
Danger medium hits: 136Medium-risk: admin panels, config files+60
Danger medium hits: 140Medium-risk: admin panels, config files+60
Danger medium hits: 141Medium-risk: admin panels, config files+60
Danger medium hits: 148Medium-risk: admin panels, config files+60
Danger medium hits: 150Medium-risk: admin panels, config files+60
Danger medium hits: 151Medium-risk: admin panels, config files+60
Danger medium hits: 153Medium-risk: admin panels, config files+60
Danger medium hits: 154Medium-risk: admin panels, config files+60
Danger medium hits: 170Medium-risk: admin panels, config files+60
Danger medium hits: 179Medium-risk: admin panels, config files+60
Danger medium hits: 182Medium-risk: admin panels, config files+60
Danger medium hits: 183Medium-risk: admin panels, config files+60
Danger medium hits: 185Medium-risk: admin panels, config files+60
Danger medium hits: 188Medium-risk: admin panels, config files+60
Danger medium hits: 189Medium-risk: admin panels, config files+60
Danger medium hits: 194Medium-risk: admin panels, config files+60
Danger medium hits: 196Medium-risk: admin panels, config files+60
Danger medium hits: 198Medium-risk: admin panels, config files+60
Danger medium hits: 206Medium-risk: admin panels, config files+60
Danger medium hits: 216Medium-risk: admin panels, config files+60
Danger medium hits: 221Medium-risk: admin panels, config files+60
Danger medium hits: 222Medium-risk: admin panels, config files+60
Danger medium hits: 230Medium-risk: admin panels, config files+60
Danger medium hits: 234Medium-risk: admin panels, config files+60
Danger medium hits: 243Medium-risk: admin panels, config files+60
Danger medium hits: 247Medium-risk: admin panels, config files+60
Danger medium hits: 251Medium-risk: admin panels, config files+60
Danger medium hits: 252Medium-risk: admin panels, config files+60
Danger medium hits: 255Medium-risk: admin panels, config files+60
Danger medium hits: 256Medium-risk: admin panels, config files+60
Danger medium hits: 260Medium-risk: admin panels, config files+60
Danger medium hits: 264Medium-risk: admin panels, config files+60
Danger medium hits: 266Medium-risk: admin panels, config files+60
Danger medium hits: 272Medium-risk: admin panels, config files+60
Danger medium hits: 278Medium-risk: admin panels, config files+60
Danger medium hits: 280Medium-risk: admin panels, config files+60
Danger medium hits: 284Medium-risk: admin panels, config files+60
Danger medium hits: 289Medium-risk: admin panels, config files+60
Danger medium hits: 294Medium-risk: admin panels, config files+60
Danger medium hits: 296Medium-risk: admin panels, config files+60
Danger medium hits: 297Medium-risk: admin panels, config files+60
Danger medium hits: 308Medium-risk: admin panels, config files+60
Danger medium hits: 310Medium-risk: admin panels, config files+60
Danger medium hits: 313Medium-risk: admin panels, config files+60
Danger medium hits: 315Medium-risk: admin panels, config files+60
Danger medium hits: 318Medium-risk: admin panels, config files+60
Danger medium hits: 322Medium-risk: admin panels, config files+60
Danger medium hits: 326Medium-risk: admin panels, config files+60
Danger medium hits: 328Medium-risk: admin panels, config files+60
Danger medium hits: 330Medium-risk: admin panels, config files+60
Danger medium hits: 332Medium-risk: admin panels, config files+60
Danger medium hits: 338Medium-risk: admin panels, config files+60
Danger medium hits: 351Medium-risk: admin panels, config files+60
Danger medium hits: 380Medium-risk: admin panels, config files+60
Danger medium hits: 381Medium-risk: admin panels, config files+60
Danger medium hits: 396Medium-risk: admin panels, config files+60
Danger medium hits: 400Medium-risk: admin panels, config files+60
Danger medium hits: 401Medium-risk: admin panels, config files+60
Danger medium hits: 408Medium-risk: admin panels, config files+60
Danger medium hits: 409Medium-risk: admin panels, config files+60
Danger medium hits: 419Medium-risk: admin panels, config files+60
