JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 172.215.231.118

172.215.231.118 was found in our database!

This IP was reported 25 times. Confidence of Abuse is 49%: ?

49%

ISP	Microsoft Limited
Usage Type	Data Center/Web Hosting/Transit
ASN	AS8075
Domain Name	microsoft.com
Country	🇺🇸 United States of America
City	Cheyenne, Wyoming

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 172.215.231.118

Whois 172.215.231.118

IP Abuse Reports for 172.215.231.118:

This IP address has been reported a total of 25 times from 19 distinct sources. 172.215.231.118 was first reported on October 8th 2025, and the most recent report was 5 days ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇺🇸 micropedro	2026-07-01 03:30:40 (5 days ago)	8 incidents: malicious activity. Ports: 2082/TCP(1), 2083/TCP(1), 2087/TCP(1), 8080/TCP(1), 8443/TCP ... show more 8 incidents: malicious activity. Ports: 2082/TCP(1), 2083/TCP(1), 2087/TCP(1), 8080/TCP(1), 8443/TCP(1). First: 2026-06-09 20:30, Last: 2026-06-30 23:30 UTC. Triggers: ufw-repeater. show less	Port Scan
🇺🇸 micropedro	2026-07-01 03:30:20 (5 days ago)	4 incidents: malicious activity. First: 2026-06-09 20:30, Last: 2026-06-30 23:30 UTC. Triggers: ufw- ... show more 4 incidents: malicious activity. First: 2026-06-09 20:30, Last: 2026-06-30 23:30 UTC. Triggers: ufw-repeater. show less	Port Scan
🇩🇪 igerman	2026-06-15 11:28:29 (3 weeks ago)	caddy probes: cloud-creds: GET /.aws/credentials(DROP) \| env-probe: GET /.env(DROP), GET /.env.backu ... show more caddy probes: cloud-creds: GET /.aws/credentials(DROP) \| env-probe: GET /.env(DROP), GET /.env.backup(DROP), GET /.env.bak(DROP), GET /.env.development(DROP), GET /.env.docker(DROP), GET /.env.local(DROP), GET /.env.old(DROP), GET /.env.prod(DROP), GET /.env.production(DROP), GET /.env.production.local(DROP), GET /.env.save(DROP), GET /.env.staging(DROP) \| git-repo: GET /.git/HEAD(DROP), GET /.git/config(DROP) \| web: GET /.DS_Store(DROP), GET /.htpasswd(DROP), GET /actuator/env(DROP), GET /backup.sql(DROP), GET /config.php(DROP), GET /config/database.yml(DROP), GET /dump.sql(DROP), GET /phpinfo.php(DROP) \| wordpress: GET /wp-config.php(DROP), GET /wp-config.php.bak(DROP) show less	Web App Attack
🇺🇸 TPI-Abuse	2026-06-15 09:55:33 (3 weeks ago)	(mod_security) mod_security (id:210492) triggered by 172.215.231.118 (-): 1 in the last 300 secs; Po ... show more (mod_security) mod_security (id:210492) triggered by 172.215.231.118 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jun 15 05:55:29.208995 2026] [security2:error] [pid 16159:tid 16159] [client 172.215.231.118:36927] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "192.64.150.31"] [uri "/.git/HEAD"] [unique_id "ai_MEXScqKPEkSba9wJU5wAAAB4"] show less	Brute-Force Bad Web Bot Web App Attack
🇹🇷 Threat.live	2026-06-15 08:55:02 (3 weeks ago)	Suspicious Connection Attempts	Brute-Force
🇦🇹 urnilxfgbez	2026-06-03 22:45:00 (1 month ago)	Last 24 Hours suspicious: (DPT=445\|DPT=3389\|DPT=22\|DPT=3306\|DPT=8080\|DPT=23\|DPT=5900\|DPT=1433)	Port Scan
Anonymous	2026-06-03 08:00:00 (1 month ago)	SSH Brute-Force	DDoS Attack Port Scan Hacking Brute-Force SSH
🇪🇸 alferez	2026-06-03 03:43:54 (1 month ago)	Searching .(env\|sql\|zip\|tar\|rar) files	Hacking Exploited Host Web App Attack
🇺🇸 TPI-Abuse	2026-06-03 03:33:33 (1 month ago)	(mod_security) mod_security (id:210492) triggered by 172.215.231.118 (-): 1 in the last 300 secs; Po ... show more (mod_security) mod_security (id:210492) triggered by 172.215.231.118 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jun 02 23:33:28.908829 2026] [security2:error] [pid 19902:tid 19902] [client 172.215.231.118:28057] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "192.64.151.37"] [uri "/.env.production"] [unique_id "ah-giHNO1wkmIFSI1xJZlAAAAAQ"] show less	Brute-Force Bad Web Bot Web App Attack
🇦🇺 LiftUp Hosting	2026-06-03 02:42:58 (1 month ago)	Honeypot hit: Empty payload (likely service probe); 2086 [1], 2082 [1] TCP	Port Scan
🇺🇸 MPL	2026-06-03 02:37:31 (1 month ago)	tcp port scan (3 or more attempts)	Port Scan
🇬🇧 PeravixGroup	2026-06-03 01:48:49 (1 month ago)	Honeypot detection: Web application scanning / reconnaissance attempt on port 8080. Severity: LOW. A ... show more Honeypot detection: Web application scanning / reconnaissance attempt on port 8080. Severity: LOW. Aaran.cloud show less	Port Scan Bad Web Bot
🇹🇭 Sawasdee	2026-06-03 01:48:10 (1 month ago)	Unwanted checking 80 or 443 port ...	Bad Web Bot
🇳🇱 COMPLEX	2026-06-03 00:47:23 (1 month ago)	Unsolicited TCP traffic \| Action: DROP \| Port 80	Port Scan
Anonymous	2026-06-03 00:36:00 (1 month ago)		DDoS Attack Brute-Force SSH Hacking

Showing 1 to 15 of 25 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇫🇷 185.177.72.53

🇮🇳 168.220.234.138

🇧🇬 91.191.209.98

🇮🇳 59.98.148.5

🇮🇩 202.51.214.99

🇻🇪 201.208.187.163

🇺🇸 172.253.0.30

🇧🇷 168.194.225.76

🇧🇷 168.181.216.3

🇭🇰 154.221.20.92

🇳🇱 93.177.116.84

🇩🇪 85.137.253.1

🇨🇳 61.145.190.218

🇲🇾 49.125.203.167

🇳🇱 45.148.10.152

🇺🇸 2604:a880:2:d1:0:1:51e7:6001

🇲🇿 197.219.208.38

🇦🇷 190.220.172.154

🇻🇳 171.231.181.27

🇧🇷 167.250.66.136