JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

172.195.108.132

Recent Activity

Abuse Confidence Score

100% Critical

596 reports

407 reporters · latest 54 minutes ago

ISP: Microsoft Limited
Usage Type: Data Center/Web Hosting/Transit
ASN: AS8075
Domain Name: microsoft.com
Country: 🇲🇽 Mexico
City: Santiago de Queretaro, Queretaro

ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report Whois

Example preview

Account required for the enhanced features Log in Sign up

Abuse Reports

Export reports CSV

Total reports

596 from 407 distinct reporters

First reported

November 10th 2026

Most recent report

54 minutes ago

Last 60 days

Top reporter locations 🇩🇪 Germany 153 🇺🇸 United States of America 133 🇫🇷 France 56

Most common categories Web App Attack 470 Hacking 144 Bad Web Bot 142 Brute-Force 121 Port Scan 34

Recent reports We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇭🇺 kranem	2026-11-11 18:01:10 UTC · (54 minutes ago)	Triggered Cloudflare WAF from MX. Action taken: BLOCK ASN: 8075 (Microsoft Corporation) Protocol: HTTP/1.1 (GET method) Endpoint: /wp-includes/blocks/gallery/JedAV2QSJ1.php Timestamp: 2026-11-11T15:23:01Z User-Agent: empty	Bad Web Bot
🇩🇪 rh24	2026-11-11 18:00:04 UTC · (55 minutes ago)	HTTP flood or excessive requests, blocked by host firewall.	DDoS Attack Web App Attack
🇺🇸 MatCat	2026-11-11 17:05:10 UTC · (1 hour ago)	Banned by fail2ban: apache-noscript	Hacking Web App Attack
🇩🇪 Admin-Gito	2026-11-11 16:57:32 UTC · (1 hour ago)	172.195.108.132 - - [11/Nov/2026:17:50:00 +0100] "GET /wp-includes/ID3/module.audio-video.asf-character.php HTTP/1.1" 404 349439 "-" "-" 172.195.108.132 - - [11/Nov/2026:17:50:09 +0100] "GET /wp-includes/PHPMailer/admin.php HTTP/1.1" 404 349425 "-" " ... show more 172.195.108.132 - - [11/Nov/2026:17:50:00 +0100] "GET /wp-includes/ID3/module.audio-video.asf-character.php HTTP/1.1" 404 349439 "-" "-" 172.195.108.132 - - [11/Nov/2026:17:50:09 +0100] "GET /wp-includes/PHPMailer/admin.php HTTP/1.1" 404 349425 "-" "-" 172.195.108.132 - - [11/Nov/2026:17:50:17 +0100] "GET /wp-includes/class-wpdb-core.php HTTP/1.1" 404 349425 "-" "-" 172.195.108.132 - - [11/Nov/2026:17:50:23 +0100] "GET /wp-includes/d98a400.php HTTP/1.1" 404 349417 "-" "-" 172.195.108.132 - - [11/Nov/2026:17:50:25 +0100] "GET /wp-includes/fonts/shell.php HTTP/1.1" 404 349414 "-" "-" 172.195.108.132 - - [11/Nov/2026:17:50:27 +0100] "GET /wp-includes/pgQE1XRxufm.php HTTP/1.1" 404 349421 "-" "-" 172.195.108.132 - - [11/Nov/2026:17:50:39 +0100] "GET /wp-includes/IXR/wp-login.php HTTP/1.1" 404 349415 "-" "-" 172.195.108.132 - - [11/Nov/2026:17:50:41 +0100] "GET /wp-includes/class-walker-comment-wp.php HTTP/1.1" 404 349433 "-" "-" 172.195.108.132 - - [11/Nov/2026:17:50:45 +0100] "GET /wp-incl ... show less	Web App Attack
Anonymous	2026-11-11 16:44:30 UTC · (2 hours ago)	IP matched detection query 20 more in short time bad rqs.	Brute-Force Web App Attack Hacking