Danger medium hits: 425Medium-risk: admin panels, config files+60
Danger medium hits: 438Medium-risk: admin panels, config files+60
Danger medium hits: 440Medium-risk: admin panels, config files+60
Danger medium hits: 442Medium-risk: admin panels, config files+60
Danger medium hits: 443Medium-risk: admin panels, config files+60
Danger medium hits: 455Medium-risk: admin panels, config files+60
Danger medium hits: 459Medium-risk: admin panels, config files+60
Danger medium hits: 468Medium-risk: admin panels, config files+60
Danger medium hits: 475Medium-risk: admin panels, config files+60
Danger medium hits: 481Medium-risk: admin panels, config files+60
Danger medium hits: 482Medium-risk: admin panels, config files+60
Danger medium hits: 497Medium-risk: admin panels, config files+60
Danger medium hits: 498Medium-risk: admin panels, config files+60
Danger medium hits: 513Medium-risk: admin panels, config files+60
Danger medium hits: 538Medium-risk: admin panels, config files+60
Danger medium hits: 559Medium-risk: admin panels, config files+60
Danger medium hits: 572Medium-risk: admin panels, config files+60
Danger medium hits: 578Medium-risk: admin panels, config files+60
Danger medium hits: 591Medium-risk: admin panels, config files+60
Danger medium hits: 601Medium-risk: admin panels, config files+60
Danger medium hits: 617Medium-risk: admin panels, config files+60
Danger medium hits: 62Medium-risk: admin panels, config files+60
Danger medium hits: 63Medium-risk: admin panels, config files+60
Danger medium hits: 639Medium-risk: admin panels, config files+60
Danger medium hits: 676Medium-risk: admin panels, config files+60
Danger medium hits: 68Medium-risk: admin panels, config files+60
Danger medium hits: 744Medium-risk: admin panels, config files+60
Danger medium hits: 767Medium-risk: admin panels, config files+60
Danger medium hits: 806Medium-risk: admin panels, config files+60
Danger medium hits: 835Medium-risk: admin panels, config files+60
Danger medium hits: 843Medium-risk: admin panels, config files+60
Danger medium hits: 91Medium-risk: admin panels, config files+60
Danger medium hits: 92Medium-risk: admin panels, config files+60
Danger medium hits: 94Medium-risk: admin panels, config files+60
Danger strong hits: 1High-risk paths: shells, RCE vectors, exploits+25
Danger strong hits: 100High-risk paths: shells, RCE vectors, exploits+100
Danger strong hits: 101High-risk paths: shells, RCE vectors, exploits+100
Danger strong hits: 106High-risk paths: shells, RCE vectors, exploits+100
Danger strong hits: 107High-risk paths: shells, RCE vectors, exploits+100
Danger strong hits: 114High-risk paths: shells, RCE vectors, exploits+100
Danger strong hits: 115High-risk paths: shells, RCE vectors, exploits+100
Danger strong hits: 117High-risk paths: shells, RCE vectors, exploits+100
Danger strong hits: 118High-risk paths: shells, RCE vectors, exploits+100
Danger strong hits: 119High-risk paths: shells, RCE vectors, exploits+100
Danger strong hits: 12High-risk paths: shells, RCE vectors, exploits+100
Danger strong hits: 120High-risk paths: shells, RCE vectors, exploits+100
Danger strong hits: 123High-risk paths: shells, RCE vectors, exploits+100
Danger strong hits: 127High-risk paths: shells, RCE vectors, exploits+100
Danger strong hits: 135High-risk paths: shells, RCE vectors, exploits+100
Danger strong hits: 136High-risk paths: shells, RCE vectors, exploits+100
Danger strong hits: 14High-risk paths: shells, RCE vectors, exploits+100
Danger strong hits: 141High-risk paths: shells, RCE vectors, exploits+100
Danger strong hits: 148High-risk paths: shells, RCE vectors, exploits+100
Danger strong hits: 149High-risk paths: shells, RCE vectors, exploits+100
Danger strong hits: 154High-risk paths: shells, RCE vectors, exploits+100
Danger strong hits: 155High-risk paths: shells, RCE vectors, exploits+100
Danger strong hits: 16High-risk paths: shells, RCE vectors, exploits+100
Danger strong hits: 161High-risk paths: shells, RCE vectors, exploits+100
