Dashboard›🇨🇭 Switzerland›20.203.219.190

THREAT REPORT

IP Threat Report
20.203.219.190

ABUSE.MOM — BEHAVE OR GET EXPOSED

Generated: 2026-07-30 00:54:07

First seen: 2026-07-22 19:03:12

Last seen: 2026-07-30 00:53:25

Geolocation & Classification

IP Address

20.203.219.190

Type

Hosting

Country

🇨🇭 Switzerland

City

Zurich

ISP

Microsoft Corporation

Organization

Microsoft Azure Cloud (switzerlandnorth)

Autonomous System

AS8075 Microsoft Corporation

Hit Count

8823

Detection Signatures

Signature	Description	Points
404 ratio 40-60%	Majority of requests returned 404 — enumeration	+15
404 ratio >= 60%	Majority of requests returned 404 — enumeration	+25
Burst 100/10s	Abnormally fast request rate — automated scanning	+35
Burst 102/10s	Abnormally fast request rate — automated scanning	+35
Burst 103/10s	Abnormally fast request rate — automated scanning	+35
Burst 104/10s	Abnormally fast request rate — automated scanning	+35
Burst 105/10s	Abnormally fast request rate — automated scanning	+35
Burst 106/10s	Abnormally fast request rate — automated scanning	+35
Burst 107/10s	Abnormally fast request rate — automated scanning	+35
Burst 109/10s	Abnormally fast request rate — automated scanning	+35
Burst 111/10s	Abnormally fast request rate — automated scanning	+35
Burst 112/10s	Abnormally fast request rate — automated scanning	+35
Burst 114/10s	Abnormally fast request rate — automated scanning	+35
Burst 115/10s	Abnormally fast request rate — automated scanning	+35
Burst 116/10s	Abnormally fast request rate — automated scanning	+35
Burst 117/10s	Abnormally fast request rate — automated scanning	+35
Burst 118/10s	Abnormally fast request rate — automated scanning	+35
Burst 119/10s	Abnormally fast request rate — automated scanning	+35
Burst 12/10s	Abnormally fast request rate — automated scanning	+35
Burst 12/2s	Abnormally fast request rate — automated scanning	+35
Burst 120/10s	Abnormally fast request rate — automated scanning	+35
Burst 121/10s	Abnormally fast request rate — automated scanning	+35
Burst 124/10s	Abnormally fast request rate — automated scanning	+35
Burst 125/10s	Abnormally fast request rate — automated scanning	+35
Burst 126/10s	Abnormally fast request rate — automated scanning	+35
Burst 127/10s	Abnormally fast request rate — automated scanning	+35
Burst 130/10s	Abnormally fast request rate — automated scanning	+35
Burst 134/10s	Abnormally fast request rate — automated scanning	+35
Burst 137/10s	Abnormally fast request rate — automated scanning	+35
Burst 138/10s	Abnormally fast request rate — automated scanning	+35
Burst 141/10s	Abnormally fast request rate — automated scanning	+35
Burst 144/10s	Abnormally fast request rate — automated scanning	+35
Burst 145/10s	Abnormally fast request rate — automated scanning	+35
Burst 146/10s	Abnormally fast request rate — automated scanning	+35
Burst 147/10s	Abnormally fast request rate — automated scanning	+35
Burst 148/10s	Abnormally fast request rate — automated scanning	+35
Burst 149/10s	Abnormally fast request rate — automated scanning	+35
Burst 150/10s	Abnormally fast request rate — automated scanning	+35
Burst 151/10s	Abnormally fast request rate — automated scanning	+35
Burst 154/10s	Abnormally fast request rate — automated scanning	+35
Burst 155/10s	Abnormally fast request rate — automated scanning	+35
Burst 156/10s	Abnormally fast request rate — automated scanning	+35
Burst 19/2s	Abnormally fast request rate — automated scanning	+35
Burst 20/10s	Abnormally fast request rate — automated scanning	+35
Burst 20/2s	Abnormally fast request rate — automated scanning	+35
Burst 200/10s	Abnormally fast request rate — automated scanning	+35
Burst 23/2s	Abnormally fast request rate — automated scanning	+35
