JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 132.196.32.49

132.196.32.49 was found in our database!

This IP was reported 278 times. Confidence of Abuse is 72%: ?

72%

ISP	Microsoft Limited
Usage Type	Data Center/Web Hosting/Transit
ASN	AS8075
Domain Name	microsoft.com
Country	🇺🇸 United States of America
City	Des Moines, Iowa

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 132.196.32.49

Whois 132.196.32.49

IP Abuse Reports for 132.196.32.49:

This IP address has been reported a total of 278 times from 178 distinct sources. 132.196.32.49 was first reported on September 20th 2025, and the most recent report was 1 week ago.

Old Reports: The most recent abuse report for this IP address is from 1 week ago . It is possible that this IP is no longer involved in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
Anonymous	2026-06-13 19:51:16 (1 week ago)	Unauthorized connection attempt	Port Scan Hacking Exploited Host
🇳🇱 Selckie	2026-06-13 18:06:14 (1 week ago)	fail2ban: NGINX unusual impact	Web App Attack
Anonymous	2026-06-13 10:04:10 (1 week ago)	PORT & IP Scan.	Port Scan Brute-Force
🇵🇱 Wepted	2026-06-13 09:32:15 (1 week ago)	Port scan detected by honeypot	Port Scan Hacking
🇫🇷 Rom74	2026-06-13 08:42:49 (1 week ago)	[Sat Jun 13 10:42:45.046100 2026] [security2:error] [pid 1896047:tid 131878690473664] [client 132.19 ... show more [Sat Jun 13 10:42:45.046100 2026] [security2:error] [pid 1896047:tid 131878690473664] [client 132.196.32.49:60657] [client 132.196.32.49] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 8)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.5"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "86.205.229.132"] [uri "/.git/HEAD"] [unique_id "ai0YBelqkwO729zuH19t_AAAAIk"] [Sat Jun 13 10:42:47.305480 2026] [security2:error] [pid 1900522:tid 131878927353536] [client 132.196.32.49:60637] [client 132.196.32.49] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded ( ... show less	Web App Attack
🇺🇸 Mainpine	2026-06-13 08:21:45 (1 week ago)	[Sat Jun 13 08:21:37.584311 2026] [proxy_fcgi:error] [pid 3354071:tid 3354227] [client 132.196.32.49 ... show more [Sat Jun 13 08:21:37.584311 2026] [proxy_fcgi:error] [pid 3354071:tid 3354227] [client 132.196.32.49:61332] AH01071: Got error 'Primary script unknown' [Sat Jun 13 08:21:41.096444 2026] [proxy_fcgi:error] [pid 3354068:tid 3354155] [client 132.196.32.49:61335] AH01071: Got error 'Primary script unknown' [Sat Jun 13 08:21:45.229024 2026] [proxy_fcgi:error] [pid 3354068:tid 3354158] [client 132.196.32.49:61329] AH01071: Got error 'Primary script unknown' ... show less	Web App Attack
🇩🇪 lumbermatt_de	2026-06-13 07:30:41 (1 week ago)	Vulnerability exploit attack detected	Web App Attack
Anonymous	2026-06-13 07:30:02 (1 week ago)	suspicious request in access.log	Web App Attack
🇸🇪 NordhTech	2026-06-13 07:15:45 (1 week ago)	More than 3 malicious connection attempts, trying port(s) 2087/tcp, then blocked from services ...	Port Scan Hacking
🇺🇸 ISPLtd	2026-06-13 06:23:08 (1 week ago)	Jun 13 03:23:07 132.196.32.49 TCP SPT=61344 DPT=2087 SYN Jun 13 03:23:07 132.196.32.49 TCP SPT=61325 ... show more Jun 13 03:23:07 132.196.32.49 TCP SPT=61344 DPT=2087 SYN Jun 13 03:23:07 132.196.32.49 TCP SPT=61325 DPT=8443 SYN Jun 13 03:23:07 132.196.32.49 TCP SPT=61333 DPT=2082 SYN ... show less	Port Scan
🇳🇱 tpjg	2026-06-13 06:05:41 (1 week ago)	Automated: 15 requests with error status in 120s window from 132.196.32.49. Evidence: /config.php:30 ... show more Automated: 15 requests with error status in 120s window from 132.196.32.49. Evidence: /config.php:301,/.DS_Store:301,/actuator/env:301,/server-status:301,/phpinfo.php:301,/config/database.yml:301,/.aws/credentials:301,/wp-config.php.bak:301,/wp-config.php:301,/.env.save:301,/.env.backup:301,/.env.production:301,/.env.local:301,/.env:301,/.git/HEAD:301 show less	Web App Attack
🇩🇪 piticu iuli	2026-06-13 05:29:14 (1 week ago)	(mod_security) mod_security triggered on hostname [redacted] 132.196.32.49 (US/United States/-)	SQL Injection
🇩🇪 bogdanv	2026-05-27 14:17:07 (3 weeks ago)	$f2bV_matches	Brute-Force SSH
🇺🇸 TPI-Abuse	2026-05-23 15:56:48 (4 weeks ago)	(mod_security) mod_security (id:210492) triggered by 132.196.32.49 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:210492) triggered by 132.196.32.49 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat May 23 11:56:42.383919 2026] [security2:error] [pid 5919:tid 5919] [client 132.196.32.49:14769] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "russellforcongress.com"] [uri "/.env"] [unique_id "ahHOOjAMGLLOASZzVd52cQAAAA8"] show less	Brute-Force Bad Web Bot Web App Attack
Anonymous	2026-05-23 14:48:04 (4 weeks ago)	(PERMBLOCK) 132.196.32.49 (US/United States/-) has had more than 4 temp blocks in the last 86400 sec ... show more (PERMBLOCK) 132.196.32.49 (US/United States/-) has had more than 4 temp blocks in the last 86400 secs; Ports: *; Direction: inout; Trigger: LF_PERMBLOCK_COUNT; Logs: show less	Port Scan

Showing 1 to 15 of 278 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇸🇬 104.23.175.58

🇳🇱 91.92.42.227

🇧🇷 2804:1b3:6148:ef9c:c519:a077:7ba9:3d15

🇺🇸 107.150.98.59

🇮🇩 103.160.213.137

🇰🇪 102.210.149.105

🇺🇸 47.251.186.35

🇫🇷 46.105.46.43

🇺🇸 45.79.67.140

🇳🇱 204.76.203.36

🇮🇩 180.247.102.178

🇲🇾 180.75.249.93

🇬🇭 102.223.92.101

🇫🇷 95.111.234.80

🇳🇱 91.92.42.10

🇳🇱 91.92.40.5

🇰🇷 59.6.72.106

🇧🇷 45.163.173.239

🇳🇱 45.148.10.200

🇹🇼 45.43.37.254