JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

172.184.166.99

Activity Trending Down

Abuse Confidence Score

13% Caution

20 reports

17 reporters · latest 4 weeks ago

ISP: Microsoft Limited
Usage Type: Data Center/Web Hosting/Transit
ASN: AS8075
Domain Name: microsoft.com
Country: 🇺🇸 United States of America
City: San Jose, California

ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report Whois

Example preview

Account required for the enhanced features Log in Sign up

Abuse Reports

Export reports CSV

Total reports

20 from 17 distinct reporters

First reported

June 10th 2026

Most recent report

4 weeks ago

Last 60 days

Top reporter locations 🇺🇸 United States of America 2 🇹🇷 Turkey 1

Most common categories Web App Attack 2 Port Scan 2 Open Proxy 1 Bad Web Bot 1 Brute-Force 1

Old reports The most recent abuse report for this IP address is from 4 weeks ago. It is possible that this IP is no longer involved in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇹🇷 Domainhizmetleri.com	2026-10-18 17:09:47 UTC · (4 weeks ago)	Source: DH Hunter (Honeypot) \| Reason: Portscan (1 ports, 1 attempts in 480h, non-TR)	Port Scan
🇺🇸 TPI-Abuse	2026-10-16 07:35:07 UTC · (4 weeks ago)	(mod_security) mod_security (id:210801) triggered by 172.184.166.99 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 16 03:35:02.859630 2026] [security2:error] [pid 30341:tid 30341] [client 172.184.166.99:22552] ... show more (mod_security) mod_security (id:210801) triggered by 172.184.166.99 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 16 03:35:02.859630 2026] [security2:error] [pid 30341:tid 30341] [client 172.184.166.99:22552] ModSecurity: Access denied with code 403 (phase 2). Matched phrase "grabber" at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "17"] [id "210801"] [rev "2"] [msg "COMODO WAF: Request Indicates a Security Scanner Scanned the Site\|\|www.unitymaine.org\|F\|2"] [data "electiondatagrabber/0.1 (+academic election research)"] [severity "CRITICAL"] [tag "CWAF"] [tag "Agents"] [hostname "www.unitymaine.org"] [uri "/town-clerk/pages/elections"] [unique_id "atHTpvC3zAdhiLmSCbuOUAAAAAU"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 Rayulcifer	2026-10-03 17:06:00 UTC · (1 month ago)	172.184.166.99 - - [03/Oct/2026:12:05:50 -0500] "GET /.env HTTP/1.1" 200 852 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.129 Safari/537.36" ...	Open Proxy Port Scan Hacking Web App Attack SSH
Anonymous	2026-08-26 04:01:18 UTC · (2 months ago)	172.184.166.99 - - [26/Aug/2026:06:01:16 +0200] "GET /careers HTTP/1.1" 404 117837 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36" 172.184.166.99 - - [26/Aug/2026:06:01:16 +0200] "GET /careers HTTP/1.1" 404 21956 "-" "Mozilla/5.0 ( ... show more 172.184.166.99 - - [26/Aug/2026:06:01:16 +0200] "GET /careers HTTP/1.1" 404 117837 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36" 172.184.166.99 - - [26/Aug/2026:06:01:16 +0200] "GET /careers HTTP/1.1" 404 21956 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36" 172.184.166.99 - - [26/Aug/2026:06:01:17 +0200] "GET /career HTTP/1.1" 404 21955 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36" 172.184.166.99 - - [26/Aug/2026:06:01:16 +0200] "GET /join HTTP/1.1" 404 117810 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36" 172.184.166.99 - - [26/Aug/2026:06:01:16 +0200] "GET /career HTTP/1.1" 404 117828 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36" 172.184.166.99 - - [26/Aug/2026:06:01:17 +0200] "GET /join HTTP/1.1" 404 21952 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36" 172.184.166.99 - - [26/Aug/2026:06:01:17 +0200] "GET /openings HTTP/1.1" 404 21958 "-" "Mozilla/5.0 (Windows NT ... show less	Bad Web Bot Web App Attack