Burst 24/10s	Abnormally fast request rate — automated scanning	+35
Burst 25/2s	Abnormally fast request rate — automated scanning	+35
Burst 26/2s	Abnormally fast request rate — automated scanning	+35
Burst 27/2s	Abnormally fast request rate — automated scanning	+35
Burst 29/10s	Abnormally fast request rate — automated scanning	+35
Burst 29/2s	Abnormally fast request rate — automated scanning	+35
Burst 30/10s	Abnormally fast request rate — automated scanning	+35
Burst 30/2s	Abnormally fast request rate — automated scanning	+35
Burst 31/2s	Abnormally fast request rate — automated scanning	+35
Burst 32/2s	Abnormally fast request rate — automated scanning	+35
Burst 35/10s	Abnormally fast request rate — automated scanning	+35
Burst 35/2s	Abnormally fast request rate — automated scanning	+35
Burst 36/2s	Abnormally fast request rate — automated scanning	+35
Burst 37/2s	Abnormally fast request rate — automated scanning	+35
Burst 38/2s	Abnormally fast request rate — automated scanning	+35
Burst 39/2s	Abnormally fast request rate — automated scanning	+35
Burst 40/2s	Abnormally fast request rate — automated scanning	+35
Burst 41/2s	Abnormally fast request rate — automated scanning	+35
Burst 42/2s	Abnormally fast request rate — automated scanning	+35
Burst 43/2s	Abnormally fast request rate — automated scanning	+35
Burst 44/10s	Abnormally fast request rate — automated scanning	+35
Burst 44/2s	Abnormally fast request rate — automated scanning	+35
Burst 45/2s	Abnormally fast request rate — automated scanning	+35
Burst 46/2s	Abnormally fast request rate — automated scanning	+35
Burst 47/2s	Abnormally fast request rate — automated scanning	+35
Burst 48/10s	Abnormally fast request rate — automated scanning	+35
Burst 48/2s	Abnormally fast request rate — automated scanning	+35
Burst 49/2s	Abnormally fast request rate — automated scanning	+35
Burst 50/2s	Abnormally fast request rate — automated scanning	+35
Burst 51/2s	Abnormally fast request rate — automated scanning	+35
Burst 52/2s	Abnormally fast request rate — automated scanning	+35
Burst 53/2s	Abnormally fast request rate — automated scanning	+35
Burst 54/2s	Abnormally fast request rate — automated scanning	+35
Burst 56/10s	Abnormally fast request rate — automated scanning	+35
Burst 56/2s	Abnormally fast request rate — automated scanning	+35
Burst 57/10s	Abnormally fast request rate — automated scanning	+35
Burst 57/2s	Abnormally fast request rate — automated scanning	+35
Burst 58/2s	Abnormally fast request rate — automated scanning	+35
Burst 6/2s	Abnormally fast request rate — automated scanning	+35
Burst 61/2s	Abnormally fast request rate — automated scanning	+35
Burst 67/10s	Abnormally fast request rate — automated scanning	+35
Burst 68/10s	Abnormally fast request rate — automated scanning	+35
Burst 69/10s	Abnormally fast request rate — automated scanning	+35
Burst 70/10s	Abnormally fast request rate — automated scanning	+35
Burst 73/10s	Abnormally fast request rate — automated scanning	+35
Burst 75/10s	Abnormally fast request rate — automated scanning	+35
Burst 76/10s	Abnormally fast request rate — automated scanning	+35
Burst 78/10s	Abnormally fast request rate — automated scanning	+35
Burst 80/10s	Abnormally fast request rate — automated scanning	+35
Burst 81/10s	Abnormally fast request rate — automated scanning	+35
Burst 82/10s	Abnormally fast request rate — automated scanning	+35
Burst 83/10s	Abnormally fast request rate — automated scanning	+35
Burst 84/10s	Abnormally fast request rate — automated scanning	+35
Burst 86/10s	Abnormally fast request rate — automated scanning	+35
Burst 87/10s	Abnormally fast request rate — automated scanning	+35
Burst 89/10s	Abnormally fast request rate — automated scanning	+35
