172.161.40.129
Recent Activity
This IP has received recent abuse reports, which causes the score to increase.
- ISP
- Microsoft Limited
- Usage Type
- Data Center/Web Hosting/Transit
- ASN
- AS8075
- Domain Name
- microsoft.com
- Country
- 🇨🇭 Switzerland
- City
- Zurich, Zurich
Abuse Reports
Total reports
1,040 from
636 distinct
reporters
First reported
Most recent report
Recent reports
We have received reports of abusive activity from this IP address within the last week. It is
potentially still actively engaged in abusive activities.
| Reporter | IoA Timestamp (UTC) | Comment | Categories |
|---|---|---|---|
| 🇺🇸 Sonoflet |
CrowdSec detection | scenario: http-backdoors-attempts
|
Web App Attack Exploited Host | |
| 🇪🇸 Linux Fertxo |
Unauthorized connection attempts: 5 hits @ port(s) 80, protocol(s) tcp
|
Port Scan Hacking | |
| 🇦🇲 arm osint |
Automated web vulnerability scanning: 140 HTTP 4xx probes for sensitive paths (/about.php, /atomlib.php, //tfm.php, /0.php). Detected by Wazuh HIDS rule 31151 on a self-hosted web server.
|
Web App Attack Brute-Force | |
| 🇦🇹 penguin-solutions.at |
Excessive 403/404 errors
...
|
Brute-Force Web App Attack | |
| 🇫🇷 Thibault Millant |
172.161.40.129 - - [09/Nov/2026:07:32:17 +0000] "GET /wp-content/plugins/hellopress/wp_filemanager.php HTTP/1.1" 404 146 "-" "-"
...
|
Brute-Force Exploited Host SSH | |
| 🇺🇸 Wootroot |
Honeypot (http): web recon/exploit probes
|
Web App Attack | |
| Anonymous |
$f2bV_matches
|
Brute-Force Web App Attack | |
| 🇩🇪 AetherFox |
|
Hacking Bad Web Bot | |
| 🇵🇹 euronodes |
172.161.40.129 - - [09/Nov/2026:07:25:25 +0000] "GET /wp-content/plugins/hellopress/wp_filemanager.php HTTP/1.1" 404 118 "-" "-"
...
|
Web App Attack Hacking | |
| 🇫🇷 ✨ |
Domain : gestioncgt.es
Rule : WEB
IP in black list
|
Port Scan | |
| 🇺🇸 nasset |
|
Bad Web Bot Web App Attack | |
| 🇮🇪 AutosOnShow |
blocked for webapp attack | path requested: /wp/wp-content/plugins/classic-editor/js/geido.php | seen at 2026-11-09 07:07:47.473 |
|
Web App Attack | |
| 🇩🇪 hchristo |
|
Brute-Force | |
| 🇫🇷 polarolouis |
This IP was detected by CrowdSec triggering crowdsecurity/http-admin-interface-probing
|
Web App Attack Hacking | |
| 🇺🇦 RatCommander |
CrowdSec: crowdsecurity/http-backdoors-attempts
|
Port Scan Web App Attack |
Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown