AbuseIPDB » 52.125.141.28
52.125.141.28
This IP was reported 8 times. Confidence of
Abuse
is 43% : ?
ISP
Microsoft Corporation
Usage Type
Data Center/Web Hosting/Transit
ASN
AS8075
Domain Name
microsoft.com
Country
🇳🇱
Netherlands
City
Amsterdam, North Holland
IP info including ISP, Usage Type, and Location provided
by IPInfo . Updated weekly.
IP Abuse Reports for 52.125.141.28 :
This IP address has been reported a total of
8
times from
6 distinct
sources.
52.125.141.28 was first reported on
June 25th 2026 , and the most recent report was
9 hours ago
Recent Reports:
We have received reports of abusive activity from this IP address within the last week. It is
potentially still actively engaged in abusive activities.
Reporter
IoA Timestamp (UTC)
Comment
Categories
🇫🇷
dwmp
2026-06-30 05:21:53
(9 hours ago)
Jun 30 07:17:36 plesk postfix/smtpd[667920]: lost connection after EHLO from unknown[52.125.141.28]
...
show more
Jun 30 07:17:36 plesk postfix/smtpd[667920]: lost connection after EHLO from unknown[52.125.141.28]
Jun 30 07:17:36 plesk postfix/smtpd[668161]: lost connection after EHLO from unknown[52.125.141.28]
Jun 30 07:21:53 plesk postfix/smtpd[700501]: lost connection after EHLO from unknown[52.125.141.28]
...
show less
Brute-Force
SSH
🇺🇸
TPI-Abuse
2026-06-28 14:38:24
(2 days ago)
(mod_security) mod_security (id:210730) triggered by 52.125.141.28 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210730) triggered by 52.125.141.28 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Jun 28 10:38:15.499071 2026] [security2:error] [pid 5011:tid 5011] [client 52.125.141.28:3141] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||autodiscover.qyzaco.com|F|2"] [data ".com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "autodiscover.qyzaco.com"] [uri "/autodiscover/autodiscover.json/v1.0/[email protected] "] [unique_id "akEx11sfYpyN17W720UvHgAAAAo"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇬🇧
openstrike.co.uk
2026-06-28 09:38:38
(2 days ago)
77 packets to ports 110 143 465 587 993 995
Brute-Force
🇺🇸
TPI-Abuse
2026-06-28 06:28:08
(2 days ago)
(mod_security) mod_security (id:210730) triggered by 52.125.141.28 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210730) triggered by 52.125.141.28 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Jun 28 02:28:02.577013 2026] [security2:error] [pid 29060:tid 29060] [client 52.125.141.28:3148] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||autodiscover.karsini-services.com|F|2"] [data ".com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "autodiscover.karsini-services.com"] [uri "/autodiscover/autodiscover.json/v1.0/[email protected] "] [unique_id "akC-8meygcFC3F7TpvLuEgAAABM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-06-27 08:12:27
(3 days ago)
Unauthorized connection attempt
Port Scan
Hacking
Exploited Host
🇹🇭
thaizone.com
2026-06-26 11:11:45
(4 days ago)
Mail credential brute-force attack (SM6) #1
Email Spam
Brute-Force
🇺🇸
TPI-Abuse
2026-06-26 11:00:50
(4 days ago)
(mod_security) mod_security (id:210730) triggered by 52.125.141.28 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210730) triggered by 52.125.141.28 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jun 26 07:00:44.993508 2026] [security2:error] [pid 17390:tid 17390] [client 52.125.141.28:2185] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||autodiscover.scala-global.com|F|2"] [data "[email protected] "] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "autodiscover.scala-global.com"] [uri "/autodiscover/autodiscover.json/v1.0/[email protected] "] [unique_id "aj5b3IgLwyRFblsB_sU39wAAAAM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-06-25 13:50:05
(5 days ago)
...
Web App Attack
Showing 1 to
8
of 8 reports
Think this IP has been falsely reported? You may request to have the associated
reports reviewed and removed.
Request Takedown 🚩
Recently Reported IPs: