JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 52.128.238.218

52.128.238.218 was found in our database!

This IP was reported 39 times. Confidence of Abuse is 0%: ?

ISP	Netsec Limited
Usage Type	Data Center/Web Hosting/Transit
ASN	AS963
Domain Name	netsec.com
Country	🇭🇰 Hong Kong
City	Hoi Fu Court, Yau Tsim Mong District

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 52.128.238.218

Whois 52.128.238.218

IP Abuse Reports for 52.128.238.218:

This IP address has been reported a total of 39 times from 19 distinct sources. 52.128.238.218 was first reported on July 27th 2022, and the most recent report was 1 year ago.

Old Reports: The most recent abuse report for this IP address is from 1 year ago . It is possible that this IP is no longer involved in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇩🇪 MusicLibrary	2024-10-22 10:10:36 (1 year ago)	Automated report, SQL Injection, pattern: /(\%27)\|(')\|(\-\-)\|(\%23)\|(#)/i - User Agent: Mozilla/5.0 ... show more Automated report, SQL Injection, pattern: /(\%27)\|(')\|(\-\-)\|(\%23)\|(#)/i - User Agent: Mozilla/5.0 (iPod; U; CPU iPhone OS 2_2_1 like Mac OS X; en-us) AppleWebKit/525.18.1 (KHTML, like Gecko) Version/3.1.1 Mobile/5H11a Safari/525.20 show less	SQL Injection
🇺🇸 TheMadBeaker	2024-10-17 05:57:39 (1 year ago)	Fail2Ban Ban Triggered HTTP SQL Injection Attempt	Hacking SQL Injection
🇯🇵 HeliJP	2024-10-13 17:56:13 (1 year ago)	2024-10-13T17:45:51Z - Recognized attacks\bad behavior from IP address 52.128.238.218 on port 443\80 ... show more 2024-10-13T17:45:51Z - Recognized attacks\bad behavior from IP address 52.128.238.218 on port 443\80 (3 daily hits): SQL Injection Attack: Common Injection Testing Detected show less	Hacking SQL Injection
🇬🇧 AvonleaConsulting	2024-10-09 22:59:22 (1 year ago)	Brute force attack stopped by firewall	Web Spam Brute-Force Web App Attack
🇺🇸 TPI-Abuse	2024-10-09 21:47:24 (1 year ago)	(mod_security) mod_security (id:212620) triggered by 52.128.238.218 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:212620) triggered by 52.128.238.218 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 09 17:47:15.370249 2024] [security2:error] [pid 12368:tid 12368] [client 52.128.238.218:64723] [client 52.128.238.218] ModSecurity: Access denied with code 403 (phase 2). Pattern match "<script\\\\b" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/07_XSS_XSS.conf"] [line "65"] [id "212620"] [rev "4"] [msg "COMODO WAF: Cross-site Scripting (XSS) Attack\|\|www.oualierealty.com\|F\|2"] [data "Matched Data: <script found within REQUEST_URI: /index.php?action=\\x22><script>alert(string.fromcharcode(88,83,83))</script>&type=member"] [severity "CRITICAL"] [tag "CWAF"] [tag "XSS"] [hostname "www.oualierealty.com"] [uri "/index.php"] [unique_id "Zwb54ysEVH5riwRugnUMfgAAAAs"] show less	Brute-Force Bad Web Bot Web App Attack
🇬🇧 AvonleaConsulting	2024-10-08 22:59:05 (1 year ago)	Scanning unused Default website or suspicious access to valid sites from IP marked as abusive	Bad Web Bot Web App Attack
🇬🇧 AvonleaConsulting	2024-10-08 00:58:35 (1 year ago)	Unrecognised attack	IoT Targeted
🇯🇵 VXG-NET	2024-10-08 00:35:38 (1 year ago)	port=80, indicator_type=info-leak	Hacking
🇺🇸 TPI-Abuse	2024-10-07 21:06:38 (1 year ago)	(mod_security) mod_security (id:212620) triggered by 52.128.238.218 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:212620) triggered by 52.128.238.218 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Oct 07 17:06:27.460134 2024] [security2:error] [pid 14527:tid 14527] [client 52.128.238.218:63021] [client 52.128.238.218] ModSecurity: Access denied with code 403 (phase 2). Pattern match "<script\\\\b" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/07_XSS_XSS.conf"] [line "65"] [id "212620"] [rev "4"] [msg "COMODO WAF: Cross-site Scripting (XSS) Attack\|\|southtncardio.com\|F\|2"] [data "Matched Data: <script found within REQUEST_URI: /index.php?option=\\x22><script>alert(string.fromcharcode(88,83,83))</script>&view=page&id=79"] [severity "CRITICAL"] [tag "CWAF"] [tag "XSS"] [hostname "southtncardio.com"] [uri "/index.php"] [unique_id "ZwRNUzmtKk1lqFNQjhsa8QAAAAc"] show less	Brute-Force Bad Web Bot Web App Attack
🇨🇦 JuicyJ	2024-09-03 09:39:51 (1 year ago)	Excessive crawling/scraping	Web App Attack
🇺🇸 ALSCO®️	2024-08-22 22:00:57 (1 year ago)	Report By ALSCO Security Team: Potential CSRF Attack Detected	Hacking
🇺🇸 Secure Gateway®️	2024-08-22 22:00:56 (1 year ago)	Report By Secure Gateway Security Team: Brute Force Login Attempt	Web App Attack
🇺🇸 TPI-Abuse	2024-08-21 13:44:26 (1 year ago)	(mod_security) mod_security (id:212620) triggered by 52.128.238.218 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:212620) triggered by 52.128.238.218 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Aug 21 09:44:16.141655 2024] [security2:error] [pid 2273:tid 2329] [client 52.128.238.218:64485] [client 52.128.238.218] ModSecurity: Access denied with code 403 (phase 2). Pattern match "<script\\\\b" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/07_XSS_XSS.conf"] [line "65"] [id "212620"] [rev "4"] [msg "COMODO WAF: Cross-site Scripting (XSS) Attack\|\|gamecrazy.us\|F\|2"] [data "Matched Data: <script found within REQUEST_URI: /index.php?action=\\x22><script>alert(string.fromcharcode(88,83,83))</script>&cid=20"] [severity "CRITICAL"] [tag "CWAF"] [tag "XSS"] [hostname "gamecrazy.us"] [uri "/index.php"] [unique_id "ZsXvMP54RID0330x77SvuwAAANY"] show less	Brute-Force Bad Web Bot Web App Attack
🇫🇷 Sklurk	2024-03-10 12:14:08 (2 years ago)	Web App Attack	Web App Attack
Anonymous	2024-03-06 07:31:17 (2 years ago)	Web attack	Bad Web Bot Web App Attack

Showing 1 to 15 of 39 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇵🇭 202.137.113.211

🇰🇷 144.24.72.208

🇮🇳 103.72.73.83

🇮🇶 65.20.139.149

🇺🇸 18.218.53.152

🇪🇸 212.30.33.170

🇭🇰 199.45.154.191

🇺🇸 192.129.243.42

🇻🇳 171.244.37.97

🇺🇸 66.132.195.15

🇻🇳 14.225.217.138

🇨🇳 115.190.83.181

🇹🇼 111.70.14.135

🇽🇰 91.187.112.252

🇧🇷 205.210.31.204

🇨🇳 114.215.202.153

🇱🇹 81.30.98.44

🇺🇸 45.194.67.120

🇹🇿 41.59.50.70

🇺🇸 13.89.124.217