JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 172.168.194.20

172.168.194.20 was found in our database!

This IP was reported 161 times. Confidence of Abuse is 100%: ?

100%

ISP	Microsoft Limited
Usage Type	Data Center/Web Hosting/Transit
ASN	AS8075
Domain Name	microsoft.com
Country	🇺🇸 United States of America
City	Des Moines, Iowa

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 172.168.194.20

Whois 172.168.194.20

IP Abuse Reports for 172.168.194.20:

This IP address has been reported a total of 161 times from 90 distinct sources. 172.168.194.20 was first reported on August 30th 2026, and the most recent report was 2 hours ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇩🇪 karger	2026-09-03 05:07:16 (2 hours ago)	Wordpress attack - soft filter	Brute-Force Web App Attack
🇩🇪 AlexEventfahrtenIPDB	2026-09-03 04:58:05 (3 hours ago)	[Thu Sep 03 06:58:04.445305 2026] [authz_core:error] [pid 2140193:tid 2140204] [remote 172.168.194.2 ... show more [Thu Sep 03 06:58:04.445305 2026] [authz_core:error] [pid 2140193:tid 2140204] [remote 172.168.194.20:48205] AH01630: client denied by server configuration: /var/www/std-sites/cadillac/wp-login.php ... show less	Brute-Force Web App Attack
🇺🇸 Mundo Bueno	2026-09-03 04:52:32 (3 hours ago)	[ISILIA Protection v2.1] Tentative d'accès: /xmlrpc.php \| Pays: US \| UA: Mozilla/5.0 (Windows NT 10. ... show more [ISILIA Protection v2.1] Tentative d'accès: /xmlrpc.php \| Pays: US \| UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Sa show less	Hacking Web App Attack
🇺🇸 mnogoweb	2026-09-03 04:30:52 (3 hours ago)	(smtpauth) Failed SMTP AUTH login from 172.168.194.20 (US/United States/-): 5 in the last 3600 secs; ... show more (smtpauth) Failed SMTP AUTH login from 172.168.194.20 (US/United States/-): 5 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_SMTPAUTH; Logs: 2026-09-02 21:53:45 login authenticator failed for (45.74.31.30) [172.168.194.20]: 535 Incorrect authentication data ([email protected]) 2026-09-02 22:13:04 login authenticator failed for (45.74.31.30) [172.168.194.20]: 535 Incorrect authentication data ([email protected]) 2026-09-02 22:24:06 login authenticator failed for (45.74.31.30) [172.168.194.20]: 535 Incorrect authentication data ([email protected]) 2026-09-02 22:29:25 login authenticator failed for (45.74.31.30) [172.168.194.20]: 535 Incorrect authentication data ([email protected]) 2026-09-02 22:30:49 login authenticator failed for (45.74.31.30) [172.168.194.20]: 535 Incorrect authentication data ([email protected]) show less	Port Scan
🇩🇪 NetWatch	2026-09-03 01:31:03 (6 hours ago)	The IP 172.168.194.20 tried multiple SSH_BRUTE_FORCE logins	Brute-Force
🇺🇦 URAN Publishing Service	2026-09-03 01:03:43 (6 hours ago)	[03/Sep/2026:04:03:43 +0300] -- 172.168.194.20 Ban reason: Scanner [CMS_GENERIC] \| Request: GET /wp- ... show more [03/Sep/2026:04:03:43 +0300] -- 172.168.194.20 Ban reason: Scanner [CMS_GENERIC] \| Request: GET /wp-json/ HTTP/1.1 show less	Bad Web Bot Web App Attack
🇬🇧 andypiper	2026-09-03 01:02:43 (7 hours ago)	CrowdSec ban for AbuseIPDB Top List	Brute-Force Web App Attack
🇩🇪 FeG Deutschland	2026-09-03 00:10:53 (7 hours ago)	Looking for CMS/PHP/SQL vulnerablilities/excessive crawling - 2	Exploited Host Web App Attack
Anonymous	2026-09-03 00:10:37 (7 hours ago)	WordPress Brute Force	Hacking Brute-Force Web App Attack
