JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 172.203.85.194

172.203.85.194 was found in our database!

This IP was reported 28 times. Confidence of Abuse is 100%: ?

100%

ISP	Microsoft Limited
Usage Type	Data Center/Web Hosting/Transit
ASN	AS8075
Domain Name	microsoft.com
Country	🇺🇸 United States of America
City	Boydton, Virginia

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 172.203.85.194

Whois 172.203.85.194

IP Abuse Reports for 172.203.85.194:

This IP address has been reported a total of 28 times from 27 distinct sources. 172.203.85.194 was first reported on July 19th 2026, and the most recent report was 2 hours ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇩🇪 NetWatch	2026-07-26 10:13:24 (2 hours ago)	The IP 172.203.85.194 tried multiple SSH_BRUTE_FORCE logins	Brute-Force
🇭🇺 Lacika555	2026-07-25 19:36:31 (17 hours ago)	RdpGuard detected brute-force attempt on RDP	Brute-Force
🇩🇪 dispaisyenterprises	2026-07-23 09:22:46 (3 days ago)	Honeypot [fra-de-honeypot]: HTTP/1.1 request on 4040 CONNECT www.google.com:443 User-Agent: Mozilla ... show more Honeypot [fra-de-honeypot]: HTTP/1.1 request on 4040 CONNECT www.google.com:443 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:145.0) Gecko/20100101 Firefox/145.0; 4040 [1] TCP Reported by DisPaisy Enterprises (dispaisy.systems) using: https://github.com/sefinek/T-Pot-To-AbuseIPDB show less	Hacking Bad Web Bot
🇦🇺 LiftUp Hosting	2026-07-23 08:39:57 (3 days ago)	Honeypot hit: HTTP/1.1 request on 10085 CONNECT www.google.com:443 User-Agent: Mozilla/5.0 (Windows ... show more Honeypot hit: HTTP/1.1 request on 10085 CONNECT www.google.com:443 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:145.0) Gecko/20100101 Firefox/145.0; 10085 [1] TCP show less	Hacking Bad Web Bot
🇯🇵 demonsword	2026-07-23 08:26:27 (3 days ago)	Detected by SentinelX honeypot: sent HTTP CONNECT request probing for an open proxy. Connection was ... show more Detected by SentinelX honeypot: sent HTTP CONNECT request probing for an open proxy. Connection was hijacked and held in a tarpit to slow down the scan. Probed target: www.google.com:443 show less	Open Proxy Port Scan
🇧🇷 diego	2026-07-23 07:38:57 (3 days ago)	[rede-168-134] 07/23/2026-04:38:57.202344, 172.203.85.194, Protocol: 6, ET CINS Active Threat Intell ... show more [rede-168-134] 07/23/2026-04:38:57.202344, 172.203.85.194, Protocol: 6, ET CINS Active Threat Intelligence Poor Reputation IP group 227 show less	Hacking
🇩🇪 anycast_ac	2026-07-22 19:22:30 (3 days ago)	[mirai-detector honeypot] Inbound attack against our honeypot on tcp/9050 (socks). Tried credentials ... show more [mirai-detector honeypot] Inbound attack against our honeypot on tcp/9050 (socks). Tried credentials: b'james':b'123456' Family fingerprint: proxy-scanner Commands captured: $ socks5 methods offered: ['no-auth', 'user/pass'] $ socks5 auth: 'james' : '123456' show less	DDoS Attack
🇺🇸 NetGuard	2026-07-22 17:58:49 (3 days ago)	#honeypot #netguard247 #heralding #credentialharvesting Captured by NetGuard 24/7 T-Pot honeypot (ne ... show more #honeypot #netguard247 #heralding #credentialharvesting Captured by NetGuard 24/7 T-Pot honeypot (netguard24-7.com). Timestamp: 2026-07-22T17:58:49.216+00:00 Attacker IP: 172.203.85.194 \| Port: 1080 \| Country: United Kingdom Honeypot: heralding \| Attack: credential_harvesting Source: NetGuard 24/7 (netguard24-7.com) \| PhantomGrid Defense show less	Brute-Force
🇨🇦 Luhte	2026-07-22 17:49:38 (3 days ago)	Unsolicited TCP connection from 172.203.85.194 to port 0 at 2026-07-22T17:49:38Z. Source IP complete ... show more Unsolicited TCP connection from 172.203.85.194 to port 0 at 2026-07-22T17:49:38Z. Source IP completed three-way handshake to non-public service on this host. Detected by automated intrusion monitoring. show less	Port Scan Hacking
🇹🇷 Domainhizmetleri.com	2026-07-22 12:35:47 (4 days ago)	[honeypot] - MS-SQL-PROBE	Port Scan Hacking
🇩🇪 BlackCrowy	2026-07-22 12:15:22 (4 days ago)	Connection closed. Duration: 2 мин. 0 сек..	Port Scan
🇧🇬 MazenHost	2026-07-22 10:22:28 (4 days ago)	1784715748 - 07/22/2026 12:22:28 Host: 172.203.85.194/172.203.85.194 Port: 2000 TCP Blocked ...	Port Scan
🇬🇧 gbzret4d	2026-07-22 09:15:53 (4 days ago)	Honeypot [uk-production01]: Unauthorized traffic (4 bytes of payload); 10086 [1] TCP	Port Scan
🇺🇸 MPL	2026-07-22 02:20:35 (4 days ago)	tcp port scan (6 or more attempts)	Port Scan
🇸🇰 GOVCERT	2026-07-21 23:34:39 (4 days ago)	Excessive Firewall Denies	DDoS Attack Web Spam

Showing 1 to 15 of 28 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇳🇱 2a09:bac5:4e3d:2705::3e3:2

🇺🇸 167.99.238.115

🇨🇳 58.212.81.89

🇬🇧 185.216.145.179

🇳🇱 142.93.131.99

🇰🇷 101.36.114.198

🇸🇬 47.84.109.59

🇬🇧 35.203.211.17

🇮🇪 3.249.114.89

🇵🇱 176.53.159.198

🇵🇱 176.53.159.197

🇳🇵 160.250.254.141

🇺🇸 108.179.211.49

🇧🇬 79.124.60.194

🇵🇭 110.235.179.213

🇸🇬 103.189.235.93

🇷🇴 92.118.39.49

🇸🇬 51.79.217.46

🇹🇷 5.181.85.100

🇸🇬 119.13.106.88