JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

172.172.87.66

Activity Trending Down

Abuse Confidence Score

7% Caution

16 reports

14 reporters · latest 1 month ago

ISP: Microsoft Limited
Usage Type: Data Center/Web Hosting/Transit
ASN: AS8075
Domain Name: microsoft.com
Country: 🇺🇸 United States of America
City: Boydton, Virginia

ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report Whois

Example preview

Account required for the enhanced features Log in Sign up

Abuse Reports

Export reports CSV

Total reports

16 from 14 distinct reporters

First reported

October 19th 2025

Most recent report

1 month ago

Last 60 days

Top reporter locations 🇨🇿 Czechia 1 🇳🇱 Netherlands 1

Most common categories Web App Attack 2 Hacking 2 Brute-Force 1

Old reports The most recent abuse report for this IP address is from 1 month ago. It is possible that this IP is no longer involved in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
Anonymous	2026-09-20 17:38:02 UTC · (1 month ago)	Malicious activity detected	Hacking Web App Attack
Anonymous	2026-09-20 17:11:59 UTC · (1 month ago)	IP matched detection query 20 more in short time bad rqs.	Brute-Force Web App Attack Hacking
🇮🇹 VHosting	2026-08-22 20:35:07 UTC · (2 months ago)	Detected mail brute force attack from different servers	Brute-Force
🇺🇸 Rayulcifer	2026-08-16 18:29:11 UTC · (2 months ago)	172.172.87.66 - - [16/Aug/2026:13:29:10 -0500] "GET http://cachefly.cachefly.net/200mb.test HTTP/1.1" 403 363 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0 Safari/537.36" 172.172.87.66 - - [16/Aug/ ... show more 172.172.87.66 - - [16/Aug/2026:13:29:10 -0500] "GET http://cachefly.cachefly.net/200mb.test HTTP/1.1" 403 363 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0 Safari/537.36" 172.172.87.66 - - [16/Aug/2026:13:29:10 -0500] "GET http://ipv4.download.thinkbroadband.com/1MB.zip HTTP/1.1" 403 363 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0 Safari/537.36" 172.172.87.66 - - [16/Aug/2026:13:29:10 -0500] "GET http://speedtest.tele2.net/1MB.zip HTTP/1.1" 403 363 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0 Safari/537.36" 172.172.87.66 - - [16/Aug/2026:13:29:10 -0500] "CONNECT proof.ovh.net:443 HTTP/1.1" 403 344 "-" "-" 172.172.87.66 - - [16/Aug/2026:13:29:10 -0500] "CONNECT speed.cloudflare.com:443 HTTP/1.1" 403 344 "-" "-" ... show less	Open Proxy Port Scan Hacking Web App Attack SSH
Anonymous	2026-06-03 06:15:16 UTC · (5 months ago)	Unauthorized connection attempt	Port Scan Hacking Exploited Host
🇹🇷 Threat.live	2026-06-03 05:50:03 UTC · (5 months ago)	Suspicious Connection Attempts	Brute-Force
🇺🇸 TPI-Abuse	2026-06-03 05:15:19 UTC · (5 months ago)	(mod_security) mod_security (id:210492) triggered by 172.172.87.66 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jun 03 01:15:11.413442 2026] [security2:error] [pid 12923:tid 12923] [client 172.172.87.66:29856] M ... show more (mod_security) mod_security (id:210492) triggered by 172.172.87.66 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jun 03 01:15:11.413442 2026] [security2:error] [pid 12923:tid 12923] [client 172.172.87.66:29856] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "192.64.151.14"] [uri "/.git/config"] [unique_id "ah-4X59sWP4rgqNFROWeUQAAAAg"] show less	Brute-Force Bad Web Bot Web App Attack