🇩🇪 Marc	2026-09-02 23:43:18 (8 hours ago)	172.168.194.20 - - [03/Sep/2026:01:42:24 +0200] "GET /feed/atom/ HTTP/2.0" 404 483 "-" "Mozilla/5.0 ... show more 172.168.194.20 - - [03/Sep/2026:01:42:24 +0200] "GET /feed/atom/ HTTP/2.0" 404 483 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36" 172.168.194.20 - - [03/Sep/2026:01:42:58 +0200] "GET /wp-json/wp/v2/users?per_page=100&_fields=slug HTTP/2.0" 404 483 "https://relay.stormdesignz5.de/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36" 172.168.194.20 - - [03/Sep/2026:01:43:18 +0200] "GET /wp-json/buddypress/v1/members HTTP/2.0" 404 483 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36" show less	Brute-Force
🇩🇪 big-cloud.nl	2026-09-02 13:35:51 (18 hours ago)	Try to access /xmlrpc.php	Web App Attack
🇺🇸 TPI-Abuse	2026-09-02 13:15:45 (18 hours ago)	(mod_security) mod_security (id:225170) triggered by 172.168.194.20 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:225170) triggered by 172.168.194.20 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Sep 02 09:15:39.056016 2026] [security2:error] [pid 11138:tid 11138] [client 172.168.194.20:0] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)\|\|www.upskirtcrazy.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "www.upskirtcrazy.com"] [uri "/wp-json/wp/v2/users"] [unique_id "apghe2TVj_uR1vi7XKOjNwAAAA0"], referer: https://www.upskirtcrazy.com/ show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 Victor López	2026-09-02 12:55:26 (19 hours ago)	ads.buscaempresas.co 172.168.194.20 - - [02/Sep/2026:07:54:44 -0500] "GET /sitemap.xml HTTP/1.1" 444 ... show more ads.buscaempresas.co 172.168.194.20 - - [02/Sep/2026:07:54:44 -0500] "GET /sitemap.xml HTTP/1.1" 444 0 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36, Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36" - ads.buscaempresas.co 172.168.194.20 - - [02/Sep/2026:07:54:50 -0500] "GET /wp-json/wc/v2/customers?per_page=100&_fields=username HTTP/1.1" 444 0 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36, Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36" - ads.buscaempresas.co 172.168.194.20 - - [02/Sep/2026:07:55:25 -0500] "GET /wp-json/mepr/v1/members HTTP/1.1" 444 0 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36, Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like ... show less	Hacking Web App Attack
🇦🇺 FireGuard Server	2026-09-02 12:30:06 (19 hours ago)	Blocked by os-abuseipdb; 21 hits, proto=tcp, ports=443	Port Scan Hacking
Anonymous	2026-09-02 10:57:32 (21 hours ago)	[02/Sep/2026:10:57:31 +0000] host=lovelyrender.app server=lovelyrender.app ip=172.168.194.20 method= ... show more [02/Sep/2026:10:57:31 +0000] host=lovelyrender.app server=lovelyrender.app ip=172.168.194.20 method=GET req=/wp-json/wp/v2/users?per_page=50&_embed&_fields=id,slug,name uri=/index.php status=302 bytes=0 rt=0.049 urt=0.049 ref="-" ua="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36" ... show less	Web App Attack Bad Web Bot

Showing 1 to 15 of 161 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇧🇷 205.210.31.255

🇧🇷 205.210.31.192

🇮🇩 202.162.204.223

🇦🇺 202.53.63.247

🇹🇼 198.235.24.108

🇵🇰 175.107.205.211

🇳🇱 172.253.7.210

🇻🇳 160.191.139.115

🇷🇴 89.32.41.122

🇺🇸 65.87.223.26

🇹🇼 60.199.224.55

🇳🇱 45.148.10.152

🇮🇳 160.187.68.214

🇪🇪 95.85.245.227

🇷🇺 95.27.102.92

🇺🇸 89.117.9.138

🇳🇱 45.156.87.127

🇳🇬 41.242.115.83

🇸🇪 34.51.192.241

🇫🇷 31.98.26.125