JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 172.212.164.19

172.212.164.19 was found in our database!

This IP was reported 43 times. Confidence of Abuse is 44%: ?

44%

ISP	Microsoft Limited
Usage Type	Data Center/Web Hosting/Transit
ASN	AS8075
Domain Name	microsoft.com
Country	🇺🇸 United States of America
City	Des Moines, Iowa

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 172.212.164.19

Whois 172.212.164.19

IP Abuse Reports for 172.212.164.19:

This IP address has been reported a total of 43 times from 36 distinct sources. 172.212.164.19 was first reported on September 14th 2025, and the most recent report was 13 hours ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇪🇸 Z\|ntrueñigO	2026-07-21 21:56:57 (13 hours ago)	Auto-report. Hits=1, Ports=443, Country=-.	Brute-Force
🇳🇱 Selckie	2026-07-07 09:55:17 (2 weeks ago)	fail2ban: NGINX unusual impact	Web App Attack
🇰🇷 enp0s1	2026-06-16 05:43:02 (1 month ago)	Auto-reported by Fail2Ban (UFW Block, Port Scan)	Port Scan
🇧🇪 sid3windr	2026-06-12 01:17:42 (1 month ago)	GET /.git/HEAD (Tarpitted for 1d15h8m26s, wasted 8.06MB)	Web App Attack
🇦🇹 urnilxfgbez	2026-06-10 22:45:00 (1 month ago)	Last 24 Hours suspicious: (DPT=445\|DPT=3389\|DPT=22\|DPT=3306\|DPT=8080\|DPT=23\|DPT=5900\|DPT=1433)	Port Scan
🇧🇷 diego	2026-06-10 15:00:20 (1 month ago)	[probe-44-49] 2026-06-10 14:42:43, Client: 172.212.164.19, Protocol: 6, Unauthorized activity to HTT ... show more [probe-44-49] 2026-06-10 14:42:43, Client: 172.212.164.19, Protocol: 6, Unauthorized activity to HTTP: POST /___proxy_subdomain_whm/login/ show less	Web App Attack
🇺🇸 paulo.apoloni	2026-06-10 14:34:24 (1 month ago)	172.212.164.19 - - [10/Jun/2026:11:34:19 -0300] "GET /.git/HEAD HTTP/1.1" 404 118 "-" "Mozilla/5.0 ( ... show more 172.212.164.19 - - [10/Jun/2026:11:34:19 -0300] "GET /.git/HEAD HTTP/1.1" 404 118 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0" 172.212.164.19 - - [10/Jun/2026:11:34:20 -0300] "GET /.git/config HTTP/1.1" 404 118 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_4_1) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.4 Safari/605.1.15" 172.212.164.19 - - [10/Jun/2026:11:34:21 -0300] "GET /.env HTTP/1.1" 404 118 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14.4; rv:125.0) Gecko/20100101 Firefox/125.0" 172.212.164.19 - - [10/Jun/2026:11:34:22 -0300] "GET /.env.local HTTP/1.1" 404 118 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0" 172.212.164.19 - - [10/Jun/2026:11:34:23 -0300] "GET /.env.production HTTP/1.1" 404 118 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:125.0) Gecko/20100101 Firefox/125.0" ... show less	Web App Attack
🇺🇸 TPI-Abuse	2026-06-10 14:08:10 (1 month ago)	(mod_security) mod_security (id:210492) triggered by 172.212.164.19 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210492) triggered by 172.212.164.19 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jun 10 10:08:03.849444 2026] [security2:error] [pid 19076:tid 19076] [client 172.212.164.19:24075] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "192.64.150.177"] [uri "/.git/config"] [unique_id "ailvwzy1Rg8sTkZt101oDgAAAB0"] show less	Brute-Force Bad Web Bot Web App Attack
🇨🇭 zynex	2026-06-10 13:04:37 (1 month ago)	URL Probing: /.env	Web App Attack
🇹🇭 Sawasdee	2026-06-10 12:51:11 (1 month ago)	Unwanted checking 80 or 443 port ...	Bad Web Bot
🇺🇸 masterguru	2026-06-10 12:45:28 (1 month ago)	Host header is a numeric IP address. Pattern match "^ (920350-166)	Hacking Bad Web Bot
🇺🇸 TPI-Abuse	2026-06-10 11:39:22 (1 month ago)	(mod_security) mod_security (id:210492) triggered by 172.212.164.19 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210492) triggered by 172.212.164.19 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jun 10 07:39:16.139951 2026] [security2:error] [pid 20424:tid 20424] [client 172.212.164.19:24462] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "192.64.150.243"] [uri "/.git/HEAD"] [unique_id "ailM5GpDBJsw73WsmFaCZQAAAAE"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 thororen	2026-06-10 11:38:20 (1 month ago)	Blocked by UFW [2087/tcp] Source port: 24474 TTL: 44 Packet length: 60 TOS: 0x00 This report was ge ... show more Blocked by UFW [2087/tcp] Source port: 24474 TTL: 44 Packet length: 60 TOS: 0x00 This report was generated by: https://github.com/sefinek/UFW-AbuseIPDB-Reporter show less	Port Scan
🇺🇸 TPI-Abuse	2026-06-10 10:37:52 (1 month ago)	(mod_security) mod_security (id:210492) triggered by 172.212.164.19 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210492) triggered by 172.212.164.19 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jun 10 06:37:47.537079 2026] [security2:error] [pid 5971:tid 5971] [client 172.212.164.19:23713] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "192.64.150.136"] [uri "/.git/HEAD"] [unique_id "aik-e-q2UpA0tnSRv3UV-AAAAAM"] show less	Brute-Force Bad Web Bot Web App Attack
🇩🇪 DEV-DNS	2026-06-10 10:12:52 (1 month ago)	(mod_security) mod_security triggered on hostname [redacted])	SQL Injection

Showing 1 to 15 of 43 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇨🇱 181.226.250.250

🇫🇷 85.217.140.11

🇮🇷 193.151.135.52

🇨🇱 190.47.163.89

🇵🇱 189.81.135.7

🇮🇹 188.215.94.153

🇯🇴 178.77.189.29

🇺🇸 172.172.30.4

🇧🇩 160.187.117.139

🇺🇸 135.119.63.200

🇮🇩 124.40.252.3

🇨🇳 111.228.46.221

🇵🇰 103.186.114.70

🇳🇱 51.15.59.186

🇨🇳 221.234.36.123

🇺🇸 205.210.31.100

🇺🇸 199.195.254.215

🇳🇱 192.178.116.23

🇺🇸 173.239.240.213

🇩🇪 167.94.146.46