🇩🇪 pscriptos	2026-05-26 06:39:08 UTC · (5 months ago)	This IP was detected by CrowdSec triggering crowdsecurity/http-probing	Web App Attack Hacking
🇳🇱 wlt-blocker	2026-04-22 00:13:45 UTC · (6 months ago)	Unauthorized access to webpage admin	Web App Attack
🇫🇷 dynamix	2026-04-21 23:21:18 UTC · (6 months ago)	Multiple WAF Violations	Web App Attack
🇫🇮 kumiko	2026-04-21 22:21:32 UTC · (6 months ago)	[2026-04-22 01:21:31] Probing for dotfiles "GET /.git/config HTTP/2.0" 302	Bad Web Bot Web App Attack
🇺🇸 Rayulcifer	2026-04-20 19:13:42 UTC · (6 months ago)	172.172.87.66 - - [20/Apr/2026:14:13:41 -0500] "CONNECT speed.hetzner.de:443 HTTP/1.1" 502 488 "-" "-" 172.172.87.66 - - [20/Apr/2026:14:13:41 -0500] "CONNECT speed.cloudflare.com:443 HTTP/1.1" 502 488 "-" "-" ...	Open Proxy Port Scan Hacking Web App Attack SSH
🇩🇪 2048	2026-03-21 18:30:27 UTC · (7 months ago)	2026-03-21T19:30:24.519189+01:00 machodeer kernel: [2374643.654166] [UFW BLOCK] IN=ens3 OUT= MAC=REDACTED SRC=172.172.87.66 DST=REDACTED LEN=60 TOS=0x00 PREC=0x00 TTL=44 ID=64416 DF PROTO=TCP SPT=25857 DPT=443 WINDOW=64240 RES=0x00 SYN URGP=0 2026-0 ... show more 2026-03-21T19:30:24.519189+01:00 machodeer kernel: [2374643.654166] [UFW BLOCK] IN=ens3 OUT= MAC=REDACTED SRC=172.172.87.66 DST=REDACTED LEN=60 TOS=0x00 PREC=0x00 TTL=44 ID=64416 DF PROTO=TCP SPT=25857 DPT=443 WINDOW=64240 RES=0x00 SYN URGP=0 2026-03-21T19:30:25.577372+01:00 machodeer kernel: [2374644.712286] [UFW BLOCK] IN=ens3 OUT= MAC=REDACTED SRC=172.172.87.66 DST=REDACTED LEN=60 TOS=0x00 PREC=0x00 TTL=44 ID=64417 DF PROTO=TCP SPT=25857 DPT=443 WINDOW=64240 RES=0x00 SYN URGP=0 2026-03-21T19:30:26.600693+01:00 machodeer kernel: [2374645.736097] [UFW BLOCK] IN=ens3 OUT= MAC=REDACTED SRC=172.172.87.66 DST=REDACTED LEN=60 TOS=0x00 PREC=0x00 TTL=44 ID=64418 DF PROTO=TCP SPT=25857 DPT=443 WINDOW=64240 RES=0x00 SYN URGP=0 show less	Port Scan
🇺🇸 Rayulcifer	2026-02-28 08:21:29 UTC · (8 months ago)	172.172.87.66 - - [28/Feb/2026:03:21:29 -0500] "CONNECT speed.hetzner.de:443 HTTP/1.1" 502 488 "-" "-" 172.172.87.66 - - [28/Feb/2026:03:21:29 -0500] "CONNECT speed.cloudflare.com:443 HTTP/1.1" 502 488 "-" "-" ...	Open Proxy Port Scan Hacking Web App Attack SSH
Anonymous	2026-01-17 07:44:53 UTC · (9 months ago)	Aggressive web scan	Web App Attack

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown

Recently Reported IPs:

🇺🇸 185.61.222.49

🇺🇸 51.8.102.13

🇺🇸 199.165.159.205

🇦🇱 193.187.101.221

🇹🇷 185.231.227.116

🇨🇳 183.13.78.77

🇩🇪 172.68.192.184

🇸🇬 161.118.226.106

🇮🇳 118.91.176.212

🇻🇳 113.169.77.212

🇳🇱 109.160.32.165

🇫🇷 85.217.140.48

🇮🇷 78.109.200.147

🇺🇸 70.182.173.218

🇺🇸 20.84.99.255

🇫🇷 13.140.162.10

🇮🇹 188.215.94.140

🇧🇷 187.0.232.186

🇨🇦 85.217.149.70

🇺🇸 57.141.20.70