Burst 9/2s	Abnormally fast request rate — automated scanning	+35
Burst 92/10s	Abnormally fast request rate — automated scanning	+35
Burst 93/10s	Abnormally fast request rate — automated scanning	+35
Burst 95/10s	Abnormally fast request rate — automated scanning	+35
Burst 99/10s	Abnormally fast request rate — automated scanning	+35
Danger medium hits: 1	Medium-risk: admin panels, config files	+10
Danger medium hits: 102	Medium-risk: admin panels, config files	+60
Danger medium hits: 103	Medium-risk: admin panels, config files	+60
Danger medium hits: 104	Medium-risk: admin panels, config files	+60
Danger medium hits: 105	Medium-risk: admin panels, config files	+60
Danger medium hits: 108	Medium-risk: admin panels, config files	+60
Danger medium hits: 111	Medium-risk: admin panels, config files	+60
Danger medium hits: 113	Medium-risk: admin panels, config files	+60
Danger medium hits: 117	Medium-risk: admin panels, config files	+60
Danger medium hits: 118	Medium-risk: admin panels, config files	+60
Danger medium hits: 12	Medium-risk: admin panels, config files	+60
Danger medium hits: 125	Medium-risk: admin panels, config files	+60
Danger medium hits: 126	Medium-risk: admin panels, config files	+60
Danger medium hits: 132	Medium-risk: admin panels, config files	+60
Danger medium hits: 135	Medium-risk: admin panels, config files	+60
Danger medium hits: 138	Medium-risk: admin panels, config files	+60
Danger medium hits: 141	Medium-risk: admin panels, config files	+60
Danger medium hits: 145	Medium-risk: admin panels, config files	+60
Danger medium hits: 146	Medium-risk: admin panels, config files	+60
Danger medium hits: 147	Medium-risk: admin panels, config files	+60
Danger medium hits: 148	Medium-risk: admin panels, config files	+60
Danger medium hits: 150	Medium-risk: admin panels, config files	+60
Danger medium hits: 151	Medium-risk: admin panels, config files	+60
Danger medium hits: 156	Medium-risk: admin panels, config files	+60
Danger medium hits: 157	Medium-risk: admin panels, config files	+60
Danger medium hits: 158	Medium-risk: admin panels, config files	+60
Danger medium hits: 162	Medium-risk: admin panels, config files	+60
Danger medium hits: 164	Medium-risk: admin panels, config files	+60
Danger medium hits: 174	Medium-risk: admin panels, config files	+60
Danger medium hits: 175	Medium-risk: admin panels, config files	+60
Danger medium hits: 180	Medium-risk: admin panels, config files	+60
Danger medium hits: 185	Medium-risk: admin panels, config files	+60
Danger medium hits: 186	Medium-risk: admin panels, config files	+60
Danger medium hits: 188	Medium-risk: admin panels, config files	+60
Danger medium hits: 19	Medium-risk: admin panels, config files	+60
Danger medium hits: 2	Medium-risk: admin panels, config files	+20
Danger medium hits: 20	Medium-risk: admin panels, config files	+60
Danger medium hits: 204	Medium-risk: admin panels, config files	+60
Danger medium hits: 21	Medium-risk: admin panels, config files	+60
Danger medium hits: 214	Medium-risk: admin panels, config files	+60
Danger medium hits: 220	Medium-risk: admin panels, config files	+60
Danger medium hits: 221	Medium-risk: admin panels, config files	+60
Danger medium hits: 234	Medium-risk: admin panels, config files	+60
Danger medium hits: 26	Medium-risk: admin panels, config files	+60
Danger medium hits: 260	Medium-risk: admin panels, config files	+60
Danger medium hits: 297	Medium-risk: admin panels, config files	+60
Danger medium hits: 3	Medium-risk: admin panels, config files	+30
Danger medium hits: 313	Medium-risk: admin panels, config files	+60
Danger medium hits: 319	Medium-risk: admin panels, config files	+60
Danger medium hits: 32	Medium-risk: admin panels, config files	+60
