JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

52.125.128.6

Neutral Activity

Abuse Confidence Score

0% Low Risk

268 reports

20 reporters · latest 2 years ago

ISP: Microsoft Corporation
Usage Type: Data Center/Web Hosting/Transit
ASN: AS8075
Domain Name: microsoft.com
Country: 🇺🇸 United States of America
City: Des Moines, Iowa

ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report Whois

No reports in the last 60 days

52.125.128.6 has been reported 268 times. The most recent report is from 2 years ago.

The full history is preserved below and remains searchable. A 0% score reflects the absence of recent activity, but this is not a guarantee that earlier reports were invalid. Abuse confidence score decays, naturally, over time, when the abusive activity stops.

Abuse Reports

Export reports CSV

Total reports

268 from 20 distinct reporters

First reported

November 21st 2022

Most recent report

2 years ago

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇺🇸 MPL	2024-08-10 18:48:57 UTC · (2 years ago)	tcp port scan (232 or more attempts)	Port Scan
🇺🇸 MPL	2024-08-10 18:48:57 UTC · (2 years ago)	tcp port scan (232 or more attempts)	Port Scan
🇺🇸 MPL	2024-08-10 17:24:45 UTC · (2 years ago)	tcp/443 (30 or more attempts)	Port Scan
🇺🇸 TPI-Abuse	2024-08-10 13:32:18 UTC · (2 years ago)	(mod_security) mod_security (id:210730) triggered by 52.125.128.6 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Aug 10 09:32:12.984571 2024] [security2:error] [pid 6487:tid 6487] [client 52.125.128.6:9455] [clien ... show more (mod_security) mod_security (id:210730) triggered by 52.125.128.6 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Aug 10 09:32:12.984571 2024] [security2:error] [pid 6487:tid 6487] [client 52.125.128.6:9455] [client 52.125.128.6] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy\|\|autodiscover.agapeaccounting.com\|F\|2"] [data ".com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "autodiscover.agapeaccounting.com"] [uri "/autodiscover/autodiscover.json/v1.0/[email protected]"] [unique_id "Zrdr3DpxqJbveond1V9opwAAAAE"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 MPL	2024-08-09 21:01:50 UTC · (2 years ago)	tcp/443 (28 or more attempts)	Port Scan
🇺🇸 TPI-Abuse	2024-08-09 19:58:27 UTC · (2 years ago)	(mod_security) mod_security (id:210730) triggered by 52.125.128.6 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Aug 09 15:58:22.779532 2024] [security2:error] [pid 10522:tid 10547] [client 52.125.128.6:11459] [cl ... show more (mod_security) mod_security (id:210730) triggered by 52.125.128.6 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Aug 09 15:58:22.779532 2024] [security2:error] [pid 10522:tid 10547] [client 52.125.128.6:11459] [client 52.125.128.6] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy\|\|autodiscover.nationsrecovery.com\|F\|2"] [data ".com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "autodiscover.nationsrecovery.com"] [uri "/autodiscover/autodiscover.json/v1.0/[email protected]"] [unique_id "ZrZ03r4g_TAdq6DOslhvBwAAAUc"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 MPL	2024-08-09 17:01:27 UTC · (2 years ago)	tcp/443 (28 or more attempts)	Port Scan
🇺🇸 MPL	2024-08-08 17:01:51 UTC · (2 years ago)	tcp/443 (14 or more attempts)	Port Scan
🇺🇸 MPL	2024-08-07 00:02:57 UTC · (2 years ago)	tcp/443 (14 or more attempts)	Port Scan
🇺🇸 MPL	2024-08-06 18:13:20 UTC · (2 years ago)	tcp port scan (212 or more attempts)	Port Scan
🇦🇺 MAGIC	2024-08-06 09:05:54 UTC · (2 years ago)	VM1 Bad user agents ignoring web crawling rules. Draing bandwidth	DDoS Attack Bad Web Bot
🇦🇺 MAGIC	2024-07-18 09:09:03 UTC · (2 years ago)	VM1 Bad user agents ignoring web crawling rules. Draing bandwidth	DDoS Attack Bad Web Bot
🇺🇸 TPI-Abuse	2024-07-14 15:31:19 UTC · (2 years ago)	(mod_security) mod_security (id:210730) triggered by 52.125.128.6 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Jul 14 11:31:13.603671 2024] [security2:error] [pid 32755] [client 52.125.128.6:3072] [client 52.125 ... show more (mod_security) mod_security (id:210730) triggered by 52.125.128.6 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Jul 14 11:31:13.603671 2024] [security2:error] [pid 32755] [client 52.125.128.6:3072] [client 52.125.128.6] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy\|\|autodiscover.ucommsi.com\|F\|2"] [data ".com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "autodiscover.ucommsi.com"] [uri "/autodiscover/autodiscover.json/v1.0/[email protected]"] [unique_id "ZpPvQTiOx6ZCgGSxveNfTAAAAAI"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2024-07-13 14:53:05 UTC · (2 years ago)	(mod_security) mod_security (id:210730) triggered by 52.125.128.6 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Jul 13 10:52:56.986008 2024] [security2:error] [pid 14733] [client 52.125.128.6:9478] [client 52.125 ... show more (mod_security) mod_security (id:210730) triggered by 52.125.128.6 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Jul 13 10:52:56.986008 2024] [security2:error] [pid 14733] [client 52.125.128.6:9478] [client 52.125.128.6] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy\|\|autodiscover.unpluggedfurniture.com\|F\|2"] [data ".com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "autodiscover.unpluggedfurniture.com"] [uri "/autodiscover/autodiscover.json/v1.0/[email protected]"] [unique_id "ZpKUyBqfI6aJKuL0oVvdmwAAAAk"] show less	Brute-Force Bad Web Bot Web App Attack
Anonymous	2024-07-12 17:34:28 UTC · (2 years ago)		Email Spam Spoofing

Showing 1 to 15 of 268 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown

Recently Reported IPs:

🇧🇴 166.114.170.82

🇮🇱 213.146.169.114

🇩🇪 195.182.16.183

🇬🇧 165.154.129.43

🇳🇱 85.11.167.72

🇮🇶 65.20.160.228

🇺🇸 51.8.102.112

🇺🇸 20.106.75.210

🇺🇸 16.145.30.14

🇷🇴 2.57.121.118

🇺🇸 212.119.40.226

🇦🇷 190.96.127.50

🇨🇭 179.43.153.18

🇨🇦 178.253.33.28

🇸🇬 167.172.73.52

🇺🇸 152.163.158.220

🇬🇧 87.106.65.126

🇬🇧 81.19.219.225

🇳🇱 77.239.124.47

🇺🇸 68.53.255.107