JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

172.172.87.85

Activity Trending Down

Abuse Confidence Score

13% Caution

18 reports

13 reporters · latest 2 weeks ago

ISP: Microsoft Limited
Usage Type: Data Center/Web Hosting/Transit
ASN: AS8075
Domain Name: microsoft.com
Country: 🇺🇸 United States of America
City: Boydton, Virginia

ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report Whois

Example preview

Account required for the enhanced features Log in Sign up

Abuse Reports

Export reports CSV

Total reports

18 from 13 distinct reporters

First reported

September 10th 2025

Most recent report

2 weeks ago

Last 60 days

Top reporter locations 🇺🇸 United States of America 2 🇯🇵 Japan 1

Most common categories Port Scan 2 Web App Attack 2 Open Proxy 2 Brute-Force 1 SSH 1

Old reports The most recent abuse report for this IP address is from 2 weeks ago. It is possible that this IP is no longer involved in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇺🇸 mnsf	2026-10-25 06:05:07 UTC · (2 weeks ago)	Too many Status 40X (11)	Brute-Force Web App Attack
🇺🇸 Rayulcifer	2026-10-03 13:07:59 UTC · (1 month ago)	172.172.87.85 - - [03/Oct/2026:08:07:54 -0500] "GET http://cachefly.cachefly.net/200mb.test HTTP/1.1" 403 363 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0 Safari/537.36" 172.172.87.85 - - [03/Oct/ ... show more 172.172.87.85 - - [03/Oct/2026:08:07:54 -0500] "GET http://cachefly.cachefly.net/200mb.test HTTP/1.1" 403 363 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0 Safari/537.36" 172.172.87.85 - - [03/Oct/2026:08:07:54 -0500] "GET http://ipv4.download.thinkbroadband.com/1MB.zip HTTP/1.1" 403 363 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0 Safari/537.36" 172.172.87.85 - - [03/Oct/2026:08:07:54 -0500] "GET http://speedtest.tele2.net/1MB.zip HTTP/1.1" 403 363 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0 Safari/537.36" 172.172.87.85 - - [03/Oct/2026:08:07:54 -0500] "CONNECT speed.cloudflare.com:443 HTTP/1.1" 403 344 "-" "-" 172.172.87.85 - - [03/Oct/2026:08:07:54 -0500] "CONNECT proof.ovh.net:443 HTTP/1.1" 403 344 "-" "-" ... show less	Open Proxy Port Scan Hacking Web App Attack SSH
🇯🇵 demonsword	2026-09-28 06:04:25 UTC · (1 month ago)	Detected by SentinelX honeypot: sent HTTP CONNECT request probing for an open proxy. Connection was hijacked and held in a tarpit to slow down the scan. Probed target: admin-pc.tail712579.ts.net:443	Open Proxy Port Scan
🇺🇸 mnsf	2026-09-12 20:05:36 UTC · (2 months ago)	Too many Status 40X (12)	Brute-Force Web App Attack
🇦🇺 nzhost.co.nz	2026-09-12 19:26:50 UTC · (2 months ago)	$f2bV_matches	Hacking Brute-Force
🇮🇹 VHosting	2026-08-08 22:20:04 UTC · (3 months ago)	Detected mail brute force attack from 4 different servers	Brute-Force
🇯🇵 SentinalX by uzumaru	2026-06-28 08:56:49 UTC · (4 months ago)	Detected by SentinelX honeypot: sent HTTP CONNECT request probing for an open proxy. Connection was hijacked and held in a tarpit to slow down the scan. Probed target: ptlogin.4399.com:443	Open Proxy Port Scan
Anonymous	2026-06-16 17:56:04 UTC · (4 months ago)	Unauthorized connection attempt	Port Scan Hacking Exploited Host
🇨🇿 ICT KnTl	2026-06-16 07:31:06 UTC · (4 months ago)	[Tue Jun 16 09:30:57.653756 2026] [php7:error] [pid 962152:tid 962152] [client 172.172.87.85:28759] script '/var/www/html/wp-config.php' not found or unable to stat [Tue Jun 16 09:31:05.439694 2026] [php7:error] [pid 962154:tid 962154] [client 172.17 ... show more [Tue Jun 16 09:30:57.653756 2026] [php7:error] [pid 962152:tid 962152] [client 172.172.87.85:28759] script '/var/www/html/wp-config.php' not found or unable to stat [Tue Jun 16 09:31:05.439694 2026] [php7:error] [pid 962154:tid 962154] [client 172.172.87.85:28772] script '/var/www/html/phpinfo.php' not found or unable to stat [Tue Jun 16 09:31:06.330874 2026] [php7:error] [pid 963969:tid 963969] [client 172.172.87.85:28749] script '/var/www/html/info.php' not found or unable to stat ... show less	Web App Attack