Danger strong hits: 17High-risk paths: shells, RCE vectors, exploits+100
Danger strong hits: 183High-risk paths: shells, RCE vectors, exploits+100
Danger strong hits: 196High-risk paths: shells, RCE vectors, exploits+100
Danger strong hits: 2High-risk paths: shells, RCE vectors, exploits+50
Danger strong hits: 21High-risk paths: shells, RCE vectors, exploits+100
Danger strong hits: 218High-risk paths: shells, RCE vectors, exploits+100
Danger strong hits: 230High-risk paths: shells, RCE vectors, exploits+100
Danger strong hits: 24High-risk paths: shells, RCE vectors, exploits+100
Danger strong hits: 247High-risk paths: shells, RCE vectors, exploits+100
Danger strong hits: 26High-risk paths: shells, RCE vectors, exploits+100
Danger strong hits: 277High-risk paths: shells, RCE vectors, exploits+100
Danger strong hits: 28High-risk paths: shells, RCE vectors, exploits+100
Danger strong hits: 289High-risk paths: shells, RCE vectors, exploits+100
Danger strong hits: 29High-risk paths: shells, RCE vectors, exploits+100
Danger strong hits: 30High-risk paths: shells, RCE vectors, exploits+100
Danger strong hits: 31High-risk paths: shells, RCE vectors, exploits+100
Danger strong hits: 33High-risk paths: shells, RCE vectors, exploits+100
Danger strong hits: 34High-risk paths: shells, RCE vectors, exploits+100
Danger strong hits: 35High-risk paths: shells, RCE vectors, exploits+100
Danger strong hits: 37High-risk paths: shells, RCE vectors, exploits+100
Danger strong hits: 38High-risk paths: shells, RCE vectors, exploits+100
Danger strong hits: 39High-risk paths: shells, RCE vectors, exploits+100
Danger strong hits: 4High-risk paths: shells, RCE vectors, exploits+100
Danger strong hits: 41High-risk paths: shells, RCE vectors, exploits+100
Danger strong hits: 42High-risk paths: shells, RCE vectors, exploits+100
Danger strong hits: 43High-risk paths: shells, RCE vectors, exploits+100
Danger strong hits: 44High-risk paths: shells, RCE vectors, exploits+100
Danger strong hits: 45High-risk paths: shells, RCE vectors, exploits+100
Danger strong hits: 46High-risk paths: shells, RCE vectors, exploits+100
Danger strong hits: 49High-risk paths: shells, RCE vectors, exploits+100
Danger strong hits: 50High-risk paths: shells, RCE vectors, exploits+100
Danger strong hits: 54High-risk paths: shells, RCE vectors, exploits+100
Danger strong hits: 55High-risk paths: shells, RCE vectors, exploits+100
Danger strong hits: 58High-risk paths: shells, RCE vectors, exploits+100
Danger strong hits: 59High-risk paths: shells, RCE vectors, exploits+100
Danger strong hits: 6High-risk paths: shells, RCE vectors, exploits+100
Danger strong hits: 60High-risk paths: shells, RCE vectors, exploits+100
Danger strong hits: 61High-risk paths: shells, RCE vectors, exploits+100
Danger strong hits: 67High-risk paths: shells, RCE vectors, exploits+100
Danger strong hits: 70High-risk paths: shells, RCE vectors, exploits+100
Danger strong hits: 71High-risk paths: shells, RCE vectors, exploits+100
Danger strong hits: 72High-risk paths: shells, RCE vectors, exploits+100
Danger strong hits: 75High-risk paths: shells, RCE vectors, exploits+100
Danger strong hits: 76High-risk paths: shells, RCE vectors, exploits+100
Danger strong hits: 77High-risk paths: shells, RCE vectors, exploits+100
Danger strong hits: 78High-risk paths: shells, RCE vectors, exploits+100
Danger strong hits: 8High-risk paths: shells, RCE vectors, exploits+100
Danger strong hits: 81High-risk paths: shells, RCE vectors, exploits+100
Danger strong hits: 84High-risk paths: shells, RCE vectors, exploits+100
Danger strong hits: 88High-risk paths: shells, RCE vectors, exploits+100
Danger strong hits: 89High-risk paths: shells, RCE vectors, exploits+100
Foreign refererReferer from unrelated external domain+10
Probe 302→404Behavioral anomaly detected by automated analysis+20
UA changedMultiple User-Agents — bot rotation technique+25
UA suspiciousBehavioral anomaly detected by automated analysis+15
Σ = 14690
03

