JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 172.203.196.182

172.203.196.182 was found in our database!

This IP was reported 21 times. Confidence of Abuse is 35%: ?

35%

ISP	Microsoft Limited
Usage Type	Data Center/Web Hosting/Transit
ASN	AS8075
Domain Name	microsoft.com
Country	🇺🇸 United States of America
City	Washington, Virginia

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 172.203.196.182

Whois 172.203.196.182

IP Abuse Reports for 172.203.196.182:

This IP address has been reported a total of 21 times from 14 distinct sources. 172.203.196.182 was first reported on April 10th 2026, and the most recent report was 10 hours ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇯🇵 demonsword	2026-07-14 12:57:55 (10 hours ago)	Detected by SentinelX honeypot: sent HTTP CONNECT request probing for an open proxy. Connection was ... show more Detected by SentinelX honeypot: sent HTTP CONNECT request probing for an open proxy. Connection was hijacked and held in a tarpit to slow down the scan. Probed target: e-learning.youpass.vn:443:443 show less	Open Proxy Port Scan
🇺🇸 Axel	2026-06-16 17:16:47 (4 weeks ago)	Blocked by UFW on MVI [2078/tcp] \| SPT: 4226 \| TTL: 47 \| LEN: 60 \| TOS: 0x00 • Reported by: github.c ... show more Blocked by UFW on MVI [2078/tcp] \| SPT: 4226 \| TTL: 47 \| LEN: 60 \| TOS: 0x00 • Reported by: github.com/sefinek/UFW-AbuseIPDB-Reporter show less	Port Scan
Anonymous	2026-06-14 10:44:58 (1 month ago)	Aggressive web scan	Web App Attack
🇯🇵 jay hung	2026-06-12 08:01:02 (1 month ago)	2026-06-12T08:01:02.227219+00:00 quarktech kernel: [1086105.142195] [UFW BLOCK] IN=eth0 OUT= MAC=22: ... show more 2026-06-12T08:01:02.227219+00:00 quarktech kernel: [1086105.142195] [UFW BLOCK] IN=eth0 OUT= MAC=22:00:92:2e:84:93:fe:ff:ff:ff:ff:ff:08:00 SRC=172.203.196.182 DST=172.237.20.248 LEN=40 TOS=0x00 PREC=0x00 TTL=101 ID=1 DF PROTO=TCP SPT=43050 DPT=443 WINDOW=0 RES=0x00 ACK RST URGP=0 ... show less	Port Scan
🇦🇹 urnilxfgbez	2026-06-02 22:45:00 (1 month ago)	Last 24 Hours suspicious: (DPT=445\|DPT=3389\|DPT=22\|DPT=3306\|DPT=8080\|DPT=23\|DPT=5900\|DPT=1433)	Port Scan
🇬🇧 PeravixGroup	2026-06-02 20:49:30 (1 month ago)	Honeypot detection: Web application scanning / reconnaissance attempt on port 8080. Severity: LOW. A ... show more Honeypot detection: Web application scanning / reconnaissance attempt on port 8080. Severity: LOW. Aaran.cloud show less	Port Scan Bad Web Bot
🇩🇪 AetherFox	2026-06-02 20:26:21 (1 month ago)	AetherFox VoidGuard detected: [Tue Jun 02 20:26:16.692974 2026] [authz_core:error] [pid 2940003:tid ... show more AetherFox VoidGuard detected: [Tue Jun 02 20:26:16.692974 2026] [authz_core:error] [pid 2940003:tid 2940008] [client 172.203.196.182:8397] AH01630: client denied by server configuration: proxy:http://[MASKED]/.git/HEAD [Tue Jun 02 20:26:16.693185 2026] [authz_core:error] [pid 2940003:tid 2940008] [client 172.203.196.182:8397] AH01630: client denied by server configuration: /var/www/html/ERRORpages/403.html [Tue Jun 02 20:26:19.143402 2026] [authz_core:error] [pid 2959821:tid 2959841] [client 172.203.196.182:8431] AH01630: client denied by server configuration: proxy:http://[MASKED]/.git/config [Tue Jun 02 20:26:19.143726 2026] [authz_core:error] [pid 2959821:tid 2959841] [client 172.203.196.182:8431] AH01630: client denied by server configuration: /var/www/html/ERRORpages/403.html [Tue Jun 02 20:26:20.053078 2026] [authz_core:error] [pid 2943145:tid 2943150] [client 172.203.196.182:9125] AH01630: client denied by server configuration: proxy:http://[MASKED]/ ... show less	Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-06-02 19:47:42 (1 month ago)	(mod_security) mod_security (id:210492) triggered by 172.203.196.182 (-): 1 in the last 300 secs; Po ... show more (mod_security) mod_security (id:210492) triggered by 172.203.196.182 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jun 02 15:47:37.696877 2026] [security2:error] [pid 23363:tid 23363] [client 172.203.196.182:9359] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "192.64.150.171"] [uri "/.git/HEAD"] [unique_id "ah8zWXbEBBqVQmXuhjmHmgAAAAo"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 RAP	2026-06-02 19:31:25 (1 month ago)	2026-06-02 19:31:25 UTC Unauthorized activity to TCP port 8080. Web App	Port Scan Web App Attack
🇬🇧 PeravixGroup	2026-06-02 17:19:11 (1 month ago)	Honeypot detection: Web application scanning / reconnaissance attempt on port 8443. Severity: LOW. A ... show more Honeypot detection: Web application scanning / reconnaissance attempt on port 8443. Severity: LOW. Aaran.cloud show less	Port Scan Bad Web Bot
Anonymous	2026-06-02 17:18:25 (1 month ago)	Unauthorized connection attempt	Port Scan Hacking Exploited Host
🇨🇦 lakered	2026-05-21 10:55:03 (1 month ago)	Detectors: [MANUAL] \| Reasons: Manual review: Malicious activity detected in web logs	Port Scan Hacking Web App Attack
Anonymous	2026-05-21 08:15:26 (1 month ago)	(caddyscan) Scanner path probe from 172.203.196.182 (US/United States/-): 5 in the last 3600 secs; P ... show more (caddyscan) Scanner path probe from 172.203.196.182 (US/United States/-): 5 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: [REDACTED] 200 2627 172.203.196.182 - - [21/May/2026:08:15:20 +0000] "GET /.env HTTP/1.1" [REDACTED] 200 2627 172.203.196.182 - - [21/May/2026:08:15:21 +0000] "GET /config/.env HTTP/1.1" [REDACTED] 200 2627 172.203.196.182 - - [21/May/2026:08:15:21 +0000] "GET /.git/config HTTP/1.1" [REDACTED] 200 2627 172.203.196.182 - - [21/May/2026:08:15:21 +0000] "GET /.env HTTP/1.1" [REDACTED] 200 2627 172.203.196.182 - - [21/May/2026:08:15:21 +0000] "GET /.env HTTP/1.1" show less	Port Scan
Anonymous	2026-05-21 07:57:19 (1 month ago)	(caddyscan) Scanner path probe from 172.203.196.182 (US/United States/-): 5 in the last 3600 secs; P ... show more (caddyscan) Scanner path probe from 172.203.196.182 (US/United States/-): 5 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: [REDACTED] 200 2627 172.203.196.182 - - [21/May/2026:07:57:14 +0000] "GET /config/.env HTTP/1.1" [REDACTED] 200 2627 172.203.196.182 - - [21/May/2026:07:57:14 +0000] "GET /.git/config HTTP/1.1" [REDACTED] 200 2627 172.203.196.182 - - [21/May/2026:07:57:15 +0000] "GET /.env HTTP/1.1" [REDACTED] 200 2627 172.203.196.182 - - [21/May/2026:07:57:15 +0000] "GET /.env HTTP/1.1" [REDACTED] 200 2627 172.203.196.182 - - [21/May/2026:07:57:15 +0000] "GET /@fs/.git/config?import&raw HTTP/1.1" show less	Port Scan
🇺🇸 TPI-Abuse	2026-05-21 06:43:04 (1 month ago)	(mod_security) mod_security (id:210492) triggered by 172.203.196.182 (-): 1 in the last 300 secs; Po ... show more (mod_security) mod_security (id:210492) triggered by 172.203.196.182 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu May 21 02:42:59.498607 2026] [security2:error] [pid 7379:tid 7379] [client 172.203.196.182:12355] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rentadeandamioscdmx.com"] [uri "/.env"] [unique_id "ag6pcyUBHc6Nv1XOjbt7oQAAAB0"], referer: https://stackoverflow.com/ show less	Brute-Force Bad Web Bot Web App Attack

Showing 1 to 15 of 21 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇩🇪 194.88.98.109

🇬🇧 185.192.70.181

🇬🇧 185.192.70.10

🇫🇷 185.177.72.205

🇺🇸 172.70.206.68

🇺🇸 172.67.221.104

🇮🇶 169.224.42.235

🇵🇰 154.208.42.67

🇹🇱 103.143.164.80

🇩🇪 64.89.163.168

🇱🇹 45.227.254.170

🇵🇹 188.208.143.24

🇬🇧 185.192.70.184

🇮🇳 182.95.181.138

🇸🇬 175.156.95.79

🇺🇸 172.58.146.42

🇮🇩 163.7.11.71

🇧🇷 152.250.13.185

🇭🇰 152.32.186.240

🇫🇮 147.185.133.4