JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 15.252.96.173

15.252.96.173

Recent Activity

33 reports found in our database

100% ▲ ▲ ▲ Critical

Abuse confidence score ?

ISP

Amazon.com, Inc.

Usage Type

Data Center/Web Hosting/Transit

ASN

AS16509

Hostname(s)

ec2-15-252-96-173.ap-south-1.compute.amazonaws.com

Domain Name

amazon.com

Country

🇮🇳 India

City

Mumbai, Maharashtra

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report Whois

Top Reporter Countries (Last 60 Days)

Example preview

Report Categories (Last 60 Days)

Example preview

Reports Activity

Example preview

Account required for the enhanced features Log in Sign up

IP Abuse Reports for 15.252.96.173:

This IP address has been reported a total of 33 times from 31 distinct sources. 15.252.96.173 was first reported on September 5th 2026, and the most recent report was 3 hours ago. In the last 60 days, the top reporter locations were: Germany with 13 reports; United States of America with 6 reports; France with 4 reports. The most common categories in these recent reports were: Web App Attack 15 times; Bad Web Bot 9 times; Brute-Force 8 times; Port Scan 6 times; Hacking 5 times; Other 6 times.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇳🇴 Abuse Buster	2026-09-11 01:40:18 (3 hours ago)	15.252.96.173 - - [11/Sep/2026:03:40:16 +0200] "GET /.env HTTP/1.1" 301 162 "-" "Mozilla/5.0 (Macint ... show more 15.252.96.173 - - [11/Sep/2026:03:40:16 +0200] "GET /.env HTTP/1.1" 301 162 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:126.0) Gecko/20100101 Firefox/126.0" 15.252.96.173 - - [11/Sep/2026:03:40:17 +0200] "GET /.env HTTP/1.1" 404 22 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" ... show less	Web App Attack
🇧🇷 Peregrine	2026-09-10 03:09:20 (1 day ago)	Fail2Ban Jail: tomcat-honeypot \| Evidence: - 15.252.96.173 - - [06/Sep/2026:15:16:57 -0300] "GET /.e ... show more Fail2Ban Jail: tomcat-honeypot \| Evidence: - 15.252.96.173 - - [06/Sep/2026:15:16:57 -0300] "GET /.env HTTP/1.1" 404 414 - 15.252.96.173 - - [06/Sep/2026:15:16:58 -0300] "GET /.git/config HTTP/1.1" 404 414 - 15.252.96.173 - - [06/Sep/2026:15:16:59 -0300] "GET /.git/HEAD HTTP/1.1" 404 414 - 15.252.96.173 - - [06/Sep/2026:15:17:00 -0300] "GET /phpinfo.php HTTP/1.1" 404 414 - 15.252.96.173 - - [06/Sep/2026:15:17:01 -0300] "GET /backup.sql HTTP/1.1" 404 414 - 15.252.96.173 - - [06/Sep/2026:15:17:01 -0300] "GET /dump.sql HTTP/1.1" 404 414 - 15.252.96.173 - - [06/Sep/2026:15:17:02 -0300] "GET /.aws/credentials HTTP/1.1" 404 414 - 15.252.96.173 - - [06/Sep/2026:15:17:02 -0300] "GET /config.php.bak HTTP/1.1" 404 414 - 15.252.96.173 - - [06/Sep/2026:15:17:03 -0300] "GET /wp-config.php.bak HTTP/1.1" 404 414 - 15.252.96.173 - - [06/Sep/2026:15:17:04 -0300] "GET /backup.zip HTTP/1.1" 404 414 show less	Bad Web Bot
🇩🇪 konseptit	2026-09-09 22:06:29 (1 day ago)	(mod_security) mod_security triggered on hostname [redacted] 15.252.96.173 (IN/India/ec2-15-252-96-1 ... show more (mod_security) mod_security triggered on hostname [redacted] 15.252.96.173 (IN/India/ec2-15-252-96-173.ap-south-1.compute.amazonaws.com) show less	SQL Injection
