JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 45.131.193.52

45.131.193.52 was found in our database!

This IP was reported 147 times. Confidence of Abuse is 69%: ?

69%

ISP	VPN-Consumer-US
Usage Type	Data Center/Web Hosting/Transit
ASN	AS262287
Domain Name	expressvpn.com
Country	🇺🇸 United States of America
City	Miami, Florida

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 45.131.193.52

Whois 45.131.193.52

IP Abuse Reports for 45.131.193.52:

This IP address has been reported a total of 147 times from 58 distinct sources. 45.131.193.52 was first reported on December 18th 2022, and the most recent report was 56 minutes ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇫🇷 Baking333	2026-08-27 18:22:06 (56 minutes ago)	[redacted] 45.131.193.52 - - [27/Aug/2026:19:22:02 +0100] "GET /[redacted] HTTP/1.1" 302 6798 0/7447 ... show more [redacted] 45.131.193.52 - - [27/Aug/2026:19:22:02 +0100] "GET /[redacted] HTTP/1.1" 302 6798 0/74471 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Chrome/129.0.0.0 Safari/537.36" [redacted] 45.131.193.52 - - [27/Aug/2026:19:22:04 +0100] "GET /wp-admin/ HTTP/1.1" 301 627 0/316 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; rv:143.0) Gecko/20100101 Firefox/143.0" show less	Bad Web Bot Web App Attack
🇺🇸 lostswordfish.com	2026-08-26 12:56:06 (1 day ago)	Wordfence waf block on illinoisvoices	Web App Attack
🇧🇪 brechtr	2026-08-26 12:55:45 (1 day ago)	[Press84-BanHammer] bad username — Sourced from: brechtryckaert.com — Request: POST /wp-login.php	Brute-Force
🇺🇸 TPI-Abuse	2026-08-20 13:27:49 (1 week ago)	(mod_security) mod_security (id:210492) triggered by 45.131.193.52 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:210492) triggered by 45.131.193.52 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Aug 20 09:27:43.980462 2026] [security2:error] [pid 15919:tid 15919] [client 45.131.193.52:39887] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "192.64.150.110"] [uri "/.env"] [unique_id "aocAz9sWwAC1125GjlcrDQAAABU"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-08-20 12:03:21 (1 week ago)	(mod_security) mod_security (id:210492) triggered by 45.131.193.52 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:210492) triggered by 45.131.193.52 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Aug 20 08:03:12.947732 2026] [security2:error] [pid 7508:tid 7508] [client 45.131.193.52:58703] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "192.64.150.172"] [uri "/vendor/.env"] [unique_id "aobtAJV44ksy4eZEW_pTiwAAAAo"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-08-20 11:18:37 (1 week ago)	(mod_security) mod_security (id:210492) triggered by 45.131.193.52 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:210492) triggered by 45.131.193.52 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Aug 20 07:18:24.002013 2026] [security2:error] [pid 19160:tid 19160] [client 45.131.193.52:43577] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "192.64.150.101"] [uri "/vendor/laravel/.env"] [unique_id "aobigG8niL9GizUTcZv35AAAAAY"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-08-20 10:04:13 (1 week ago)	(mod_security) mod_security (id:210492) triggered by 45.131.193.52 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:210492) triggered by 45.131.193.52 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Aug 20 06:04:04.256270 2026] [security2:error] [pid 27797:tid 27797] [client 45.131.193.52:41957] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "192.64.150.197"] [uri "/backend/.env"] [unique_id "aobRFCiE6F9g-WemOdFZ5QAAAAo"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-08-20 08:39:31 (1 week ago)	(mod_security) mod_security (id:210492) triggered by 45.131.193.52 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:210492) triggered by 45.131.193.52 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Aug 20 04:39:14.614286 2026] [security2:error] [pid 4009:tid 4009] [client 45.131.193.52:39037] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "192.64.150.16"] [uri "/old/.env"] [unique_id "aoa9Mu-DgxTW-lo-x7d4QwAAABA"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-08-20 07:14:27 (1 week ago)	(mod_security) mod_security (id:210492) triggered by 45.131.193.52 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:210492) triggered by 45.131.193.52 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Aug 20 03:14:22.020114 2026] [security2:error] [pid 20995:tid 20995] [client 45.131.193.52:62681] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "192.64.150.121"] [uri "/.env"] [unique_id "aoapTl3SVO3OYb4kai54QQAAAAY"] show less	Brute-Force Bad Web Bot Web App Attack
🇮🇩 Burayot	2026-08-20 04:35:27 (1 week ago)	LF_MODSEC: (mod_security) mod_security (id:949110) triggered by 45.131.193.52 (US/United States/-): ... show more LF_MODSEC: (mod_security) mod_security (id:949110) triggered by 45.131.193.52 (US/United States/-): 2 in the last 3600 secs show less	Web App Attack
🇩🇪 gadix	2026-08-18 21:52:29 (1 week ago)	45.131.193.52 - - [18/Aug/2026:21:38:43 +0200] "POST /wp-login.php HTTP/1.1" 200 16597 "-" "Mozilla/ ... show more 45.131.193.52 - - [18/Aug/2026:21:38:43 +0200] "POST /wp-login.php HTTP/1.1" 200 16597 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Chrome/129.0.0.0 Safari/537.36" 45.131.193.52 - - [18/Aug/2026:22:58:54 +0200] "POST /wp-login.php HTTP/1.1" 200 16602 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Chrome/129.0.0.0 Safari/537.36" 45.131.193.52 - - [18/Aug/2026:23:52:26 +0200] "POST /wp-login.php HTTP/1.1" 200 16601 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; r ... show less	Web App Attack
🇪🇸 masterguru	2026-08-18 20:16:54 (1 week ago)	wp-login request blocked, no referer. Pattern match "wp-login.php" at REQUEST_URI. (5001900-122)	Web App Attack
🇫🇷 Stylottica	2026-08-15 23:02:53 (1 week ago)	PrestaShop Security Module: suspicious probe path detected (/admin/)	Web App Attack
🇪🇸 elcruzado.es	2026-08-14 12:06:06 (1 week ago)	(wordpress) Failed wordpress login from 45.131.193.52 (US/United States/-)	Brute-Force
Anonymous	2026-08-14 03:15:31 (1 week ago)	Web attack blocked by Wordfence on mergel.nu (1 hit). Reported by CRMON.	Web App Attack

Showing 1 to 15 of 147 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇺🇸 136.34.252.154

🇨🇭 104.244.74.84

🇬🇷 83.235.16.111

🇱🇹 62.60.130.242

🇱🇹 213.176.26.88

🇰🇷 211.246.182.158

🇻🇪 201.249.89.102

🇺🇸 140.186.53.181

🇮🇳 98.70.48.241

🇬🇧 62.60.130.253

🇮🇩 43.243.142.42

🇺🇸 35.230.39.182

🇺🇸 34.55.120.64

🇩🇪 217.250.126.217

🇺🇦 194.44.48.42

🇳🇱 193.47.62.69

🇷🇴 193.46.255.86

🇺🇸 170.106.179.68

🇸🇬 161.118.192.206

🇰🇪 102.211.147.29