🇦🇺 2000cn.com.au	2026-11-11 16:42:01 UTC · (2 hours ago)	This IP was detected by CrowdSec triggering crowdsecurity/http-probing	Web App Attack Hacking
Anonymous	2026-11-11 16:40:38 UTC · (2 hours ago)	Aggressive web scan	Web App Attack
🇳🇴 doofy	2026-11-11 16:35:16 UTC · (2 hours ago)	[Wed Nov 11 17:32:15.300331 2026] [access_compat:error] [pid 38505:tid 38607] [client 172.195.108.132:49623] AH01797: client denied by server configuration: /www/famjohnsen.no/wp-content/languages/plugins/index.php [Wed Nov 11 17:33:15.317359 2026] [ ... show more [Wed Nov 11 17:32:15.300331 2026] [access_compat:error] [pid 38505:tid 38607] [client 172.195.108.132:49623] AH01797: client denied by server configuration: /www/famjohnsen.no/wp-content/languages/plugins/index.php [Wed Nov 11 17:33:15.317359 2026] [access_compat:error] [pid 38505:tid 38601] [client 172.195.108.132:49623] AH01797: client denied by server configuration: /www/famjohnsen.no/wp-content/uploads/sectors.php [Wed Nov 11 17:33:35.545713 2026] [access_compat:error] [pid 38505:tid 38599] [client 172.195.108.132:49623] AH01797: client denied by server configuration: /www/famjohnsen.no/wp-content/uploads/wp-login.php [Wed Nov 11 17:34:08.396429 2026] [access_compat:error] [pid 38505:tid 38579] [client 172.195.108.132:49623] AH01797: client denied by server configuration: /www/famjohnsen.no/wp-content/languages/wp-login.php [Wed Nov 11 17:35:15.368053 2026] [access_compat:error] [pid 38505:tid 38608] [client 172.195.108.132:49654] AH01797: client denied by server configuration: /ww ... show less	Brute-Force Web App Attack
🇫🇷 security.rdmc.fr	2026-11-11 16:18:06 UTC · (2 hours ago)	Activity from blacklisted IP	Hacking
🇺🇸 nasset	2026-11-11 16:16:05 UTC · (2 hours ago)	172.195.108.132 - - [11/Nov/2026:08:16:04 -0800] "GET /fleen.php?p= HTTP/1.1" 403 584 "-" "-" TLSv1.3 TLS_AES_256_GCM_SHA384 172.195.108.132 - - [11/Nov/2026:08:16:04 -0800] "GET /lala.php HTTP/1.1" 403 584 "-" "-" TLSv1.3 TLS_AES_256_GCM_SHA384 172. ... show more 172.195.108.132 - - [11/Nov/2026:08:16:04 -0800] "GET /fleen.php?p= HTTP/1.1" 403 584 "-" "-" TLSv1.3 TLS_AES_256_GCM_SHA384 172.195.108.132 - - [11/Nov/2026:08:16:04 -0800] "GET /lala.php HTTP/1.1" 403 584 "-" "-" TLSv1.3 TLS_AES_256_GCM_SHA384 172.195.108.132 - - [11/Nov/2026:08:16:04 -0800] "GET /file18.php HTTP/1.1" 403 584 "-" "-" TLSv1.3 TLS_AES_256_GCM_SHA384 172.195.108.132 - - [11/Nov/2026:08:16:05 -0800] "GET /file2.php HTTP/1.1" 403 584 "-" "-" TLSv1.3 TLS_AES_256_GCM_SHA384 172.195.108.132 - - [11/Nov/2026:08:16:05 -0800] "GET /bd.php HTTP/1.1" 403 584 "-" "-" TLSv1.3 TLS_AES_256_GCM_SHA384 ... show less	Bad Web Bot Web App Attack