🇩🇪 dpsbs	2026-08-09 05:26:27 UTC · (3 months ago)	multiple ips intrustions detected	Hacking
🇩🇪 jeannelboutique	2026-08-09 05:14:23 UTC · (3 months ago)	(mod_security) mod_security triggered on hostname [redacted] 172.184.166.99 (US/United States/-)	SQL Injection
🇺🇸 gu-alvareza	2026-08-09 05:05:02 UTC · (3 months ago)	Spring.Boot.Actuator.Unauthorized.Access	Brute-Force
Anonymous	2026-08-09 04:40:17 UTC · (3 months ago)	This IP was detected by CrowdSec triggering crowdsecurity/http-sensitive-files	Web App Attack Hacking
🇺🇸 MPL	2026-08-09 03:28:56 UTC · (3 months ago)	tcp port scan (20 or more attempts)	Port Scan
🇮🇪 AutosOnShow	2026-08-09 02:20:06 UTC · (3 months ago)	blocked for webapp attack \| path requested: /.git/config \| seen at 2026-08-09 02:19:35.948 \|	Web App Attack
🇺🇸 TPI-Abuse	2026-08-09 01:54:39 UTC · (3 months ago)	(mod_security) mod_security (id:210492) triggered by 172.184.166.99 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Aug 08 21:54:33.692382 2026] [security2:error] [pid 3232493:tid 3232493] [client 172.184.166.99:23 ... show more (mod_security) mod_security (id:210492) triggered by 172.184.166.99 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Aug 08 21:54:33.692382 2026] [security2:error] [pid 3232493:tid 3232493] [client 172.184.166.99:23619] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "192.64.150.54"] [uri "/.git/HEAD"] [unique_id "anfd2e9q2LTaPK14LKJVQgAAADI"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 c y	2026-08-05 22:46:28 UTC · (3 months ago)	Security Monitor detected: sensitive_path_access	Port Scan
🇩🇪 KPS	2026-08-03 04:19:00 UTC · (3 months ago)	PortscanN	Port Scan
Anonymous	2026-08-03 03:18:43 UTC · (3 months ago)	172.184.166.99 - - [03/Aug/2026:03:18:34 +0000] "GET /.git/HEAD HTTP/1.1" 444 0 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:125.0) Gecko/20100101 Firefox/125.0" "-" 172.184.166.99 - - [03/Aug/2026:03:18:36 +0000] "GET /.git/logs/HEAD HTTP/1.1" 444 0 "-" ... show more 172.184.166.99 - - [03/Aug/2026:03:18:34 +0000] "GET /.git/HEAD HTTP/1.1" 444 0 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:125.0) Gecko/20100101 Firefox/125.0" "-" 172.184.166.99 - - [03/Aug/2026:03:18:36 +0000] "GET /.git/logs/HEAD HTTP/1.1" 444 0 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_4_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36" "-" 172.184.166.99 - - [03/Aug/2026:03:18:38 +0000] "GET /.git/refs/heads/master HTTP/1.1" 444 0 "-" "Mozilla/5.0 (Linux; Android 14; Pixel 8) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Mobile Safari/537.36" "-" 172.184.166.99 - - [03/Aug/2026:03:18:40 +0000] "GET /.git/refs/heads/main HTTP/1.1" 444 0 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36" "-" 172.184.166.99 - - [03/Aug/2026:03:18:43 +0000] "GET /.env.local HTTP/1.1" 444 0 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0" "-" ... show less	Port Scan Brute-Force
🇹🇷 SeczarSecureOps	2026-08-03 01:15:41 UTC · (3 months ago)	Auto-blocked by Seczar SecureOps — Port Scan Detection (10 events in 10min) at 2026-08-03 01:15	Port Scan

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown

Recently Reported IPs:

🇺🇸 216.25.89.119

🇭🇰 152.32.252.233

🇧🇷 191.55.171.100

🇺🇸 162.216.150.37

🇺🇸 104.28.169.56

🇳🇱 64.205.72.117

🇺🇸 52.2.4.213

🇺🇸 49.51.245.241

🇺🇸 35.254.202.136

🇹🇼 34.81.154.249

🇹🇳 196.229.6.162

🇨🇭 179.43.188.2

🇺🇸 136.85.254.191

🇸🇬 206.189.80.176

🇧🇧 196.3.215.107

🇺🇸 142.93.251.172

🇨🇳 113.142.60.99

🇨🇮 102.67.251.252

🇳🇱 45.148.10.141

🇺🇸 45.132.187.172