JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 172.203.204.230

172.203.204.230 was found in our database!

This IP was reported 20 times. Confidence of Abuse is 46%: ?

46%

ISP	Microsoft Limited
Usage Type	Data Center/Web Hosting/Transit
ASN	AS8075
Domain Name	microsoft.com
Country	🇺🇸 United States of America
City	Washington, Virginia

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 172.203.204.230

Whois 172.203.204.230

IP Abuse Reports for 172.203.204.230:

This IP address has been reported a total of 20 times from 17 distinct sources. 172.203.204.230 was first reported on May 26th 2026, and the most recent report was 4 weeks ago.

Old Reports: The most recent abuse report for this IP address is from 4 weeks ago . It is possible that this IP is no longer involved in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇺🇸 MPL	2026-06-03 06:40:08 (4 weeks ago)	tcp port scan (16 or more attempts)	Port Scan
🇺🇸 mutebot.net	2026-06-03 06:16:03 (4 weeks ago)	SRC=172.203.204.230, PROTO=TCP, SPT=16474, DPT=8080	Port Scan
🇧🇷 Vieira Filho	2026-06-03 06:04:15 (4 weeks ago)	172.203.204.230 - - [03/Jun/2026:03:04:14 -0300] [35.198.31.82] "35.198.31.82" "GET /.env HTTP/1.1" ... show more 172.203.204.230 - - [03/Jun/2026:03:04:14 -0300] [35.198.31.82] "35.198.31.82" "GET /.env HTTP/1.1" 404 169 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_4_1) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.4 Safari/605.1.15" 0.000 ... show less	Brute-Force Web App Attack Exploited Host
🇨🇦 Not Fake	2026-06-03 05:33:11 (4 weeks ago)	$f2bV_matches	Web App Attack
🇺🇸 aks4226	2026-06-03 05:20:12 (4 weeks ago)	Bot search, attacking common web applications.	Web App Attack
🇺🇸 donarev419	2026-06-03 05:05:43 (4 weeks ago)	Port scan detected on port 80 (connection without data transfer)	Port Scan
Anonymous	2026-06-03 05:03:58 (4 weeks ago)	172.203.204.230 - - [02/Jun/2026:22:03:57 -0700] "GET /.env.production HTTP/1.1" 403 397 "-" "Mozill ... show more 172.203.204.230 - - [02/Jun/2026:22:03:57 -0700] "GET /.env.production HTTP/1.1" 403 397 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)" ... show less	Brute-Force SSH
🇧🇷 SOC PR	2026-06-03 05:01:10 (4 weeks ago)	IPS: Web Server Exposed Git Repository Information Disclosure.	Hacking
🇺🇸 TPI-Abuse	2026-06-03 02:58:19 (4 weeks ago)	(mod_security) mod_security (id:210492) triggered by 172.203.204.230 (-): 1 in the last 300 secs; Po ... show more (mod_security) mod_security (id:210492) triggered by 172.203.204.230 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jun 02 22:58:13.216633 2026] [security2:error] [pid 17364:tid 17364] [client 172.203.204.230:15811] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "192.64.150.45"] [uri "/.git/HEAD"] [unique_id "ah-YRfBUqNVjqN3Wk-1OxAAAAAk"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 technash	2026-06-03 02:50:00 (4 weeks ago)	Port scanning detection [Fortinet/Sentinel]. Deny/drop traffic.	Port Scan
🇺🇸 TPI-Abuse	2026-06-03 02:19:40 (4 weeks ago)	(mod_security) mod_security (id:210492) triggered by 172.203.204.230 (-): 1 in the last 300 secs; Po ... show more (mod_security) mod_security (id:210492) triggered by 172.203.204.230 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jun 02 22:19:32.517042 2026] [security2:error] [pid 11671:tid 11671] [client 172.203.204.230:15813] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "192.64.150.139"] [uri "/.git/config"] [unique_id "ah-PNGlBZQDAyCAOL9h6RQAAAAw"] show less	Brute-Force Bad Web Bot Web App Attack
🇬🇧 PeravixGroup	2026-06-03 01:55:37 (4 weeks ago)	Honeypot detection: Web application scanning / reconnaissance attempt on port 8080. Severity: LOW. A ... show more Honeypot detection: Web application scanning / reconnaissance attempt on port 8080. Severity: LOW. Aaran.cloud show less	Port Scan Bad Web Bot
🇺🇸 TPI-Abuse	2026-06-02 12:24:07 (4 weeks ago)	(mod_security) mod_security (id:210492) triggered by 172.203.204.230 (-): 1 in the last 300 secs; Po ... show more (mod_security) mod_security (id:210492) triggered by 172.203.204.230 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jun 02 08:23:59.537817 2026] [security2:error] [pid 1391:tid 1391] [client 172.203.204.230:25560] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "192.64.150.65"] [uri "/.git/HEAD"] [unique_id "ah7LX2rXi4UXi6WRN2gaSQAAAAU"] show less	Brute-Force Bad Web Bot Web App Attack
Anonymous	2026-06-02 12:16:29 (4 weeks ago)	Unauthorized connection attempt	Port Scan Hacking Exploited Host
🇯🇵 VXG-NET	2026-06-02 09:48:32 (4 weeks ago)	port=80, indicator_type=info-leak	Hacking

Showing 1 to 15 of 20 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇰🇷 222.118.59.16

🇧🇷 190.115.84.25

🇩🇪 164.92.161.148

🇵🇰 154.208.43.55

🇸🇬 101.47.155.9

🇺🇸 66.132.195.50

🇺🇸 2602:80d:1008::9b

🇹🇭 182.52.236.235

🇺🇸 172.237.150.127

🇺🇸 162.216.149.161

🇺🇸 84.233.199.165

🇮🇷 62.60.132.53

🇱🇹 62.60.130.219

🇬🇧 35.203.210.12

🇮🇪 3.255.207.71

🇺🇸 2602:80d:1007::21

🇪🇸 196.196.150.99

🇧🇩 103.163.117.83

🇫🇷 91.231.89.46

🇧🇬 77.76.13.194