Danger medium hits: 35	Medium-risk: admin panels, config files	+60
Danger medium hits: 36	Medium-risk: admin panels, config files	+60
Danger medium hits: 38	Medium-risk: admin panels, config files	+60
Danger medium hits: 39	Medium-risk: admin panels, config files	+60
Danger medium hits: 41	Medium-risk: admin panels, config files	+60
Danger medium hits: 43	Medium-risk: admin panels, config files	+60
Danger medium hits: 478	Medium-risk: admin panels, config files	+60
Danger medium hits: 56	Medium-risk: admin panels, config files	+60
Danger medium hits: 6	Medium-risk: admin panels, config files	+60
Danger medium hits: 653	Medium-risk: admin panels, config files	+60
Danger medium hits: 68	Medium-risk: admin panels, config files	+60
Danger medium hits: 70	Medium-risk: admin panels, config files	+60
Danger medium hits: 71	Medium-risk: admin panels, config files	+60
Danger medium hits: 72	Medium-risk: admin panels, config files	+60
Danger medium hits: 75	Medium-risk: admin panels, config files	+60
Danger medium hits: 76	Medium-risk: admin panels, config files	+60
Danger medium hits: 77	Medium-risk: admin panels, config files	+60
Danger medium hits: 78	Medium-risk: admin panels, config files	+60
Danger medium hits: 79	Medium-risk: admin panels, config files	+60
Danger medium hits: 80	Medium-risk: admin panels, config files	+60
Danger medium hits: 83	Medium-risk: admin panels, config files	+60
Danger medium hits: 84	Medium-risk: admin panels, config files	+60
Danger medium hits: 88	Medium-risk: admin panels, config files	+60
Danger medium hits: 89	Medium-risk: admin panels, config files	+60
Danger medium hits: 9	Medium-risk: admin panels, config files	+60
Danger medium hits: 90	Medium-risk: admin panels, config files	+60
Danger medium hits: 94	Medium-risk: admin panels, config files	+60
Danger medium hits: 96	Medium-risk: admin panels, config files	+60
Danger strong hits: 1	High-risk paths: shells, RCE vectors, exploits	+25
Danger strong hits: 10	High-risk paths: shells, RCE vectors, exploits	+100
Danger strong hits: 12	High-risk paths: shells, RCE vectors, exploits	+100
Danger strong hits: 14	High-risk paths: shells, RCE vectors, exploits	+100
Danger strong hits: 15	High-risk paths: shells, RCE vectors, exploits	+100
Danger strong hits: 16	High-risk paths: shells, RCE vectors, exploits	+100
Danger strong hits: 18	High-risk paths: shells, RCE vectors, exploits	+100
Danger strong hits: 19	High-risk paths: shells, RCE vectors, exploits	+100
Danger strong hits: 2	High-risk paths: shells, RCE vectors, exploits	+50
Danger strong hits: 20	High-risk paths: shells, RCE vectors, exploits	+100
Danger strong hits: 21	High-risk paths: shells, RCE vectors, exploits	+100
Danger strong hits: 22	High-risk paths: shells, RCE vectors, exploits	+100
Danger strong hits: 23	High-risk paths: shells, RCE vectors, exploits	+100
Danger strong hits: 24	High-risk paths: shells, RCE vectors, exploits	+100
Danger strong hits: 26	High-risk paths: shells, RCE vectors, exploits	+100
Danger strong hits: 3	High-risk paths: shells, RCE vectors, exploits	+75
Danger strong hits: 32	High-risk paths: shells, RCE vectors, exploits	+100
Danger strong hits: 4	High-risk paths: shells, RCE vectors, exploits	+100
Danger strong hits: 46	High-risk paths: shells, RCE vectors, exploits	+100
Danger strong hits: 6	High-risk paths: shells, RCE vectors, exploits	+100
Danger strong hits: 7	High-risk paths: shells, RCE vectors, exploits	+100
Danger strong hits: 8	High-risk paths: shells, RCE vectors, exploits	+100
Danger strong hits: 9	High-risk paths: shells, RCE vectors, exploits	+100
Probe 302→404	Behavioral anomaly detected by automated analysis	+20
UA suspicious	Behavioral anomaly detected by automated analysis	+15

