JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 117.33.238.52

117.33.238.52 was found in our database!

This IP was reported 54 times. Confidence of Abuse is 100%: ?

100%

ISP	CHINANET Shanxi(SN) province network
Usage Type	Data Center/Web Hosting/Transit
ASN	AS134768
Domain Name	xa.sn.cn
Country	🇨🇳 China
City	Xi'an, Shaanxi

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 117.33.238.52

Whois 117.33.238.52

IP Abuse Reports for 117.33.238.52:

This IP address has been reported a total of 54 times from 27 distinct sources. 117.33.238.52 was first reported on June 25th 2026, and the most recent report was 7 hours ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇺🇸 TPI-Abuse	2026-07-17 17:06:45 (7 hours ago)	(mod_security) mod_security (id:210492) triggered by 117.33.238.52 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:210492) triggered by 117.33.238.52 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jul 17 13:06:35.920799 2026] [security2:error] [pid 25009:tid 25009] [client 117.33.238.52:52208] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "inmosantanora.com"] [uri "/.env.backup"] [unique_id "alphG6KpF-AC7XtxPDbFhQAAAAk"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 wteiken	2026-07-17 16:09:32 (8 hours ago)	mta-sts.teiken.org:443 117.33.238.52:36605 - - [17/Jul/2026:12:09:27 -0400] "GET /.env.old HTTP/1.1" ... show more mta-sts.teiken.org:443 117.33.238.52:36605 - - [17/Jul/2026:12:09:27 -0400] "GET /.env.old HTTP/1.1" 404 3451 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36 (Silvy X Ran; +https://silvyxran.love; +https://silver.inc)" mta-sts.teiken.org:443 117.33.238.52:36605 - - [17/Jul/2026:12:09:28 -0400] "GET /.env.bak HTTP/1.1" 404 575 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36 (Silvy X Ran; +https://silvyxran.love; +https://silver.inc)" mta-sts.teiken.org:443 117.33.238.52:36605 - - [17/Jul/2026:12:09:29 -0400] "GET /.env.tmp HTTP/1.1" 404 575 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36 (Silvy X Ran; +https://silvyxran.love; +https://silver.inc)" mta-sts.teiken.org:443 117.33.238.52:36605 - - [17/Jul/2026:12:09:29 -0400] "GET /.env.swp HTTP/1.1" 404 575 "-" "Mozilla/5.0 (Windows NT ... show less	Web App Attack
🇩🇪 LRob	2026-07-17 13:49:53 (10 hours ago)	CrowdSec: crowdsecurity/http-sensitive-files \| req: /.envrc \| 5 distinct paths \| UA: Mozilla/5.0 (Wi ... show more CrowdSec: crowdsecurity/http-sensitive-files \| req: /.envrc \| 5 distinct paths \| UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36 (Silvy X Ran; +https://silvyxran.love; show less	Hacking
🇩🇪 webanyone	2026-07-17 13:45:50 (10 hours ago)	WAF repeated trigger detected by Fail2Ban in plesk-modsecurity jail	Web App Attack
🇫🇷 largo-it.net	2026-07-17 10:22:58 (13 hours ago)	Jul 17 12:22:52 vps-9f3cdc33 haproxy[1195832]: 117.33.238.52:39678 [17/Jul/2026:12:22:52.136] www_fr ... show more Jul 17 12:22:52 vps-9f3cdc33 haproxy[1195832]: 117.33.238.52:39678 [17/Jul/2026:12:22:52.136] www_frontend~ finance_cluster/finance1_test1_https 0/0/11/363/374 404 3252 - - ---- 65/18/0/0/0 0/0 "GET /docker-compose.yml HTTP/1.1" Jul 17 12:22:53 vps-9f3cdc33 haproxy[1195832]: 117.33.238.52:39678 [17/Jul/2026:12:22:52.916] www_frontend~ finance_cluster/finance1_test1_https 0/0/10/322/332 404 3252 - - ---- 64/18/0/0/0 0/0 "GET /docker-compose.yaml HTTP/1.1" Jul 17 12:22:54 vps-9f3cdc33 haproxy[1195832]: 117.33.238.52:39678 [17/Jul/2026:12:22:53.655] www_frontend~ finance_cluster/finance1_test1_https 0/0/11/343/354 404 3252 - - ---- 65/19/0/0/0 0/0 "GET /docker-compose.override.yml HTTP/1.1" Jul 17 12:22:55 vps-9f3cdc33 haproxy[1195832]: 117.33.238.52:39678 [17/Jul/2026:12:22:54.414] www_frontend~ finance_cluster/finance1_test1_https 0/0/11/713/724 404 3252 - - ---- 66/20/0/0/0 0/0 "GET /docker-compose.dev.yml HTTP/1.1" Jul 17 12:22:55 vps-9f3cdc33 haproxy[1195832]: 117.33.238.52:50585 [17 ... show less	Hacking Bad Web Bot Web App Attack
🇵🇱 lns.bz	2026-07-17 09:12:51 (14 hours ago)	Web app attack [PL.Lu]	Exploited Host Web App Attack
🇺🇸 TPI-Abuse	2026-07-17 08:34:32 (15 hours ago)	(mod_security) mod_security (id:210492) triggered by 117.33.238.52 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:210492) triggered by 117.33.238.52 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jul 17 04:34:26.777029 2026] [security2:error] [pid 29572:tid 29572] [client 117.33.238.52:35521] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "hcadwin.com"] [uri "/.env.development"] [unique_id "alnpEkVboTKkDLWlWcLiQwAAAAg"] show less	Brute-Force Bad Web Bot Web App Attack
Anonymous	2026-07-17 05:34:49 (18 hours ago)	Aggressive web scan	Web App Attack
🇺🇸 TPI-Abuse	2026-07-17 05:11:02 (18 hours ago)	(mod_security) mod_security (id:210492) triggered by 117.33.238.52 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:210492) triggered by 117.33.238.52 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jul 17 01:10:52.714773 2026] [security2:error] [pid 12381:tid 12381] [client 117.33.238.52:55980] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.scottwithers.scottwithers.xyz"] [uri "/.env.tmp"] [unique_id "alm5XISPVTXzJ7OXrweqfQAAAAE"] show less	Brute-Force Bad Web Bot Web App Attack
🇭🇳 unph	2026-07-17 05:08:22 (19 hours ago)	Intento de acceso sospechoso bloqueado por AbuseIPDB Blocker Plugin	Brute-Force
Anonymous	2026-07-17 04:17:25 (19 hours ago)	(caddyscan) Scanner path probe from 117.33.238.52 (CN/China/-): 5 in the last 3600 secs; Ports: ; D ... show more (caddyscan) Scanner path probe from 117.33.238.52 (CN/China/-): 5 in the last 3600 secs; Ports: ; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: [REDACTED] 200 2627 117.33.238.52 - - [17/Jul/2026:04:17:18 +0000] "GET /.env HTTP/1.1" [REDACTED] 200 2627 117.33.238.52 - - [17/Jul/2026:04:17:19 +0000] "GET /.env.local HTTP/1.1" [REDACTED] 200 2627 117.33.238.52 - - [17/Jul/2026:04:17:19 +0000] "GET /.env.production HTTP/1.1" [REDACTED] 200 2627 117.33.238.52 - - [17/Jul/2026:04:17:20 +0000] "GET /.env.development HTTP/1.1" [REDACTED] 200 2627 117.33.238.52 - - [17/Jul/2026:04:17:20 +0000] "GET /.env.dev HTTP/1.1" show less	Port Scan
🇦🇺 screwlooseit.com.au	2026-07-17 04:07:00 (20 hours ago)	Blocked by CSF 13 firewall - Rule: config-dotfile CN/China/-	Web App Attack
🇺🇸 TPI-Abuse	2026-07-17 03:08:45 (21 hours ago)	(mod_security) mod_security (id:210492) triggered by 117.33.238.52 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:210492) triggered by 117.33.238.52 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jul 16 23:08:38.443389 2026] [security2:error] [pid 15706:tid 15706] [client 117.33.238.52:55788] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.mitchell238.macryder.com"] [uri "/src/.env"] [unique_id "almctsm7dNMsd0XHjWDHegAAABE"] show less	Brute-Force Bad Web Bot Web App Attack
🇧🇾 lns.bz	2026-07-17 03:07:03 (21 hours ago)	Too many 404 requests [BY]	Web App Attack
🇺🇸 TPI-Abuse	2026-07-17 02:48:20 (21 hours ago)	(mod_security) mod_security (id:210492) triggered by 117.33.238.52 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:210492) triggered by 117.33.238.52 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jul 16 22:48:12.311236 2026] [security2:error] [pid 164824:tid 164824] [client 117.33.238.52:36149] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "mahoninginn.com"] [uri "/storage/framework/.env"] [unique_id "almX7GDUvefmE_l8Sc_3CAAAAAQ"] show less	Brute-Force Bad Web Bot Web App Attack

Showing 1 to 15 of 54 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇺🇸 162.216.150.223

🇦🇫 149.54.51.74

🇭🇰 103.210.21.242

🇧🇬 79.124.62.126

🇻🇪 38.172.172.125

🇻🇪 38.171.63.78

🇩🇪 2a09:bac5:27bb:2464::3a0:39

🇦🇫 149.54.51.42

🇷🇺 95.108.213.149

🇺🇸 91.230.168.138

🇺🇦 91.207.245.181

🇳🇱 45.148.10.151

🇺🇸 45.56.83.149

🇯🇵 43.130.249.176

🇻🇪 38.166.41.0

🇦🇷 38.159.160.185

🇬🇧 35.203.210.123

🇺🇸 20.65.195.108

🇮🇳 206.1.21.1

🇧🇷 205.210.31.186