🇻🇮 Axel	2026-11-11 16:14:48 UTC · (2 hours ago)	WAF/ModSecurity blocked 142 malicious request(s) (HTTP 403) from this IP. Activity: empty User-Agent accessing WP PHP file in directory x50; request_uri: Wordpress - prevent PHP files from executing x45; root php probe: missing UA+Referer x34; reques ... show more WAF/ModSecurity blocked 142 malicious request(s) (HTTP 403) from this IP. Activity: empty User-Agent accessing WP PHP file in directory x50; request_uri: Wordpress - prevent PHP files from executing x45; root php probe: missing UA+Referer x34; request_uri: prevent PHP files from executing x5; request_uri: Images folder - prevent PHP files from executing x2; request_uri: Fonts folder - prevent PHP files from executing x2; Wordpress - Malware x2; request_uri: CSS - prevent PHP files from executing x1; WordPress Core upgrade-window staging directory request blocked (WP 4.7-7.1.3 TOCTOU RCE, Wordfence 4b4da0cf, no CVE) x1. Latest: 2026-11-11T16:14:48Z. show less	Web Spam Hacking Brute-Force Web App Attack
🇹🇭 thaizone.com	2026-11-11 16:13:37 UTC · (2 hours ago)	Hacking attempts against websites (D1) #3	Web App Attack Hacking
🇩🇪 svr	2026-11-11 16:11:22 UTC · (2 hours ago)	Abusive Automated Web Scanner	Web App Attack
🇫🇷 Baking333	2026-11-11 16:07:46 UTC · (2 hours ago)	[redacted] 172.195.108.132 - - [11/Nov/2026:17:07:27 +0100] "GET /wp-content/plugins/hellopress/wp_filemanager.php HTTP/1.1" 302 6776 0/54768 "-" "-" 443 [redacted] 172.195.108.132 - - [11/Nov/2026:17:07:44 +0100] "GET /[redacted] HTTP/1.1" 302 1559 ... show more [redacted] 172.195.108.132 - - [11/Nov/2026:17:07:27 +0100] "GET /wp-content/plugins/hellopress/wp_filemanager.php HTTP/1.1" 302 6776 0/54768 "-" "-" 443 [redacted] 172.195.108.132 - - [11/Nov/2026:17:07:44 +0100] "GET /[redacted] HTTP/1.1" 302 1559 0/41046 "-" "-" 443 show less	Bad Web Bot Web App Attack
🇺🇸 ruusvuu	2026-11-11 16:01:03 UTC · (2 hours ago)	Automated abuse report: 153 attack/probe requests from Microsoft Corporation / MX. Targeted paths: /wp-content/plugins/hellopress/wp_filemanager.php, /this_is_a_new_hello_world.php, /new.php, /wp-access.php, /link.php. Sample log lines: [realprosperi ... show more Automated abuse report: 153 attack/probe requests from Microsoft Corporation / MX. Targeted paths: /wp-content/plugins/hellopress/wp_filemanager.php, /this_is_a_new_hello_world.php, /new.php, /wp-access.php, /link.php. Sample log lines: [realprosperity] 172.195.108.132 [2026-11-11T16:01:01.810Z] "GET /this_is_a_new_hello_world.php" 404 15330 2.453 ms "-" "-" [realprosperity] 172.195.108.132 [2026-11-11T16:01:01.939Z] "GET /new.php" 404 15330 5.822 ms "-" "-" [realprosperity] 172.195.108.132 [2026-11-11T16:01:02.433Z] "GET /bless241.php" 404 15330 2.669 ms "-" "-" Detected by an automated web-server log monitor. show less	Web App Attack

Showing 1 to 15 of 596 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown

Recently Reported IPs:

🇮🇩 114.12.5.198

🇧🇷 205.210.31.237

🇨🇦 184.147.153.57

🇮🇳 172.232.108.36

🇧🇬 79.124.59.78

🇳🇱 64.205.72.65

🇨🇳 39.149.10.102

🇺🇸 35.149.58.11

🇮🇳 20.219.139.13

🇷🇴 2.57.121.112

🇧🇬 193.24.211.219

🇫🇮 147.185.133.87

🇺🇸 147.185.132.138

🇺🇸 134.33.66.242

🇧🇩 103.158.119.148

🇺🇸 72.93.213.125

🇦🇷 45.231.226.5

🇺🇸 20.169.84.222

🇨🇴 181.132.191.15

🇩🇪 136.243.88.210