JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 172.171.3.138

172.171.3.138 was found in our database!

This IP was reported 320 times. Confidence of Abuse is 100%: ?

100%

ISP	Microsoft Limited
Usage Type	Data Center/Web Hosting/Transit
ASN	AS8075
Domain Name	microsoft.com
Country	🇺🇸 United States of America
City	Des Moines, Iowa

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 172.171.3.138

Whois 172.171.3.138

IP Abuse Reports for 172.171.3.138:

This IP address has been reported a total of 320 times from 242 distinct sources. 172.171.3.138 was first reported on January 6th 2026, and the most recent report was 2 days ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇳🇱 Site.eu	2026-05-30 13:17:04 (4 days ago)	Excessive multi-domain requests	Brute-Force
🇬🇧 consul.to	2026-05-30 13:16:47 (4 days ago)	Web attack/malicious scanning detected	Web App Attack
🇪🇸 alferez	2026-05-30 13:15:40 (4 days ago)	Searching hacked php files	Hacking Exploited Host Web App Attack
🇩🇪 raph	2026-05-30 13:15:36 (4 days ago)	[Wordpress] crawler /wp-admin/, /wp-content/, etc.	Bad Web Bot Web App Attack
🇫🇷 PacketFilter	2026-05-30 13:14:51 (4 days ago)	Fail2Ban	Hacking Web App Attack
🇩🇪 netclix.gr	2026-05-30 13:08:26 (4 days ago)	(aggressive_scan) Aggressive Web Exploit Scan 172.171.3.138 (US/United States/-): 5 in the last 4600 ... show more (aggressive_scan) Aggressive Web Exploit Scan 172.171.3.138 (US/United States/-): 5 in the last 4600 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: 172.171.3.138 - - [30/May/2026:16:08:20 +0300] "GET /wp-content/plugins/hellopress/wp_filemanager.php HTTP/1.1" 404 808 "-" "-" 172.171.3.138 - - [30/May/2026:16:08:21 +0300] "GET /core/init.php HTTP/1.1" 404 808 "-" "-" 172.171.3.138 - - [30/May/2026:16:08:21 +0300] "GET /aa.php HTTP/1.1" 404 808 "-" "-" 172.171.3.138 - - [30/May/2026:16:08:21 +0300] "GET /xmrlpc.php HTTP/1.1" 404 808 "-" "-" 172.171.3.138 - - [30/May/2026:16:08:22 +0300] "GET /class.php HTTP/1.1" 404 808 "-" "-" show less	Port Scan
Anonymous	2026-05-30 13:08:23 (4 days ago)	[Sat May 30 15:08:22.153084 2026] [php:error] [pid 987910] [client 172.171.3.138:3374] script '/var/ ... show more [Sat May 30 15:08:22.153084 2026] [php:error] [pid 987910] [client 172.171.3.138:3374] script '/var/www/dademl.com/public_html/sallu.php' not found or unable to stat [Sat May 30 15:08:22.273010 2026] [php:error] [pid 987910] [client 172.171.3.138:3374] script '/var/www/dademl.com/public_html/aboute.php' not found or unable to stat [Sat May 30 15:08:22.273010 2026] [php:error] [pid 987910] [client 172.171.3.138:3374] script '/var/www/dademl.com/public_html/aboute.php' not found or unable to stat [Sat May 30 15:08:22.447134 2026] [php:error] [pid 987910] [client 172.171.3.138:3374] script '/var/www/dademl.com/public_html/one.php' not found or unable to stat ... show less	Bad Web Bot
🇨🇭 Origon	2026-05-30 13:07:00 (4 days ago)	http-technology-probing - IP: 172.171.3.138 - time="2026-05-30T15:06:59+02:00" level=info msg="(555 ... show more http-technology-probing - IP: 172.171.3.138 - time="2026-05-30T15:06:59+02:00" level=info msg="(555f66b4f6a74558bc11e3f93469658es8App0Mcc0TKEeje) alert : crowdsecurity/http-technology-probing by ip 172.171.3.138 (US/8075)" module=db show less	Web App Attack
🇺🇸 nationaleventpros.com	2026-05-30 13:05:46 (4 days ago)	vulnerability scan	Web App Attack
🇫🇮 inlink.ltd	2026-05-30 13:04:43 (4 days ago)	Known malicious PHP file or CMS probe	Web App Attack
Anonymous	2026-05-30 13:01:10 (4 days ago)	172.171.3.138 - - [30/May/2026:15:00:51 +0200] "GET /wp-content/plugins/hellopress/wp_filemanager.ph ... show more 172.171.3.138 - - [30/May/2026:15:00:51 +0200] "GET /wp-content/plugins/hellopress/wp_filemanager.php HTTP/1.1" 404 495 "-" "-" 172.171.3.138 - - [30/May/2026:15:00:51 +0200] "GET /core/init.php HTTP/1.1" 404 495 "-" "-" 172.171.3.138 - - [30/May/2026:15:00:51 +0200] "GET /aa.php HTTP/1.1" 404 495 "-" "-" 172.171.3.138 - - [30/May/2026:15:00:57 +0200] "GET /xmrlpc.php HTTP/1.1" 404 495 "-" "-" 172.171.3.138 - - [30/May/2026:15:00:57 +0200] "GET /class.php HTTP/1.1" 404 495 "-" "-" 172.171.3.138 - - [30/May/2026:15:00:57 +0200] "GET /goods.php HTTP/1.1" 404 495 "-" "-" 172.171.3.138 - - [30/May/2026:15:00:57 +0200] "GET /info.php HTTP/1.1" 404 495 "-" "-" 172.171.3.138 - - [30/May/2026:15:00:57 +0200] "GET /as.php HTTP/1.1" 404 495 "-" "-" 172.171.3.138 - - [30/May/2026:15:00:58 +0200] "GET /bb.php HTTP/1.1" 404 495 "-" "-" 172.171.3.138 - - [30/May/2026:15:00:58 +0200] "GET /about.php HTTP/1.1" 404 495 "-" "-" 172.171.3.138 - - [30/May/2026:15:00:58 +0200] "GET /222.php HTTP/1.1" 404 4 ... show less	DDoS Attack
Anonymous	2026-05-30 13:00:21 (4 days ago)	T: f2b 404 5x	Web App Attack
🇮🇹 VHosting	2026-05-30 13:00:05 (4 days ago)	Detected WordPress attack from 4 different servers	Brute-Force Web App Attack
Anonymous	2026-05-30 12:59:37 (4 days ago)	Aggressive web scan	Web App Attack
🇳🇱 Site.eu	2026-05-30 12:57:11 (4 days ago)	Excessive 404/403 errors	Brute-Force

Showing 301 to 315 of 320 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇭🇰 203.198.173.137

🇵🇪 190.235.214.213

🇹🇭 171.97.32.124

🇧🇼 168.167.228.74

🇮🇳 168.144.95.137

🇺🇸 162.216.150.199

🇨🇳 106.13.182.13

🇺🇸 103.143.11.150

🇱🇹 77.90.185.238

🇺🇸 66.132.195.103

🇻🇳 36.50.177.171

🇴🇲 5.21.69.43

🇺🇸 2607:f8b0:4023:1006::12e

🇲🇽 187.154.100.150

🇺🇸 167.99.117.2

🇫🇷 167.86.95.8

🇻🇳 103.252.93.153

🇺🇸 66.132.172.113

🇺🇸 65.49.1.13

🇮🇳 61.12.86.90