THREAT REPORT
IP Threat Report
20.249.5.100
ABUSE.MOM — BEHAVE OR GET EXPOSED
01
Geolocation & Classification
IP Address
20.249.5.100
Type
Hosting
Country
🇰🇷 South Korea
City
Seoul
ISP
Microsoft Corporation
Organization
Microsoft Azure Cloud (koreacentral)
Autonomous System
AS8075 Microsoft Corporation
Hit Count
5257
02
Detection Signatures
| Signature | Description | Points | Severity |
|---|---|---|---|
| 404 ratio 40-60% | Majority of requests returned 404 — enumeration | +15 | |
| 404 ratio >= 60% | Majority of requests returned 404 — enumeration | +25 | |
| Burst 10/2s | Abnormally fast request rate — automated scanning | +35 | |
| Burst 11/2s | Abnormally fast request rate — automated scanning | +35 | |
| Burst 12/2s | Abnormally fast request rate — automated scanning | +35 | |
| Burst 18/2s | Abnormally fast request rate — automated scanning | +35 | |
| Burst 22/2s | Abnormally fast request rate — automated scanning | +35 | |
| Burst 23/2s | Abnormally fast request rate — automated scanning | +35 | |
| Burst 26/10s | Abnormally fast request rate — automated scanning | +35 | |
| Burst 30/10s | Abnormally fast request rate — automated scanning | +35 | |
| Burst 36/10s | Abnormally fast request rate — automated scanning | +35 | |
| Burst 37/10s | Abnormally fast request rate — automated scanning | +35 | |
| Burst 38/10s | Abnormally fast request rate — automated scanning | +35 | |
| Burst 39/10s | Abnormally fast request rate — automated scanning | +35 | |
| Burst 40/10s | Abnormally fast request rate — automated scanning | +35 | |
| Burst 41/10s | Abnormally fast request rate — automated scanning | +35 | |
| Burst 42/10s | Abnormally fast request rate — automated scanning | +35 | |
| Burst 43/10s | Abnormally fast request rate — automated scanning | +35 | |
| Burst 48/10s | Abnormally fast request rate — automated scanning | +35 | |
| Burst 62/10s | Abnormally fast request rate — automated scanning | +35 | |
| Burst 74/10s | Abnormally fast request rate — automated scanning | +35 | |
| Burst 79/10s | Abnormally fast request rate — automated scanning | +35 | |
| Burst 80/10s | Abnormally fast request rate — automated scanning | +35 | |
| Burst 81/10s | Abnormally fast request rate — automated scanning | +35 | |
| Burst 9/2s | Abnormally fast request rate — automated scanning | +35 | |
| Danger medium hits: 101 | Medium-risk: admin panels, config files | +60 | |
| Danger medium hits: 102 | Medium-risk: admin panels, config files | +60 | |
| Danger medium hits: 106 | Medium-risk: admin panels, config files | +60 | |
| Danger medium hits: 114 | Medium-risk: admin panels, config files | +60 | |
| Danger medium hits: 1143 | Medium-risk: admin panels, config files | +60 | |
| Danger medium hits: 115 | Medium-risk: admin panels, config files | +60 | |
| Danger medium hits: 1150 | Medium-risk: admin panels, config files | +60 | |
| Danger medium hits: 124 | Medium-risk: admin panels, config files | +60 | |
| Danger medium hits: 125 | Medium-risk: admin panels, config files | +60 | |
| Danger medium hits: 1258 | Medium-risk: admin panels, config files | +60 | |
| Danger medium hits: 128 | Medium-risk: admin panels, config files | +60 | |
| Danger medium hits: 130 | Medium-risk: admin panels, config files | +60 | |
| Danger medium hits: 162 | Medium-risk: admin panels, config files | +60 | |
| Danger medium hits: 163 | Medium-risk: admin panels, config files | +60 | |
| Danger medium hits: 164 | Medium-risk: admin panels, config files | +60 | |
| Danger medium hits: 178 | Medium-risk: admin panels, config files | +60 | |
| Danger medium hits: 182 | Medium-risk: admin panels, config files | +60 | |
| Danger medium hits: 193 | Medium-risk: admin panels, config files | +60 | |
| Danger medium hits: 207 | Medium-risk: admin panels, config files | +60 | |
| Danger medium hits: 226 | Medium-risk: admin panels, config files | +60 | |
| Danger medium hits: 230 | Medium-risk: admin panels, config files | +60 | |
| Danger medium hits: 236 | Medium-risk: admin panels, config files | +60 | |
| Danger medium hits: 248 | Medium-risk: admin panels, config files | +60 | |
| Danger medium hits: 250 | Medium-risk: admin panels, config files | +60 | |
| Danger medium hits: 251 | Medium-risk: admin panels, config files | +60 | |
| Danger medium hits: 252 | Medium-risk: admin panels, config files | +60 | |
| Danger medium hits: 256 | Medium-risk: admin panels, config files | +60 | |
| Danger medium hits: 266 | Medium-risk: admin panels, config files | +60 | |
| Danger medium hits: 280 | Medium-risk: admin panels, config files | +60 | |
| Danger medium hits: 282 | Medium-risk: admin panels, config files | +60 | |
| Danger medium hits: 284 | Medium-risk: admin panels, config files | +60 | |
| Danger medium hits: 286 | Medium-risk: admin panels, config files | +60 | |
| Danger medium hits: 308 | Medium-risk: admin panels, config files | +60 | |
| Danger medium hits: 317 | Medium-risk: admin panels, config files | +60 | |
| Danger medium hits: 318 | Medium-risk: admin panels, config files | +60 | |
| Danger medium hits: 323 | Medium-risk: admin panels, config files | +60 | |
| Danger medium hits: 336 | Medium-risk: admin panels, config files | +60 | |
| Danger medium hits: 34 | Medium-risk: admin panels, config files | +60 | |
| Danger medium hits: 343 | Medium-risk: admin panels, config files | +60 | |
| Danger medium hits: 344 | Medium-risk: admin panels, config files | +60 | |
| Danger medium hits: 37 | Medium-risk: admin panels, config files | +60 | |
| Danger medium hits: 371 | Medium-risk: admin panels, config files | +60 | |
| Danger medium hits: 372 | Medium-risk: admin panels, config files | +60 | |
| Danger medium hits: 378 | Medium-risk: admin panels, config files | +60 | |
| Danger medium hits: 380 | Medium-risk: admin panels, config files | +60 | |
| Danger medium hits: 384 | Medium-risk: admin panels, config files | +60 | |
| Danger medium hits: 386 | Medium-risk: admin panels, config files | +60 | |
| Danger medium hits: 390 | Medium-risk: admin panels, config files | +60 | |
| Danger medium hits: 392 | Medium-risk: admin panels, config files | +60 | |
| Danger medium hits: 40 | Medium-risk: admin panels, config files | +60 | |
| Danger medium hits: 400 | Medium-risk: admin panels, config files | +60 | |
| Danger medium hits: 412 | Medium-risk: admin panels, config files | +60 | |
| Danger medium hits: 417 | Medium-risk: admin panels, config files | +60 | |
| Danger medium hits: 418 | Medium-risk: admin panels, config files | +60 | |
| Danger medium hits: 426 | Medium-risk: admin panels, config files | +60 | |
| Danger medium hits: 428 | Medium-risk: admin panels, config files | +60 | |
| Danger medium hits: 429 | Medium-risk: admin panels, config files | +60 | |
| Danger medium hits: 436 | Medium-risk: admin panels, config files | +60 | |
| Danger medium hits: 44 | Medium-risk: admin panels, config files | +60 | |
| Danger medium hits: 447 | Medium-risk: admin panels, config files | +60 | |
| Danger medium hits: 449 | Medium-risk: admin panels, config files | +60 | |
| Danger medium hits: 469 | Medium-risk: admin panels, config files | +60 | |
| Danger medium hits: 477 | Medium-risk: admin panels, config files | +60 | |
| Danger medium hits: 498 | Medium-risk: admin panels, config files | +60 | |
| Danger medium hits: 502 | Medium-risk: admin panels, config files | +60 | |
| Danger medium hits: 506 | Medium-risk: admin panels, config files | +60 | |
| Danger medium hits: 512 | Medium-risk: admin panels, config files | +60 | |
| Danger medium hits: 523 | Medium-risk: admin panels, config files | +60 | |
| Danger medium hits: 527 | Medium-risk: admin panels, config files | +60 | |
| Danger medium hits: 537 | Medium-risk: admin panels, config files | +60 | |
| Danger medium hits: 54 | Medium-risk: admin panels, config files | +60 | |
| Danger medium hits: 564 | Medium-risk: admin panels, config files | +60 | |
| Danger medium hits: 57 | Medium-risk: admin panels, config files | +60 | |
| Danger medium hits: 575 | Medium-risk: admin panels, config files | +60 | |
| Danger medium hits: 578 | Medium-risk: admin panels, config files | +60 | |
| Danger medium hits: 61 | Medium-risk: admin panels, config files | +60 | |
