JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 172.213.2.180

172.213.2.180 was found in our database!

This IP was reported 239 times. Confidence of Abuse is 100%: ?

100%

ISP	Microsoft Limited
Usage Type	Data Center/Web Hosting/Transit
ASN	AS8075
Domain Name	microsoft.com
Country	🇮🇹 Italy
City	Milan, Lombardy

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 172.213.2.180

Whois 172.213.2.180

IP Abuse Reports for 172.213.2.180:

This IP address has been reported a total of 239 times from 196 distinct sources. 172.213.2.180 was first reported on July 31st 2026, and the most recent report was 1 minute ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇺🇸 ambor	2026-08-01 05:30:15 (1 minute ago)	Honeypot access: PHP file scan attempt: /goat1.php. Path: /goat1.php	Web App Attack
🇩🇪 london2038.com	2026-08-01 05:23:49 (8 minutes ago)	Probing for exploits 172.213.2.180 - - [01/Aug/2026:07:23:45 +0200] "GET /plugins/zvwbset/shell.php ... show more Probing for exploits 172.213.2.180 - - [01/Aug/2026:07:23:45 +0200] "GET /plugins/zvwbset/shell.php HTTP/1.1" 422 0 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 172.213.2.180 - - [01/Aug/2026:07:23:45 +0200] "GET /pluginsalfa.php HTTP/1.1" 422 0 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" show less	Hacking Web App Attack
🇺🇸 n2nguyenn2nguyen	2026-08-01 05:21:53 (10 minutes ago)	Blocked by YFC Security on https://1904.brixzly.com — type: rapid_scan_attempts	Web App Attack
🇿🇦 conure	2026-08-01 05:17:01 (14 minutes ago)	csagent: score 19.9: secrets grab x2; 2 domain(s) in 1s	Web App Attack
🇫🇮 Christopher Hughes	2026-08-01 05:15:41 (16 minutes ago)	[Sat Aug 01 06:15:40.862727 2026] [proxy_fcgi:error] [pid 2441717:tid 139826519062080] [client 172.2 ... show more [Sat Aug 01 06:15:40.862727 2026] [proxy_fcgi:error] [pid 2441717:tid 139826519062080] [client 172.213.2.180:37639] AH01071: Got error 'Primary script unknown' [Sat Aug 01 06:15:40.905572 2026] [proxy_fcgi:error] [pid 2441717:tid 139826527454784] [client 172.213.2.180:37639] AH01071: Got error 'Primary script unknown' [Sat Aug 01 06:15:40.950287 2026] [proxy_fcgi:error] [pid 2441717:tid 139825000736320] [client 172.213.2.180:37639] AH01071: Got error 'Primary script unknown' [Sat Aug 01 06:15:40.993341 2026] [proxy_fcgi:error] [pid 2441717:tid 139825881544256] [client 172.213.2.180:37639] AH01071: Got error 'Primary script unknown' [Sat Aug 01 06:15:41.036458 2026] [proxy_fcgi:error] [pid 2441717:tid 139825847973440] [client 172.213.2.180:37639] AH01071: Got error 'Primary script unknown' ... show less	Web App Attack
🇬🇧 openstrike.co.uk	2026-08-01 05:14:24 (17 minutes ago)	1376 attacks on PHP URLs: GET /credits.php HTTP/1.1	Web App Attack
🇧🇷 Peregrine	2026-08-01 05:07:24 (24 minutes ago)	Fail2Ban ct101 Jail: tomcat-404 \| Evidence: 172.213.2.180 172.69.9.117 - - [01/Aug/2026:02:07:20 -03 ... show more Fail2Ban ct101 Jail: tomcat-404 \| Evidence: 172.213.2.180 172.69.9.117 - - [01/Aug/2026:02:07:20 -0300] "GET /10.php HTTP/1.1" 404 18193 172.213.2.180 172.69.9.118 - - [01/Aug/2026:02:07:20 -0300] "GET /13.php HTTP/1.1" 404 18193 172.213.2.180 172.69.9.117 - - [01/Aug/2026:02:07:21 -0300] "GET /100.php HTTP/1.1" 404 18193 172.213.2.180 172.69.9.117 - - [01/Aug/2026:02:07:21 -0300] "GET /222.php HTTP/1.1" 404 18193 172.213.2.180 172.69.9.117 - - [01/Aug/2026:02:07:21 -0300] "GET /adminfuns.php HTTP/1.1" 404 18193 show less	Bad Web Bot Web App Attack
🇫🇷 Baking333	2026-08-01 04:58:19 (33 minutes ago)	[redacted] 172.213.2.180 - - [01/Aug/2026:05:58:17 +0100] "GET /.[redacted] HTTP/1.1" 307 418 "-" "M ... show more [redacted] 172.213.2.180 - - [01/Aug/2026:05:58:17 +0100] "GET /.[redacted] HTTP/1.1" 307 418 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" [redacted] 172.213.2.180 - - [01/Aug/2026:05:58:17 +0100] "GET /.[redacted] HTTP/1.1" 307 418 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" show less	Bad Web Bot Web App Attack
🇱🇻 garmtech.com	2026-08-01 04:53:21 (38 minutes ago)	Attempted access to sensitive endpoint (/xmlrpc.php) detected. Automated scan or unauthorized probin ... show more Attempted access to sensitive endpoint (/xmlrpc.php) detected. Automated scan or unauthorized probing. show less	Web App Attack
🇧🇬 HighWay	2026-08-01 04:49:22 (42 minutes ago)	172.213.2.180 - - [01/Aug/2026:04:49:19 +0000] "GET /c0derz_shell.php HTTP/1.1" 404 4757 "-" "Mozill ... show more 172.213.2.180 - - [01/Aug/2026:04:49:19 +0000] "GET /c0derz_shell.php HTTP/1.1" 404 4757 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 172.213.2.180 - - [01/Aug/2026:04:49:19 +0000] "GET /c451f.php HTTP/1.1" 404 4758 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 172.213.2.180 - - [01/Aug/2026:04:49:19 +0000] "GET /c99.php HTTP/1.1" 404 770 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 172.213.2.180 - - [01/Aug/2026:04:49:19 +0000] "GET /c999shell.php HTTP/1.1" 404 770 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 172.213.2.180 - - [01/Aug/2026:04:49:19 +0000] "GET /cache-compat.php HTTP/1.1" 404 770 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Sa ... show less	Port Scan Bad Web Bot
🇫🇷 UnixPrime	2026-08-01 04:42:05 (49 minutes ago)	172.213.2.180 - - [01/Aug/2026:06:42:04 +0200] "GET /.env.php HTTP/1.1" 404 181 "-" "Mozilla/5.0 (Wi ... show more 172.213.2.180 - - [01/Aug/2026:06:42:04 +0200] "GET /.env.php HTTP/1.1" 404 181 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 172.213.2.180 - - [01/Aug/2026:06:42:04 +0200] "GET /.env.sample.php HTTP/1.1" 404 181 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" ... show less	Bad Web Bot Web App Attack
🇬🇧 SilverZippo	2026-08-01 04:23:57 (1 hour ago)	Web App Attack	Web App Attack
🇩🇪 ramazan	2026-08-01 04:23:55 (1 hour ago)	Fail2Ban: nginx-4xx \| Failures: 10 \| Log: /V3.php /V5.php /WP-DIRCHECKEKdj.php /WSOEnigma.php /WebSh ... show more Fail2Ban: nginx-4xx \| Failures: 10 \| Log: /V3.php /V5.php /WP-DIRCHECKEKdj.php /WSOEnigma.php /WebShell.php show less	Web App Attack Hacking
🇲🇽 octageeks.com	2026-08-01 04:19:50 (1 hour ago)	Wordpress malicious attack:[octablocked]	Web App Attack
🇩🇪 Skyrider	2026-08-01 04:18:25 (1 hour ago)	crowdsecurity/http-backdoors-attempts	Web App Attack

Showing 1 to 15 of 239 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇭🇺 195.199.210.194

🇬🇧 193.163.125.16

🇲🇽 187.188.53.225

🇨🇳 183.224.237.233

🇩🇪 167.94.145.25

🇭🇰 156.225.1.99

🇫🇷 51.159.149.103

🇳🇱 45.148.10.141

🇺🇸 18.119.209.50

🇺🇸 2620:171:d6:f002:9999::49

🇨🇳 218.245.11.130

🇺🇸 205.210.31.81

🇧🇦 195.222.57.190

🇦🇴 193.163.125.58

🇻🇪 190.6.32.107

🇩🇪 152.53.148.66

🇫🇮 147.185.133.36

🇮🇷 109.74.228.67

🇷🇺 91.79.241.22

🇹🇭 49.228.107.184