JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 172.172.157.210

172.172.157.210 was found in our database!

This IP was reported 35 times. Confidence of Abuse is 100%: ?

100%

ISP	Microsoft Limited
Usage Type	Data Center/Web Hosting/Transit
ASN	AS8075
Domain Name	microsoft.com
Country	🇺🇸 United States of America
City	Washington, Virginia

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 172.172.157.210

Whois 172.172.157.210

IP Abuse Reports for 172.172.157.210:

This IP address has been reported a total of 35 times from 29 distinct sources. 172.172.157.210 was first reported on June 1st 2026, and the most recent report was 1 week ago.

Old Reports: The most recent abuse report for this IP address is from 1 week ago . It is possible that this IP is no longer involved in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇦🇹 urnilxfgbez	2026-06-03 22:45:00 (1 week ago)	Last 24 Hours suspicious: (DPT=445\|DPT=3389\|DPT=22\|DPT=3306\|DPT=8080\|DPT=23\|DPT=5900\|DPT=1433)	Port Scan
Anonymous	2026-06-03 13:03:55 (1 week ago)	PORT & IP Scan.	Port Scan Brute-Force
Anonymous	2026-06-03 06:43:28 (1 week ago)	172.172.157.210 - - [03/Jun/2026:08:43:22 +0200] "GET /.git/config HTTP/1.1" 301 162 "-" "Mozilla/5. ... show more 172.172.157.210 - - [03/Jun/2026:08:43:22 +0200] "GET /.git/config HTTP/1.1" 301 162 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36" ... show less	Web App Attack
Anonymous	2026-06-03 04:51:04 (1 week ago)	Bot / scanning and/or hacking attempts: GET /.DS_Store HTTP/1.1, GET /phpinfo.php HTTP/1.1, GET /ser ... show more Bot / scanning and/or hacking attempts: GET /.DS_Store HTTP/1.1, GET /phpinfo.php HTTP/1.1, GET /server-status HTTP/1.1, GET /config/database.yml HTTP/1.1 show less	Hacking Web App Attack
🇳🇱 StopAbuse	2026-06-03 03:43:50 (1 week ago)	tcp/2082 tcp/2086 tcp/2087 tcp/8080 tcp/8443	Port Scan
🇺🇸 RAP	2026-06-03 03:41:15 (1 week ago)	2026-06-03 03:41:15 UTC Unauthorized activity to TCP port 8080. Web App	Port Scan Web App Attack
🇺🇸 MPL	2026-06-03 03:21:24 (1 week ago)	tcp port scan (8 or more attempts)	Port Scan
🇩🇪 london2038.com	2026-06-03 03:13:35 (1 week ago)	Connection atttempts against closed TCP ports Jun 3 05:13:34 BLOCK SRC=172.172.157.210 LEN=60 TOS=0 ... show more Connection atttempts against closed TCP ports Jun 3 05:13:34 BLOCK SRC=172.172.157.210 LEN=60 TOS=0x00 PREC=0x00 TTL=51 ID=697 DF PROTO=TCP SPT=53509 DPT=2087 WINDOW=64240 RES=0x00 SYN Jun 3 05:13:34 BLOCK SRC=172.172.157.210 LEN=60 TOS=0x00 PREC=0x00 TTL=51 ID=50302 DF PROTO=TCP SPT=53517 DPT=8443 WINDOW=64240 RES=0x00 SYN Jun 3 05:13:34 BLOCK SRC=172.172.157.210 LEN=60 TOS=0x00 PREC=0x00 TTL=50 ID=53070 DF PROTO=TCP SPT=53511 DPT=2083 WINDOW=64240 RES=0x00 SYN show less	Port Scan
