JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 172.215.209.66

172.215.209.66 was found in our database!

This IP was reported 35 times. Confidence of Abuse is 66%: ?

66%

ISP	Microsoft Limited
Usage Type	Data Center/Web Hosting/Transit
ASN	AS8075
Domain Name	microsoft.com
Country	🇺🇸 United States of America
City	Cheyenne, Wyoming

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 172.215.209.66

Whois 172.215.209.66

IP Abuse Reports for 172.215.209.66:

This IP address has been reported a total of 35 times from 27 distinct sources. 172.215.209.66 was first reported on September 14th 2025, and the most recent report was 2 weeks ago.

Old Reports: The most recent abuse report for this IP address is from 2 weeks ago . It is possible that this IP is no longer involved in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
Anonymous	2026-06-16 08:43:29 (2 weeks ago)	Honeypot hit: Empty payload (likely service probe); 2087 [2], 2086 [1], 2082 [1], 2083 [1] TCP Repor ... show more Honeypot hit: Empty payload (likely service probe); 2087 [2], 2086 [1], 2082 [1], 2083 [1] TCP Reported by: https://github.com/sefinek/T-Pot-To-AbuseIPDB show less	Port Scan
🇦🇹 urnilxfgbez	2026-06-14 22:45:00 (2 weeks ago)	Last 24 Hours suspicious: (DPT=445\|DPT=3389\|DPT=22\|DPT=3306\|DPT=8080\|DPT=23\|DPT=5900\|DPT=1433)	Port Scan
🇮🇳 Mr.Singh	2026-06-14 03:30:13 (2 weeks ago)	NFT blocked 172.215.209.66 after 3 rejections on 14-Jun-2026.	Port Scan Brute-Force
🇺🇸 MPL	2026-06-14 02:05:42 (2 weeks ago)	tcp port scan (5 or more attempts)	Port Scan
🇷🇸 Scan	2026-06-14 00:44:53 (2 weeks ago)	MultiHost/MultiPort Probe, Scan, Hack -	Port Scan Hacking
🇦🇹 urnilxfgbez	2026-06-10 22:45:00 (3 weeks ago)	Last 24 Hours suspicious: (DPT=445\|DPT=3389\|DPT=22\|DPT=3306\|DPT=8080\|DPT=23\|DPT=5900\|DPT=1433)	Port Scan
🇺🇸 TPI-Abuse	2026-06-10 12:35:37 (3 weeks ago)	(mod_security) mod_security (id:210492) triggered by 172.215.209.66 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210492) triggered by 172.215.209.66 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jun 10 08:35:31.925609 2026] [security2:error] [pid 6825:tid 6825] [client 172.215.209.66:12127] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "192.64.151.27"] [uri "/.git/HEAD"] [unique_id "ailaE79LXvCZf__sL7LlcgAAABo"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 wteiken	2026-06-10 09:19:41 (3 weeks ago)	2026-06-10T05:19:35.611245-04:00 nostromo.teiken.net kernel: [35623.620460] syn_limit:IN=en-wan OUT= ... show more 2026-06-10T05:19:35.611245-04:00 nostromo.teiken.net kernel: [35623.620460] syn_limit:IN=en-wan OUT= MAC=00:50:43:37:c2:00:88:a2:5e:1c:98:0c:08:00 SRC=172.215.209.66 DST=173.52.106.128 LEN=60 TOS=0x00 PREC=0x00 TTL=53 ID=34073 DF PROTO=TCP SPT=11601 DPT=80 WINDOW=64240 RES=0x00 SYN URGP=0 2026-06-10T05:19:36.551244-04:00 nostromo.teiken.net kernel: [35624.558897] syn_limit:IN=en-wan OUT= MAC=00:50:43:37:c2:00:88:a2:5e:1c:98:0c:08:00 SRC=172.215.209.66 DST=173.52.106.128 LEN=60 TOS=0x00 PREC=0x00 TTL=53 ID=30124 DF PROTO=TCP SPT=11619 DPT=80 WINDOW=64240 RES=0x00 SYN URGP=0 2026-06-10T05:19:37.407785-04:00 nostromo.teiken.net kernel: [35625.420240] syn_limit:IN=en-wan OUT= MAC=00:50:43:37:c2:00:88:a2:5e:1c:98:0c:08:00 SRC=172.215.209.66 DST=173.52.106.128 LEN=60 TOS=0x00 PREC=0x00 TTL=53 ID=55492 DF PROTO=TCP SPT=11623 DPT=80 WINDOW=64240 RES=0x00 SYN URGP=0 2026-06-10T05:19:38.310144-04:00 nostromo.teiken.net kernel: [35626.322592] syn_limit:IN=en-wan OUT= MAC=00:50:43:37:c2:00:88:a ... show less	Port Scan
Anonymous	2026-06-10 08:33:35 (3 weeks ago)	PSCSERV WPSCAN 172.215.209.66	Bad Web Bot Web App Attack
🇺🇸 ISPLtd	2026-06-10 08:11:33 (3 weeks ago)	Jun 10 02:11:32 172.215.209.66 TCP SPT=12240 DPT=2087 SYN Jun 10 02:11:32 172.215.209.66 TCP SPT=122 ... show more Jun 10 02:11:32 172.215.209.66 TCP SPT=12240 DPT=2087 SYN Jun 10 02:11:32 172.215.209.66 TCP SPT=12225 DPT=2086 SYN Jun 10 02:11:32 172.215.209.66 TCP SPT=12229 DPT=2083 WIND ... show less	Port Scan
🇧🇷 Peregrine	2026-06-10 08:04:51 (3 weeks ago)	Fail2Ban S3 Jail: tomcat-404 \| Evidence: - 172.215.209.66 - - [10/Jun/2026:05:04:44 -0300] "GET /wp- ... show more Fail2Ban S3 Jail: tomcat-404 \| Evidence: - 172.215.209.66 - - [10/Jun/2026:05:04:44 -0300] "GET /wp-config.php HTTP/1.1" 404 414 - 172.215.209.66 - - [10/Jun/2026:05:04:44 -0300] "GET /wp-config.php.bak HTTP/1.1" 404 414 - 172.215.209.66 - - [10/Jun/2026:05:04:45 -0300] "GET /config/database.yml HTTP/1.1" 404 414 - 172.215.209.66 - - [10/Jun/2026:05:04:45 -0300] "GET /phpinfo.php HTTP/1.1" 404 414 - 172.215.209.66 - - [10/Jun/2026:05:04:46 -0300] "GET /server-status HTTP/1.1" 404 414 - 172.215.209.66 - - [10/Jun/2026:05:04:46 -0300] "GET /actuator/env HTTP/1.1" 404 414 - 172.215.209.66 - - [10/Jun/2026:05:04:46 -0300] "GET /.DS_Store HTTP/1.1" 404 414 - 172.215.209.66 - - [10/Jun/2026:05:04:47 -0300] "GET /.htpasswd HTTP/1.1" 404 414 - 172.215.209.66 - - [10/Jun/2026:05:04:48 -0300] "GET /dump.sql HTTP/1.1" 404 414 show less	Bad Web Bot Web App Attack
🇺🇸 gu-alvareza	2026-06-10 07:06:07 (3 weeks ago)	Spring.Boot.Actuator.Unauthorized.Access	Brute-Force
🇹🇷 Threat.live	2026-06-03 04:35:05 (1 month ago)	Suspicious Connection Attempts	Brute-Force
🇺🇸 MPL	2026-06-03 04:30:31 (1 month ago)	tcp port scan (8 or more attempts)	Port Scan
🇺🇸 TPI-Abuse	2026-06-03 04:12:45 (1 month ago)	(mod_security) mod_security (id:210492) triggered by 172.215.209.66 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210492) triggered by 172.215.209.66 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jun 03 00:12:38.011070 2026] [security2:error] [pid 20247:tid 20247] [client 172.215.209.66:1298] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "192.64.150.145"] [uri "/.git/config"] [unique_id "ah-ptlM2aBKiO_BeBdvaOgAAAAk"] show less	Brute-Force Bad Web Bot Web App Attack

Showing 1 to 15 of 35 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇮🇳 185.100.212.141

🇵🇹 109.50.185.153

🇺🇦 91.234.26.132

🇩🇪 87.120.84.174

🇬🇧 35.203.211.225

🇺🇸 34.235.241.27

🇫🇮 147.185.133.255

🇺🇸 147.124.214.12

🇺🇸 144.225.187.161

🇻🇳 120.72.98.5

🇳🇱 109.236.86.20

🇮🇳 106.77.142.69

🇻🇳 103.75.182.108

🇷🇴 80.94.92.156

🇳🇱 77.91.71.25

🇩🇪 64.226.108.55

🇺🇸 20.65.194.38

🇺🇸 192.155.88.76

🇦🇷 152.169.164.2

🇫🇮 147.185.133.18