Anonymous	2026-06-16 06:49:34 UTC · (4 months ago)	2026-06-16T06:49:33.428035+00:00 caddy caddy[63377]: {"level":"info","ts":1781592573.427919,"logger":"http.log.access","msg":"handled request","request":{"remote_ip":"172.172.87.85","remote_port":"28865","client_ip":"172.172.87.85","proto":"HTTP/1.1" ... show more 2026-06-16T06:49:33.428035+00:00 caddy caddy[63377]: {"level":"info","ts":1781592573.427919,"logger":"http.log.access","msg":"handled request","request":{"remote_ip":"172.172.87.85","remote_port":"28865","client_ip":"172.172.87.85","proto":"HTTP/1.1","method":"GET","host":"142.132.232.19","uri":"/.git/refs/heads/main","headers":{"User-Agent":["Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 Edg/124.0.0.0"],"Connection":["close"],"Accept-Encoding":["gzip"]}},"bytes_read":0,"user_id":"","duration":0.000051361,"size":0,"status":308,"resp_headers":{"Server":["Caddy"],"Connection":["close"],"Location":["https://142.132.232.19/.git/refs/heads/main"],"Content-Type":[]}} ... show less	Hacking Web App Attack
🇺🇸 Mainpine	2026-06-16 06:41:16 UTC · (4 months ago)	probing for vulnerable web apps	Web App Attack
🇺🇸 TPI-Abuse	2026-06-16 06:12:56 UTC · (4 months ago)	(mod_security) mod_security (id:210492) triggered by 172.172.87.85 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jun 16 02:12:52.492049 2026] [security2:error] [pid 6101:tid 6101] [client 172.172.87.85:28737] Mod ... show more (mod_security) mod_security (id:210492) triggered by 172.172.87.85 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jun 16 02:12:52.492049 2026] [security2:error] [pid 6101:tid 6101] [client 172.172.87.85:28737] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "192.64.150.238"] [uri "/.git/HEAD"] [unique_id "ajDpZBahGFOkoiQRc3u8DgAAAAQ"] show less	Brute-Force Bad Web Bot Web App Attack
🇩🇪 ValtonTahiri	2026-06-07 16:09:50 UTC · (5 months ago)	UFW blocked a suspicious connection attempt to a closed or denied port. This activity is commonly associated with port scanning, service discovery, or automated internet probing. Technical: source_ip=172.172.87.85; proto=TCP; source_port=20166; targe ... show more UFW blocked a suspicious connection attempt to a closed or denied port. This activity is commonly associated with port scanning, service discovery, or automated internet probing. Technical: source_ip=172.172.87.85; proto=TCP; source_port=20166; target_port=7848; flags=SYN show less	Port Scan
🇯🇵 demonsword	2026-04-27 17:17:31 UTC · (6 months ago)	HTTP proxy scanner (CONNECT / open proxy probe) target: hvpnvn.edu.vn:443	Port Scan
🇺🇸 Rayulcifer	2026-04-02 13:44:10 UTC · (7 months ago)	172.172.87.85 - - [02/Apr/2026:08:41:05 -0500] "CONNECT www.emailondeck.com:443 HTTP/1.1" 502 488 "-" "-" 172.172.87.85 - - [02/Apr/2026:08:44:10 -0500] "CONNECT www.forumsal.net:443 HTTP/1.1" 502 544 "-" "-" ...	Open Proxy Port Scan Hacking Web App Attack SSH

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown

Recently Reported IPs:

🇱🇻 188.112.155.129

🇨🇳 123.245.84.241

🇷🇴 2.57.122.150

🇵🇰 2407:aa80:314:a633:be24:11ff:fe90:44f9

🇻🇳 222.254.229.216

🇧🇷 205.210.31.249

🇹🇼 198.235.24.103

🇨🇭 185.56.83.7

🇨🇦 85.217.149.54

🇸🇬 84.75.150.11

🇦🇱 46.252.40.111

🇳🇱 45.148.10.157

🇩🇪 2a0b:f4c2:1::1

🇬🇧 193.163.125.36

🇨🇱 190.5.34.233

🇨🇳 182.244.5.153

🇳🇱 176.65.149.160

🇺🇸 147.185.132.150

🇧🇬 78.128.112.74

🇨🇳 222.138.214.24