🇩🇪 keep_out	2026-06-03 03:10:33 (1 week ago)	89-nginx-404 ...	Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-06-03 02:48:44 (1 week ago)	(mod_security) mod_security (id:210492) triggered by 172.172.157.210 (-): 1 in the last 300 secs; Po ... show more (mod_security) mod_security (id:210492) triggered by 172.172.157.210 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jun 02 22:48:40.739435 2026] [security2:error] [pid 1134:tid 1134] [client 172.172.157.210:54245] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "192.64.150.169"] [uri "/.env.production"] [unique_id "ah-WCD09M4e_bEUAZj9M0wAAAAI"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-06-03 02:31:21 (1 week ago)	(mod_security) mod_security (id:210492) triggered by 172.172.157.210 (-): 1 in the last 300 secs; Po ... show more (mod_security) mod_security (id:210492) triggered by 172.172.157.210 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jun 02 22:31:15.254803 2026] [security2:error] [pid 22425:tid 22425] [client 172.172.157.210:53704] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "192.64.150.224"] [uri "/.git/HEAD"] [unique_id "ah-R8zZEfTPqtGZLsUctbQAAAAQ"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 donarev419	2026-06-03 02:20:39 (1 week ago)	Port scan detected on port 8443 (connection without data transfer)	Port Scan
🇺🇸 MPL	2026-06-03 02:19:04 (1 week ago)	tcp port scan (3 or more attempts)	Port Scan
Anonymous	2026-06-03 02:18:37 (1 week ago)	Jun 2 22:18:36 localhost kernel: [108798432.330420] iptables_INPUT_denied: IN=eth0 OUT= MAC=f2:3c:9 ... show more Jun 2 22:18:36 localhost kernel: [108798432.330420] iptables_INPUT_denied: IN=eth0 OUT= MAC=f2:3c:91:84:83:95:00:00:0c:9f:f0:1e:08:00 SRC=172.172.157.210 DST=[mungedIP2] LEN=60 TOS=0x00 PREC=0x40 TTL=45 ID=57742 DF PROTO=TCP SPT=54219 DPT=2083 WINDOW=64240 RES=0x00 SYN URGP=0 Jun 2 22:18:36 localhost kernel: [108798432.330456] iptables_INPUT_denied: IN=eth0 OUT= MAC=f2:3c:91:84:83:95:00:00:0c:9f:f0:1e:08:00 SRC=172.172.157.210 DST=[mungedIP2] LEN=60 TOS=0x00 PREC=0x40 TTL=45 ID=57742 DF PROTO=TCP SPT=54219 DPT=2083 SEQ=1159968967 ACK=0 WINDOW=64240 RES=0x00 SYN URGP=0 OPT (020405A00402080A48E57364000000000103030A) Jun 2 22:18:36 localhost kernel: [108798432.341111] iptables_INPUT_denied: IN=eth0 OUT= MAC=f2:3c:91:84:83:95:00:00:0c:9f:f0:1e:08:00 SRC=172.172.157.210 DST=[mungedIP2] LEN=60 TOS=0x00 PREC=0x40 TTL=40 ID=33742 DF PROTO=TCP SPT=54226 DPT=2086 WINDOW=64240 RES=0x00 SYN URGP=0 Jun 2 22:18:36 localhost kernel: [108798432.341117] iptables_INPUT_denied: IN=eth0 OUT= MAC=f2:3c:91:84:83:95:00:00:0c show less	Port Scan
🇬🇧 PeravixGroup	2026-06-03 01:44:44 (1 week ago)	Honeypot detection: Web application scanning / reconnaissance attempt on port 8443. Severity: LOW. A ... show more Honeypot detection: Web application scanning / reconnaissance attempt on port 8443. Severity: LOW. Aaran.cloud show less	Port Scan Bad Web Bot

Showing 1 to 15 of 35 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇺🇸 172.194.139.254

🇨🇳 120.48.67.47

🇸🇬 101.47.158.137

🇧🇬 91.92.40.14

🇩🇪 213.209.159.228

🇦🇹 152.53.3.237

🇻🇳 103.1.210.25

🇩🇪 84.56.79.159

🇳🇱 45.148.10.157

🇭🇰 36.255.220.145

🇨🇦 20.104.72.216

🇺🇸 216.25.89.152

🇺🇸 195.184.76.75

🇹🇼 114.27.84.45

🇳🇬 102.88.137.213

🇧🇬 79.124.58.142

🇸🇬 64.235.41.157

🇧🇷 191.241.76.128

🇲🇽 189.203.190.153

🇧🇷 189.126.82.223