JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 172.212.167.85

172.212.167.85 was found in our database!

This IP was reported 23 times. Confidence of Abuse is 89%: ?

89%

ISP	Microsoft Limited
Usage Type	Data Center/Web Hosting/Transit
ASN	AS8075
Domain Name	microsoft.com
Country	🇺🇸 United States of America
City	Des Moines, Iowa

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 172.212.167.85

Whois 172.212.167.85

IP Abuse Reports for 172.212.167.85:

This IP address has been reported a total of 23 times from 21 distinct sources. 172.212.167.85 was first reported on July 29th 2025, and the most recent report was 5 hours ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇦🇹 urnilxfgbez	2026-06-03 22:45:00 (5 hours ago)	Last 24 Hours suspicious: (DPT=445\|DPT=3389\|DPT=22\|DPT=3306\|DPT=8080\|DPT=23\|DPT=5900\|DPT=1433)	Port Scan
🇧🇷 SOC PR	2026-06-03 04:36:57 (23 hours ago)	IPS: Web Server Exposed Git Repository Information Disclosure.	Hacking
🇺🇸 MPL	2026-06-03 04:26:23 (23 hours ago)	tcp port scan (10 or more attempts)	Port Scan
🇺🇸 TPI-Abuse	2026-06-03 03:44:28 (1 day ago)	(mod_security) mod_security (id:210492) triggered by 172.212.167.85 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210492) triggered by 172.212.167.85 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jun 02 23:44:21.988569 2026] [security2:error] [pid 13669:tid 13669] [client 172.212.167.85:59057] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "192.64.150.181"] [uri "/.env"] [unique_id "ah-jFfSGhIarx-INV3ktHQAAABQ"] show less	Brute-Force Bad Web Bot Web App Attack
🇬🇧 PeravixGroup	2026-06-03 02:56:56 (1 day ago)	Honeypot detection: Web application scanning / reconnaissance attempt on port 8080. Severity: LOW. A ... show more Honeypot detection: Web application scanning / reconnaissance attempt on port 8080. Severity: LOW. Aaran.cloud show less	Port Scan Bad Web Bot
🇺🇸 Mantene	2026-06-03 02:44:18 (1 day ago)	172.212.167.85 - - [02/Jun/2026:22:44:14 -0400] "GET /.git/HEAD HTTP/1.1" 404 148 "-" "Mozilla/5.0 ( ... show more 172.212.167.85 - - [02/Jun/2026:22:44:14 -0400] "GET /.git/HEAD HTTP/1.1" 404 148 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_4_1) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.4 Safari/605.1.15" 172.212.167.85 - - [02/Jun/2026:22:44:16 -0400] "GET /.env HTTP/1.1" 404 143 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0" ... show less	Brute-Force SSH
🇹🇼 kk_it_man	2026-06-03 02:43:01 (1 day ago)	ET INFO Request to Hidden Environment File - Inbound ET WEB_SERVER WEB-PHP phpinfo access GPL WE ... show more ET INFO Request to Hidden Environment File - Inbound ET WEB_SERVER WEB-PHP phpinfo access GPL WEB_SERVER .htpasswd access show less	Port Scan
🇷🇸 Scan	2026-06-03 02:10:52 (1 day ago)	MultiHost/MultiPort Probe, Scan, Hack -	Port Scan Hacking
🇺🇸 TPI-Abuse	2026-06-03 00:53:04 (1 day ago)	(mod_security) mod_security (id:210492) triggered by 172.212.167.85 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210492) triggered by 172.212.167.85 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jun 02 20:53:00.212133 2026] [security2:error] [pid 16254:tid 16254] [client 172.212.167.85:58950] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "192.64.150.174"] [uri "/.git/HEAD"] [unique_id "ah967IqfIf_mkz7atCqNFQAAAAU"] show less	Brute-Force Bad Web Bot Web App Attack
🇫🇷 centurion	2026-06-03 00:51:14 (1 day ago)	Blocked by UFW on dc00 [8080/tcp] Source port: 58441 TTL: 46 Packet length: 60 TOS: 0x00 This repor ... show more Blocked by UFW on dc00 [8080/tcp] Source port: 58441 TTL: 46 Packet length: 60 TOS: 0x00 This report was generated by: https://github.com/sefinek/UFW-AbuseIPDB-Reporter show less	Port Scan Web App Attack
🇺🇸 Starburst SysOp Team	2026-06-03 00:34:54 (1 day ago)	Host header is a numeric IP address. Pattern match "(?:^( (920350-mnz6-5)	Hacking Bad Web Bot
🇩🇪 gadix	2026-06-03 00:10:22 (1 day ago)	[03/Jun/2026:02:10:17.303424 +0200] ah9w6VtlYSW9XAkUFKGg9wAAAJY 172.212.167.85 55184 127.0.0.1 7080 ... show more [03/Jun/2026:02:10:17.303424 +0200] ah9w6VtlYSW9XAkUFKGg9wAAAJY 172.212.167.85 55184 127.0.0.1 7080 [03/Jun/2026:02:10:20.763044 +0200] ah9w7FtlYSW9XAkUFKGg-QAAAIs 172.212.167.85 55196 127.0.0.1 7080 [03/Jun/2026:02:10:22.424264 +0200] ah9w7j4v-iLtHOlK9oAScQAAAAQ 172.212.167.85 55200 127.0.0.1 7080 ... show less	Web App Attack
🇬🇧 PeravixGroup	2026-06-02 23:28:35 (1 day ago)	Honeypot detection: Web application scanning / reconnaissance attempt on port 8443. Severity: LOW. A ... show more Honeypot detection: Web application scanning / reconnaissance attempt on port 8443. Severity: LOW. Aaran.cloud show less	Port Scan Bad Web Bot
Anonymous	2026-06-02 23:15:01 (1 day ago)	suspicious request in access.log	Web App Attack
🇫🇷 dynamix	2026-06-02 23:07:11 (1 day ago)	Multiple WAF Violations	Web App Attack

Showing 1 to 15 of 23 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇦🇷 200.41.185.228

🇳🇱 176.65.148.132

🇩🇪 167.94.146.65

🇺🇸 162.216.149.161

🇧🇷 147.15.20.173

🇮🇳 103.88.76.27

🇭🇰 101.36.122.183

🇫🇷 91.231.89.79

🇮🇩 43.133.148.170

🇬🇧 35.203.210.233

🇨🇳 183.185.111.202

🇺🇸 163.192.14.130

🇺🇸 72.240.29.242

🇰🇷 39.115.195.164

🇺🇸 18.117.108.210

🇮🇷 5.61.30.220

🇺🇸 192.210.254.30

🇬🇧 185.247.137.9

🇮🇳 171.61.20.182

🇺🇸 147.185.132.84