Observed Activity

Reconstructed HTTP requests from server access logs. Target domains redacted for security.

[redacted]
GET
/
200
[redacted]
GET
/page
200
Requests shown: 2 · HTTP 404: 0 · Dangerous patterns: 0

* Typical request patterns for detected signatures. Actual target domains are redacted.

04

Timeline

2026-10-03 09:16:50
First malicious request detected
IP entered monitoring from server access logs
During observation
Multiple detection signatures triggered
404 ratio 40-60% (+15), 404 ratio >= 60% (+25), Burst 119/10s (+35)
2026-10-11 01:06:49
Last malicious request observed
Total score reached: 300/100
Next cycle
IP blocked — all subsequent requests denied (HTTP 403)
Added to blocklist automatically
05

Network Provider

Microsoft Corporation
AS8075 · 🇮🇳 India

We have detected 1852 malicious IPs from this autonomous system.

View all IPs from AS8075 →
06

Recommendations

Actions taken & recommended

  • IP 20.197.26.46 is blocked at application level (HTTP 403)
  • Consider blocking at firewall level (iptables/CSF) to reduce server load
  • Other malicious IPs detected in the same /24 subnet — consider blocking 20.197.26.0/24
  • Report abuse to the network provider via their abuse contact
  • Ensure sensitive files (.env, .git, backups) are not accessible from the web

🔎 Directory Scan Defense

IP 20.197.26.46 is enumerating directories. Configure fail2ban apache-404 jail after 10+ 404 errors. Disable directory listings. Normalize all 404 responses.

🌊 Traffic Flood Defense

IP 20.197.26.46 is generating excessive traffic. Limit connections per source IP. Enable geographic blocking if traffic from this region is unexpected.

🤖 User-Agent Anomaly Defense

IP 20.197.26.46 shows suspicious UA behavior. Block empty User-Agent requests. Implement JavaScript-based bot detection for sensitive endpoints.

07

Neighbors in 20.197.26.0/24

Other blocked IPs from the same /24 subnet — indicates systematic abuse from this network range.

20.197.26.190
Score: 280 · Hits: 2812
09

Blacklist Status (DNSBL)

This IP was checked against major DNS-based blacklists used by mail servers and firewalls worldwide.

✓ Clean
spam.dnsbl.sorbs.net
✓ Clean
b.barracudacentral.org
✓ Clean
cbl.abuseat.org
✓ Clean
psbl.surriel.com
✓ Clean
bl.blocklist.de
✓ Clean
zen.spamhaus.org
✓ Clean
dnsbl.dronebl.org
✓ Clean
bl.spamcop.net

Checked: Spamhaus, SpamCop, Barracuda, SORBS, CBL, UCEProtect. Results may change over time.

10

Threat Analysis

20.197.26.46 has been assigned a threat score of 300/100 (Critical). This places it in the critical threat category. Immediate blocking is strongly advised across all network perimeters.

The following attack categories were identified:

Path EnumerationRequest FloodingUser-Agent Anomaly

📊 Threat Analysis

Threat intelligence analysis has linked 20.197.26.46 to malicious activity originating from Pune, India, operating on the network of Microsoft Corporation. The address has been under observation since its initial detection. Over a period of 7 days, this IP generated 7,755 malicious requests, averaging approximately 1107.9 requests per day. This address belongs to a datacenter or cloud hosting provider. Hosting IPs are frequently leveraged by threat actors who rent cheap VPS instances specifically for conducting attacks. The diversity of 3 separate attack methods suggests a comprehensive attack toolkit — likely an automated scanner that tests for vulnerabilities across multiple categories. With 4,284 flagged addresses, India represents a major presence in our threat database. At 300/100, this is an extremely high-risk address. All traffic should be considered hostile.

This IP belongs to a hosting or data center provider. Malicious traffic from hosting infrastructure often originates from compromised VPS instances, rented servers used for scanning campaigns, or abused free-tier cloud accounts. Hosting providers typically respond to abuse reports within 24-72 hours.

11

Related Threats

🇮🇳 Top threats from India

49.248.192.204 (313)62.72.43.237 (305)34.100.193.82 (295)194.61.40.210 (295)34.131.59.165 (288)View all →

🏢 Same network: AS8075

68.155.155.199 (320)20.127.136.245 (318)20.151.200.44 (315)20.92.77.159 (310)20.210.128.125 (310)View all →
12

Security Intelligence

💡 DDoS Mitigation Approaches

Distributed denial of service attacks overwhelm infrastructure with traffic volume. Effective mitigation combines always-on traffic scrubbing, anycast network distribution, rate limiting, and the ability to quickly scale absorption capacity during attacks.

💡 IoT Device Compromise Patterns

Internet of Things devices are prime targets for botnet recruitment due to weak default credentials, infrequent updates, and always-on connectivity. Compromised IoT devices generate persistent scanning and attack traffic without their owners knowledge.

🔍 Check Any IP Address

Share this report:
AboutDisclaimerTermsAbuse Reports Tracker
Report generated 24.10.2026 17:06
Behave or get exposed