Σ = 10495

Observed Activity

Reconstructed HTTP requests from server access logs. Target domains redacted for security.

[redacted]

GET

200

[redacted]

GET

/page

200

Requests shown: 2 · HTTP 404: 0 · Dangerous patterns: 0

* Typical request patterns for detected signatures. Actual target domains are redacted.

Timeline

2026-07-22 19:03:12

First malicious request detected

IP entered monitoring from server access logs

During observation

Multiple detection signatures triggered

404 ratio 40-60% (+15), 404 ratio >= 60% (+25), Burst 100/10s (+35)

2026-07-30 00:53:25

Last malicious request observed

Total score reached: 280/100

Next cycle

IP blocked — all subsequent requests denied (HTTP 403)

Added to blocklist automatically

Network Provider

Microsoft Corporation

AS8075 · 🇨🇭 Switzerland

Recommendations

Actions taken & recommended

IP 20.203.219.190 is blocked at application level (HTTP 403)
Consider blocking at firewall level (iptables/CSF) to reduce server load
Report abuse to the network provider via their abuse contact
Ensure sensitive files (.env, .git, backups) are not accessible from the web

🔎 Path Enumeration Protection

Block scanning from 20.203.219.190: rate-limit 404 responses per IP, deploy a honeypot 404 page, ensure no backup files are web-accessible.

🌊 Flood / DDoS Mitigation

Implement limit_req_zone in nginx. Deploy CDN with DDoS protection. Configure SYN cookies and connection tracking to throttle 20.203.219.190.

🤖 Bot Detection

Address UA spoofing from 20.203.219.190: maintain blocklist of known malicious UA strings, require consistent UA across sessions, implement TLS fingerprinting.

Blacklist Status (DNSBL)

This IP was checked against major DNS-based blacklists used by mail servers and firewalls worldwide.

✓ Clean

dnsbl.dronebl.org

✓ Clean

psbl.surriel.com

Checked: Spamhaus, SpamCop, Barracuda, SORBS, CBL, UCEProtect. Results may change over time.

Threat Analysis

20.203.219.190 has been assigned a threat score of 280/100 (Critical). This places it in the critical threat category. Immediate blocking is strongly advised across all network perimeters.

The following attack categories were identified:

Path EnumerationRequest FloodingUser-Agent Anomaly

📊 Threat Analysis

IP address 20.203.219.190 has been traced to Zurich, Switzerland, operating on the network of Microsoft Corporation. Our threat detection systems have flagged this address based on observed malicious behavior patterns. Our sensors captured 8,823 malicious requests from this address across a 7-day span, reflecting a sustained attack cadence of ~1260.4 requests per day. This address belongs to a datacenter or cloud hosting provider. Hosting IPs are frequently leveraged by threat actors who rent cheap VPS instances specifically for conducting attacks. With 3 different attack patterns detected, this IP exhibits behavior characteristic of advanced automated scanning frameworks. Our records show 101 malicious IPs originating from Switzerland, positioning it as a significant contributor to global threat activity. A score of 280/100 places this address in the top tier of severity. Block and investigate any historical connections.

This IP belongs to a hosting or data center provider. Malicious traffic from hosting infrastructure often originates from compromised VPS instances, rented servers used for scanning campaigns, or abused free-tier cloud accounts. Hosting providers typically respond to abuse reports within 24-72 hours.

Related Threats

🇨🇭 Top threats from Switzerland

34.65.167.1 (288)20.203.149.15 (280)20.250.28.140 (280)20.250.9.235 (280)20.199.184.229 (280)View all →

🏢 Same network: AS8075

51.103.130.248 (280)20.203.205.107 (280)20.203.129.163 (280)20.203.209.227 (280)51.103.133.211 (280)View all →

Security Intelligence

💡 DDoS Mitigation Approaches

Distributed denial of service attacks overwhelm infrastructure with traffic volume. Effective mitigation combines always-on traffic scrubbing, anycast network distribution, rate limiting, and the ability to quickly scale absorption capacity during attacks.

💡 Network Telescope and Darknet Monitoring

Network telescopes monitor large blocks of unused IP address space. Since no legitimate traffic should reach these addresses, all observed traffic represents scanning, backscatter from spoofed attacks, or misconfiguration — providing pure signal for threat analysis.

🔍 Check Any IP Address

Share this report:

IP Threat Report20.203.219.190

⛔ Verdict: BLOCK