🇫🇷 vincent_EUDIER	2026-09-09 13:20:00 (1 day ago)	GUEUDIER WEBAPP - HTTP 5xx Ban	Hacking
🇩🇪 Grossmann-Gruppe	2026-09-09 09:28:42 (1 day ago)	Plesk Fail2Ban: plesk-modsecurity	Hacking Brute-Force
Anonymous	2026-09-09 07:30:15 (1 day ago)	15.252.96.173 - - [09/Sep/2026:07:30:13 +0000] "GET /000000006aac436f-argus404probe HTTP/1.1" 404 16 ... show more 15.252.96.173 - - [09/Sep/2026:07:30:13 +0000] "GET /000000006aac436f-argus404probe HTTP/1.1" 404 162 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:126.0) Gecko/20100101 Firefox/126.0" 15.252.96.173 - - [09/Sep/2026:07:30:14 +0000] "GET /.env HTTP/1.1" 404 162 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:126.0) Gecko/20100101 Firefox/126.0" ... show less	Web App Attack
🇫🇮 mnazibo	2026-09-09 02:00:10 (2 days ago)	Date: Sep 09 04:49:36 2026 EAT \| Reported IP: 15.252.96.173 mod_security \| id: 920350 930130 949110 ... show more Date: Sep 09 04:49:36 2026 EAT \| Reported IP: 15.252.96.173 mod_security \| id: 920350 930130 949110 920440 920500 \| IN/usernameab.my_domain/- \| Connections: 1 \| Blocked: Permanent Block: [LF_MODSEC] \| Logs: ; Host header is a numeric IP address; Host header is a numeric IP address; Host header is a numeric IP address; Restricted File Access Attempt; Inbound Anomaly Score Exceeded (Total Score: 8); Host header is a numeric IP address; Restricted File Access Attempt; Inbound Anomaly Score Exceeded (Total Score: 8); Host header is a numeric IP address; Restricted File Access Attempt; Inbound Anomaly Score Exceeded (Total Score: 8); Host header is a numeric IP address; Restricted File Access Attempt; Inbound Anomaly Score Exceeded (Total Score: 8); Host header is a numeric IP address; Restricted File Access Attempt; Inbound Anomaly Score Exceeded (Total Score: 8); Host header is a numeric IP address; Host header is a numeric IP address; URL show less	SQL Injection Brute-Force Bad Web Bot
Anonymous	2026-09-08 21:54:12 (2 days ago)	Reported from Nginx log analysis 19. Log: 15.252.96.173 - - [08/Sep/2026:xx:xx:xx 0200] "GET / HTTP ... show more Reported from Nginx log analysis 19. Log: 15.252.96.173 - - [08/Sep/2026:xx:xx:xx 0200] "GET / HTTP/1.1" xxx xxx "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" "-" "IN India Mumbai" "AS16509" "Amazon.com, Inc." show less	Port Scan Brute-Force SSH
🇺🇸 hyena	2026-09-08 11:30:50 (2 days ago)	Repeated mod_security events.	Web App Attack
Anonymous	2026-09-08 06:38:36 (2 days ago)	HTTP_USER_AGENT Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:126.0) Gecko/20100101 Firefox/126.0	Port Scan
🇧🇷 Peregrine	2026-09-08 03:09:30 (3 days ago)	Fail2Ban Jail: tomcat-honeypot \| Evidence: - 15.252.96.173 - - [06/Sep/2026:15:16:57 -0300] "GET /.e ... show more Fail2Ban Jail: tomcat-honeypot \| Evidence: - 15.252.96.173 - - [06/Sep/2026:15:16:57 -0300] "GET /.env HTTP/1.1" 404 414 - 15.252.96.173 - - [06/Sep/2026:15:16:58 -0300] "GET /.git/config HTTP/1.1" 404 414 - 15.252.96.173 - - [06/Sep/2026:15:16:59 -0300] "GET /.git/HEAD HTTP/1.1" 404 414 - 15.252.96.173 - - [06/Sep/2026:15:17:00 -0300] "GET /phpinfo.php HTTP/1.1" 404 414 - 15.252.96.173 - - [06/Sep/2026:15:17:01 -0300] "GET /backup.sql HTTP/1.1" 404 414 - 15.252.96.173 - - [06/Sep/2026:15:17:01 -0300] "GET /dump.sql HTTP/1.1" 404 414 - 15.252.96.173 - - [06/Sep/2026:15:17:02 -0300] "GET /.aws/credentials HTTP/1.1" 404 414 - 15.252.96.173 - - [06/Sep/2026:15:17:02 -0300] "GET /config.php.bak HTTP/1.1" 404 414 - 15.252.96.173 - - [06/Sep/2026:15:17:03 -0300] "GET /wp-config.php.bak HTTP/1.1" 404 414 - 15.252.96.173 - - [06/Sep/2026:15:17:04 -0300] "GET /backup.zip HTTP/1.1" 404 414 show less	Bad Web Bot
🇩🇪 raph	2026-09-06 18:53:19 (4 days ago)	[DOT FILES] crawler .env, .git, .config, etc.	Bad Web Bot Web App Attack
🇧🇷 Peregrine	2026-09-06 18:17:07 (4 days ago)	Fail2Ban Jail: tomcat-honeypot \| Evidence: - 15.252.96.173 - - [06/Sep/2026:15:16:57 -0300] "GET /.e ... show more Fail2Ban Jail: tomcat-honeypot \| Evidence: - 15.252.96.173 - - [06/Sep/2026:15:16:57 -0300] "GET /.env HTTP/1.1" 404 414 - 15.252.96.173 - - [06/Sep/2026:15:16:58 -0300] "GET /.git/config HTTP/1.1" 404 414 - 15.252.96.173 - - [06/Sep/2026:15:16:59 -0300] "GET /.git/HEAD HTTP/1.1" 404 414 - 15.252.96.173 - - [06/Sep/2026:15:17:00 -0300] "GET /phpinfo.php HTTP/1.1" 404 414 - 15.252.96.173 - - [06/Sep/2026:15:17:01 -0300] "GET /backup.sql HTTP/1.1" 404 414 - 15.252.96.173 - - [06/Sep/2026:15:17:01 -0300] "GET /dump.sql HTTP/1.1" 404 414 - 15.252.96.173 - - [06/Sep/2026:15:17:02 -0300] "GET /.aws/credentials HTTP/1.1" 404 414 - 15.252.96.173 - - [06/Sep/2026:15:17:02 -0300] "GET /config.php.bak HTTP/1.1" 404 414 - 15.252.96.173 - - [06/Sep/2026:15:17:03 -0300] "GET /wp-config.php.bak HTTP/1.1" 404 414 - 15.252.96.173 - - [06/Sep/2026:15:17:04 -0300] "GET /backup.zip HTTP/1.1" 404 414 show less	Bad Web Bot
🇩🇪 hidemail.app	2026-09-06 16:55:22 (4 days ago)	Automated scan for exposed config/secret files and known web exploits (e.g. /.env, RCE probes); auto ... show more Automated scan for exposed config/secret files and known web exploits (e.g. /.env, RCE probes); auto-banned by fail2ban. show less	Web App Attack Hacking
🇫🇷 Baking333	2026-09-06 16:51:05 (4 days ago)	redacted:80 15.252.96.173 - - [06/Sep/2026:17:51:04 +0100] "GET /.env HTTP/1.1" 200 166 0/14520 "-" ... show more redacted:80 15.252.96.173 - - [06/Sep/2026:17:51:04 +0100] "GET /.env HTTP/1.1" 200 166 0/14520 "-" "Mozilla/5.0 (compatible; ArgusScanner/0.1; +http://example/abuse)" redacted:80 15.252.96.173 - - [06/Sep/2026:17:51:04 +0100] "GET /.git/config HTTP/1.1" 200 166 0/13594 "-" "Mozilla/5.0 (compatible; ArgusScanner/0.1; +http://example/abuse)" show less	Bad Web Bot Web App Attack

Showing 1 to 15 of 33 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇹🇳 197.3.254.85

🇬🇧 194.50.235.153

🇩🇪 185.102.115.190

🇧🇷 177.126.132.44

🇧🇷 177.126.90.235

🇨🇴 177.8.77.170

🇸🇬 143.198.220.159

🇵🇱 95.214.53.157

🇮🇶 65.20.198.159

🇺🇸 45.156.129.175

🇺🇸 34.22.39.43

🇧🇷 24.152.37.60

🇧🇪 198.235.24.242

🇧🇷 177.104.171.118

🇧🇷 177.10.133.155

🇫🇷 176.31.100.132

🇩🇪 176.9.105.121

🇺🇸 138.197.16.14

🇨🇳 122.96.50.129

🇳🇱 94.154.35.215