| Danger medium hits: 634 | Medium-risk: admin panels, config files | +60 | |
| Danger medium hits: 636 | Medium-risk: admin panels, config files | +60 | |
| Danger medium hits: 646 | Medium-risk: admin panels, config files | +60 | |
| Danger medium hits: 647 | Medium-risk: admin panels, config files | +60 | |
| Danger medium hits: 65 | Medium-risk: admin panels, config files | +60 | |
| Danger medium hits: 684 | Medium-risk: admin panels, config files | +60 | |
| Danger medium hits: 695 | Medium-risk: admin panels, config files | +60 | |
| Danger medium hits: 742 | Medium-risk: admin panels, config files | +60 | |
| Danger medium hits: 749 | Medium-risk: admin panels, config files | +60 | |
| Danger medium hits: 754 | Medium-risk: admin panels, config files | +60 | |
| Danger medium hits: 761 | Medium-risk: admin panels, config files | +60 | |
| Danger medium hits: 768 | Medium-risk: admin panels, config files | +60 | |
| Danger medium hits: 77 | Medium-risk: admin panels, config files | +60 | |
| Danger medium hits: 80 | Medium-risk: admin panels, config files | +60 | |
| Danger medium hits: 816 | Medium-risk: admin panels, config files | +60 | |
| Danger medium hits: 88 | Medium-risk: admin panels, config files | +60 | |
| Danger medium hits: 893 | Medium-risk: admin panels, config files | +60 | |
| Danger medium hits: 896 | Medium-risk: admin panels, config files | +60 | |
| Danger medium hits: 98 | Medium-risk: admin panels, config files | +60 | |
| Danger medium hits: 989 | Medium-risk: admin panels, config files | +60 | |
| Danger strong hits: 1 | High-risk paths: shells, RCE vectors, exploits | +25 | |
| Danger strong hits: 10 | High-risk paths: shells, RCE vectors, exploits | +100 | |
| Danger strong hits: 108 | High-risk paths: shells, RCE vectors, exploits | +100 | |
| Danger strong hits: 11 | High-risk paths: shells, RCE vectors, exploits | +100 | |
| Danger strong hits: 116 | High-risk paths: shells, RCE vectors, exploits | +100 | |
| Danger strong hits: 12 | High-risk paths: shells, RCE vectors, exploits | +100 | |
| Danger strong hits: 120 | High-risk paths: shells, RCE vectors, exploits | +100 | |
| Danger strong hits: 128 | High-risk paths: shells, RCE vectors, exploits | +100 | |
| Danger strong hits: 13 | High-risk paths: shells, RCE vectors, exploits | +100 | |
| Danger strong hits: 130 | High-risk paths: shells, RCE vectors, exploits | +100 | |
| Danger strong hits: 133 | High-risk paths: shells, RCE vectors, exploits | +100 | |
| Danger strong hits: 134 | High-risk paths: shells, RCE vectors, exploits | +100 | |
| Danger strong hits: 135 | High-risk paths: shells, RCE vectors, exploits | +100 | |
| Danger strong hits: 14 | High-risk paths: shells, RCE vectors, exploits | +100 | |
| Danger strong hits: 148 | High-risk paths: shells, RCE vectors, exploits | +100 | |
| Danger strong hits: 149 | High-risk paths: shells, RCE vectors, exploits | +100 | |
| Danger strong hits: 15 | High-risk paths: shells, RCE vectors, exploits | +100 | |
| Danger strong hits: 150 | High-risk paths: shells, RCE vectors, exploits | +100 | |
| Danger strong hits: 151 | High-risk paths: shells, RCE vectors, exploits | +100 | |
| Danger strong hits: 152 | High-risk paths: shells, RCE vectors, exploits | +100 | |
| Danger strong hits: 156 | High-risk paths: shells, RCE vectors, exploits | +100 | |
| Danger strong hits: 16 | High-risk paths: shells, RCE vectors, exploits | +100 | |
| Danger strong hits: 160 | High-risk paths: shells, RCE vectors, exploits | +100 | |
| Danger strong hits: 161 | High-risk paths: shells, RCE vectors, exploits | +100 | |
| Danger strong hits: 162 | High-risk paths: shells, RCE vectors, exploits | +100 | |
| Danger strong hits: 166 | High-risk paths: shells, RCE vectors, exploits | +100 | |
| Danger strong hits: 17 | High-risk paths: shells, RCE vectors, exploits | +100 | |
| Danger strong hits: 176 | High-risk paths: shells, RCE vectors, exploits | +100 | |
| Danger strong hits: 18 | High-risk paths: shells, RCE vectors, exploits | +100 | |
| Danger strong hits: 181 | High-risk paths: shells, RCE vectors, exploits | +100 | |
| Danger strong hits: 19 | High-risk paths: shells, RCE vectors, exploits | +100 | |
| Danger strong hits: 2 | High-risk paths: shells, RCE vectors, exploits | +50 | |
| Danger strong hits: 20 | High-risk paths: shells, RCE vectors, exploits | +100 | |
| Danger strong hits: 204 | High-risk paths: shells, RCE vectors, exploits | +100 | |
| Danger strong hits: 21 | High-risk paths: shells, RCE vectors, exploits | +100 | |
| Danger strong hits: 22 | High-risk paths: shells, RCE vectors, exploits | +100 | |
| Danger strong hits: 23 | High-risk paths: shells, RCE vectors, exploits | +100 | |
| Danger strong hits: 24 | High-risk paths: shells, RCE vectors, exploits | +100 | |
| Danger strong hits: 25 | High-risk paths: shells, RCE vectors, exploits | +100 | |
| Danger strong hits: 266 | High-risk paths: shells, RCE vectors, exploits | +100 | |
| Danger strong hits: 296 | High-risk paths: shells, RCE vectors, exploits | +100 | |
| Danger strong hits: 298 | High-risk paths: shells, RCE vectors, exploits | +100 | |
| Danger strong hits: 3 | High-risk paths: shells, RCE vectors, exploits | +75 | |
| Danger strong hits: 32 | High-risk paths: shells, RCE vectors, exploits | +100 | |
| Danger strong hits: 328 | High-risk paths: shells, RCE vectors, exploits | +100 | |
| Danger strong hits: 330 | High-risk paths: shells, RCE vectors, exploits | +100 | |
| Danger strong hits: 332 | High-risk paths: shells, RCE vectors, exploits | +100 | |
| Danger strong hits: 342 | High-risk paths: shells, RCE vectors, exploits | +100 | |
| Danger strong hits: 36 | High-risk paths: shells, RCE vectors, exploits | +100 | |
| Danger strong hits: 37 | High-risk paths: shells, RCE vectors, exploits | +100 | |
| Danger strong hits: 374 | High-risk paths: shells, RCE vectors, exploits | +100 | |
| Danger strong hits: 38 | High-risk paths: shells, RCE vectors, exploits | +100 | |
| Danger strong hits: 4 | High-risk paths: shells, RCE vectors, exploits | +100 | |
| Danger strong hits: 43 | High-risk paths: shells, RCE vectors, exploits | +100 | |
| Danger strong hits: 48 | High-risk paths: shells, RCE vectors, exploits | +100 | |
| Danger strong hits: 51 | High-risk paths: shells, RCE vectors, exploits | +100 | |
| Danger strong hits: 55 | High-risk paths: shells, RCE vectors, exploits | +100 | |
| Danger strong hits: 58 | High-risk paths: shells, RCE vectors, exploits | +100 | |
| Danger strong hits: 6 | High-risk paths: shells, RCE vectors, exploits | +100 | |
| Danger strong hits: 60 | High-risk paths: shells, RCE vectors, exploits | +100 | |
| Danger strong hits: 61 | High-risk paths: shells, RCE vectors, exploits | +100 | |
| Danger strong hits: 64 | High-risk paths: shells, RCE vectors, exploits | +100 | |
| Danger strong hits: 65 | High-risk paths: shells, RCE vectors, exploits | +100 | |
| Danger strong hits: 66 | High-risk paths: shells, RCE vectors, exploits | +100 | |
| Danger strong hits: 7 | High-risk paths: shells, RCE vectors, exploits | +100 | |
| Danger strong hits: 76 | High-risk paths: shells, RCE vectors, exploits | +100 | |
| Danger strong hits: 83 | High-risk paths: shells, RCE vectors, exploits | +100 | |
| Danger strong hits: 85 | High-risk paths: shells, RCE vectors, exploits | +100 | |
| Danger strong hits: 89 | High-risk paths: shells, RCE vectors, exploits | +100 | |
| Danger strong hits: 90 | High-risk paths: shells, RCE vectors, exploits | +100 | |
| Danger strong hits: 91 | High-risk paths: shells, RCE vectors, exploits | +100 | |
| Danger strong hits: 93 | High-risk paths: shells, RCE vectors, exploits | +100 | |
| Danger strong hits: 96 | High-risk paths: shells, RCE vectors, exploits | +100 | |
| Danger strong hits: 97 | High-risk paths: shells, RCE vectors, exploits | +100 | |
| Danger strong hits: 98 | High-risk paths: shells, RCE vectors, exploits | +100 | |
| Probe 302→404 | Behavioral anomaly detected by automated analysis | +20 | |
| UA suspicious | Behavioral anomaly detected by automated analysis | +15 |
Σ = 13990
03
Observed Activity
Reconstructed HTTP requests from server access logs. Target domains redacted for security.
[redacted]
GET
/
200
[redacted]
GET
/page
200
Requests shown: 2 · HTTP 404: 0 · Dangerous patterns: 0
* Typical request patterns for detected signatures. Actual target domains are redacted.
04
Timeline
2026-10-02 22:38:38
First malicious request detected
IP entered monitoring from server access logs
During observation
Multiple detection signatures triggered
404 ratio 40-60% (+15), 404 ratio >= 60% (+25), Burst 10/2s (+35)
2026-10-11 01:06:21
Last malicious request observed
Total score reached: 280/100
Next cycle
IP blocked — all subsequent requests denied (HTTP 403)
Added to blocklist automatically
05
Network Provider
Microsoft Corporation
AS8075 · 🇰🇷 South Korea
We have detected 1852 malicious IPs from this autonomous system.
06
Recommendations
Actions taken & recommended
- IP 20.249.5.100 is blocked at application level (HTTP 403)
- Consider blocking at firewall level (iptables/CSF) to reduce server load
- Report abuse to the network provider via their abuse contact
- Ensure sensitive files (.env, .git, backups) are not accessible from the web
🔎 Directory Scan Defense
IP 20.249.5.100 is enumerating directories. Configure fail2ban apache-404 jail after 10+ 404 errors. Disable directory listings. Normalize all 404 responses.
🌊 Flood / DDoS Mitigation
Implement limit_req_zone in nginx. Deploy CDN with DDoS protection. Configure SYN cookies and connection tracking to throttle 20.249.5.100.
🤖 Bot Detection
Address UA spoofing from 20.249.5.100: maintain blocklist of known malicious UA strings, require consistent UA across sessions, implement TLS fingerprinting.
09
Blacklist Status (DNSBL)
This IP was checked against major DNS-based blacklists used by mail servers and firewalls worldwide.
✓ Clean
b.barracudacentral.org
✓ Clean
spam.dnsbl.sorbs.net
✓ Clean
cbl.abuseat.org
✓ Clean
bl.blocklist.de
✓ Clean
zen.spamhaus.org
✓ Clean
dnsbl.dronebl.org
✓ Clean
psbl.surriel.com
✓ Clean
bl.spamcop.net
Checked: Spamhaus, SpamCop, Barracuda, SORBS, CBL, UCEProtect. Results may change over time.
10
Threat Analysis
20.249.5.100 has been assigned a threat score of 280/100 (Critical). This represents a critical risk level. Our detection systems have flagged multiple high-confidence indicators of malicious intent from this address.
The following attack categories were identified:
Path EnumerationRequest FloodingUser-Agent Anomaly
📊 Threat Analysis
Our monitoring infrastructure has identified 20.249.5.100, geolocated to Seoul, South Korea, operating on the network of Microsoft Corporation, as a source of suspicious network activity. Over a period of 8 days, this IP generated 5,257 malicious requests, averaging approximately 657.1 requests per day. The IP is classified as hosting/datacenter infrastructure, commonly associated with rented servers used for automated attack campaigns, botnet command-and-control, or vulnerability scanning at scale. The combination of 3 distinct attack vectors indicates a sophisticated, multi-pronged threat actor deploying automated tools that probe multiple attack surfaces simultaneously. With 601 flagged addresses, South Korea represents a major presence in our threat database. A score of 280/100 places this address in the top tier of severity. Block and investigate any historical connections.
This IP belongs to a hosting or data center provider. Malicious traffic from hosting infrastructure often originates from compromised VPS instances, rented servers used for scanning campaigns, or abused free-tier cloud accounts. Hosting providers typically respond to abuse reports within 24-72 hours.
11
Related Threats
12
Security Intelligence
💡 DDoS Mitigation Approaches
Distributed denial of service attacks overwhelm infrastructure with traffic volume. Effective mitigation combines always-on traffic scrubbing, anycast network distribution, rate limiting, and the ability to quickly scale absorption capacity during attacks.
💡 Network Flow Analysis
Analyzing network flows (NetFlow, sFlow, IPFIX) provides visibility into traffic patterns without inspecting packet contents. Flow data reveals scanning activity, data exfiltration, lateral movement, and command-and-control channels at scale.
🔍 Check Any IP Address
Share this report: