AbuseIPDB » 104.152.52.133

104.152.52.133 was found in our database!

This IP was reported 1,448 times. Confidence of Abuse is 96%: ?

96%

ISP	Rethem Hosting LLC
Usage Type	Data Center/Web Hosting/Transit
ASN	AS14987
Hostname(s)	internettl.org
Domain Name	rethemhosting.net
Country	United States of America
City	Chicago, Illinois

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated biweekly.

Report 104.152.52.133

Whois 104.152.52.133

IP Abuse Reports for 104.152.52.133:

This IP address has been reported a total of 1,448 times from 399 distinct sources. 104.152.52.133 was first reported on October 7th 2021, and the most recent report was 2 days ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp in UTC	Comment	Categories
ThreatBook.io	2025-03-24 23:19:21 (2 days ago)	ThreatBook Intelligence: Zombie,Dynamic IP more details on https://threatbook.io/ip/104.152.52.133	SSH
rtbh.com.tr	2025-03-19 16:48:47 (1 week ago)	list.rtbh.com.tr report: tcp/1433, udp/1433, udp/445	Brute-Force
Study Bitcoin 🤗	2025-03-19 15:01:04 (1 week ago)	SSH Fail2Ban [srv67]	Brute-Force
Study Bitcoin 🤗	2025-03-19 15:01:02 (1 week ago)	249 port probes: tcp/1270 (microsoft operations manager mom-encrypted), tcp/387 (appletalk update-ba ... show more249 port probes: tcp/1270 (microsoft operations manager mom-encrypted), tcp/387 (appletalk update-based routing pro.), tcp/2083, tcp/7990, tcp/2181 (eforward), tcp/8118, tcp/5001 (filmaker.com), tcp/10505, tcp/1720 (h323hostcall), tcp/170 (network postscript), tcp/9092, tcp/16482, tcp/2223 (rockwell csp3), tcp/8337, tcp/2221 (rockwell csp1), tcp/25 (smtp), tcp/8083, tcp/17500, tcp/666 (doom id software), tcp/5678 (linksys etherfast router remote administration), tcp/3306 (mysql), tcp/8091, tcp/9090 (websm), tcp/194 (internet relay chat), tcp/9418, tcp/5223, tcp/5985, tcp/1024 (reserved), tcp/829 (pkix-3 ca), tcp/7547, tcp/2049 (network file system - sun microsystems), tcp/2375, tcp/1293, tcp/88 (kerberos), tcp/7307, tcp/9060, tcp/9043, tcp/264 (bgmp), tcp/2427 (media gateway controlgateway), tcp/6679, tcp/585 (imap4+ssl), tcp/156 (sql service), tcp/8086, tcp/8005, tcp/218 (netix message posting), tcp/164 [ros] show less	DNS Compromise DDoS Attack Email Spam Port Scan Hacking SQL Injection Brute-Force Bad Web Bot Web App Attack SSH
DSSMART	2025-03-19 10:17:40 (1 week ago)	Automatic report from DSSM firewall log.	Port Scan Hacking Brute-Force
PulseServers	2025-03-19 06:48:42 (1 week ago)	FTP Brute-Force Attack on a server hosted by PulseServers.com - CA10 Honeypot ...	FTP Brute-Force Brute-Force
Honzas	2025-03-19 04:40:51 (1 week ago)	Unsolicited connection attemp, port 3389/TCP	Brute-Force
webbfabriken	2025-03-17 09:48:30 (1 week ago)	spam or other hacking activities reported by webbfabriken security servers Attack reported by ... show morespam or other hacking activities reported by webbfabriken security servers Attack reported by Webbfabriken Security API - WFSecAPI show less	Web Spam
Study Bitcoin 🤗	2025-03-17 08:07:02 (1 week ago)	85 port probes: tcp/7306, tcp/5900 (vnc virtual network computing), tcp/525 (timeserver), tcp/5243, ... show more85 port probes: tcp/7306, tcp/5900 (vnc virtual network computing), tcp/525 (timeserver), tcp/5243, tcp/9002, 2x tcp/3306 (mysql), tcp/2049 (network file system - sun microsystems), tcp/5349, tcp/3269 (microsoft global catalog with ldap), tcp/514 (remote shell), 2x tcp/25 (smtp), tcp/5601 (enterprise security agent), tcp/1512 (microsoft's windows internet name service), tcp/8089, 2x tcp/5985, 2x tcp/8172, 2x tcp/8010 (wingate http proxy), tcp/2087, tcp/143 (internet message access), tcp/4243, tcp/2375, tcp/9000 (cslistener), tcp/8243, 2x tcp/22136, tcp/10024, 2x tcp/1433 (microsoft-sql-server), tcp/3535 (ms-la), 2x tcp/444 (simple network paging), tcp/443 (https), tcp/1434 (microsoft-sql-monitor), tcp/9060, 2x tcp/8088, tcp/5001 (filmaker.com), tcp/27017, tcp/22225, tcp/5500 (fcp-addr-srvr1), tcp/2376, tcp/5223, tcp/1701 (l2tp), tcp/666 (doom id software), tcp/623 (aux bus shunt), tcp/10505, tcp/5800 (v [srv135,srv136] show less	DDoS Attack Email Spam Port Scan SQL Injection Brute-Force Bad Web Bot Web App Attack
Sawasdee	2025-03-16 21:02:20 (1 week ago)	Port Scan ...	Port Scan
c y	2025-03-15 16:47:23 (1 week ago)	...	Web App Attack
rtbh.com.tr	2025-03-13 20:48:58 (1 week ago)	list.rtbh.com.tr report: tcp/0	Brute-Force
rtbh.com.tr	2025-03-12 20:49:01 (2 weeks ago)	list.rtbh.com.tr report: tcp/0	Brute-Force
Kinsei Engineering Inc.	2025-03-12 11:01:56 (2 weeks ago)	UFW:High-frequency access to unused ports	Port Scan
urnilxfgbez	2025-03-11 23:45:00 (2 weeks ago)	Last 24 Hours suspicious: (DPT=445\|DPT=3389\|DPT=22\|DPT=3306\|DPT=8080\|DPT=23\|DPT=5900\|DPT=1433)	Port Scan