JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

52.138.172.183

Neutral Activity

Abuse Confidence Score

0% Low Risk

54 reports

30 reporters · latest 1 year ago

ISP: Microsoft Corporation
Usage Type: Data Center/Web Hosting/Transit
ASN: AS8075
Domain Name: microsoft.com
Country: 🇮🇪 Ireland
City: Dublin, Leinster

ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report Whois

No reports in the last 60 days

52.138.172.183 has been reported 54 times. The most recent report is from 1 year ago.

The full history is preserved below and remains searchable. A 0% score reflects the absence of recent activity, but this is not a guarantee that earlier reports were invalid. Abuse confidence score decays, naturally, over time, when the abusive activity stops.

Abuse Reports

Export reports CSV

Total reports

54 from 30 distinct reporters

First reported

February 22nd 2025

Most recent report

1 year ago

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇩🇪 LRob	2025-02-28 23:01:53 UTC · (1 year ago)	Repeated attacks detected by Fail2Ban in recidive jail	Hacking
🇩🇪 LRob	2025-02-26 23:10:52 UTC · (1 year ago)	Repeated attacks detected by Fail2Ban in recidive jail	Hacking
🇩🇪 LRob	2025-02-25 00:11:15 UTC · (1 year ago)	Repeated attacks detected by Fail2Ban in recidive jail	Hacking
🇮🇩 Incidents Response Neptus Team	2025-02-23 15:39:00 UTC · (1 year ago)	Report Abuse IP	Hacking Bad Web Bot Exploited Host Web App Attack
🇩🇪 FeG Deutschland	2025-02-23 10:40:42 UTC · (1 year ago)	Looking for CMS/PHP/SQL vulnerablilities/excessive crawling - 17	Exploited Host Web App Attack
🇩🇪 Hazzard	2025-02-23 10:37:57 UTC · (1 year ago)	(apache-scanners) Failed apache-scanners trigger with match [redacted])	Port Scan
🇮🇩 penjaga BRIN	2025-02-23 09:02:19 UTC · (1 year ago)	apache-auth-111	Web App Attack
🇺🇸 TPI-Abuse	2025-02-23 09:01:54 UTC · (1 year ago)	(mod_security) mod_security (id:240000) triggered by 52.138.172.183 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Feb 23 04:01:48.970270 2025] [security2:error] [pid 3084641:tid 3084641] [client 52.138.172.183:17 ... show more (mod_security) mod_security (id:240000) triggered by 52.138.172.183 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Feb 23 04:01:48.970270 2025] [security2:error] [pid 3084641:tid 3084641] [client 52.138.172.183:1789] [client 52.138.172.183] ModSecurity: Access denied with code 403 (phase 2). String match ".php" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/24_Apps_Joomla.conf"] [line "74"] [id "240000"] [rev "1"] [msg "COMODO WAF: Protecting Joomla folder\|\|register-yacht-panama.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "Joomla"] [hostname "register-yacht-panama.com"] [uri "/images/stories/admin-post.php"] [unique_id "Z7rj_Eciot5kOBmOGTtiFgAAAA0"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2025-02-23 07:22:31 UTC · (1 year ago)	(mod_security) mod_security (id:240000) triggered by 52.138.172.183 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Feb 23 02:22:27.920896 2025] [security2:error] [pid 963:tid 963] [client 52.138.172.183:4966] [cli ... show more (mod_security) mod_security (id:240000) triggered by 52.138.172.183 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Feb 23 02:22:27.920896 2025] [security2:error] [pid 963:tid 963] [client 52.138.172.183:4966] [client 52.138.172.183] ModSecurity: Access denied with code 403 (phase 2). String match ".php" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/24_Apps_Joomla.conf"] [line "74"] [id "240000"] [rev "1"] [msg "COMODO WAF: Protecting Joomla folder\|\|ichoosethelight.org\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "Joomla"] [hostname "ichoosethelight.org"] [uri "/images/stories/admin-post.php"] [unique_id "Z7rMs_RI3akw1Z6Ri5fDRAAAAA0"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 octageeks.com	2025-02-23 05:10:16 UTC · (1 year ago)	Wordpress malicious attack:[octablocked]	Web App Attack
🇺🇸 TPI-Abuse	2025-02-23 03:29:52 UTC · (1 year ago)	(mod_security) mod_security (id:240000) triggered by 52.138.172.183 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Feb 22 22:29:49.788425 2025] [security2:error] [pid 1148428:tid 1148428] [client 52.138.172.183:41 ... show more (mod_security) mod_security (id:240000) triggered by 52.138.172.183 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Feb 22 22:29:49.788425 2025] [security2:error] [pid 1148428:tid 1148428] [client 52.138.172.183:4114] [client 52.138.172.183] ModSecurity: Access denied with code 403 (phase 2). String match ".php" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/24_Apps_Joomla.conf"] [line "87"] [id "240000"] [rev "1"] [msg "COMODO WAF: Protecting Joomla folder\|\|www.cannonsearch.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "Joomla"] [hostname "www.cannonsearch.com"] [uri "/images/stories/admin-post.php"] [unique_id "Z7qWLR75ufny9EJbcPt-xwAAAAM"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2025-02-23 01:03:24 UTC · (1 year ago)	(mod_security) mod_security (id:240000) triggered by 52.138.172.183 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Feb 22 20:03:18.156185 2025] [security2:error] [pid 2340:tid 2340] [client 52.138.172.183:3335] [c ... show more (mod_security) mod_security (id:240000) triggered by 52.138.172.183 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Feb 22 20:03:18.156185 2025] [security2:error] [pid 2340:tid 2340] [client 52.138.172.183:3335] [client 52.138.172.183] ModSecurity: Access denied with code 403 (phase 2). String match ".php" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/24_Apps_Joomla.conf"] [line "74"] [id "240000"] [rev "1"] [msg "COMODO WAF: Protecting Joomla folder\|\|spacebooger.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "Joomla"] [hostname "spacebooger.com"] [uri "/images/stories/admin-post.php"] [unique_id "Z7pz1oEHlOxpBVjjU9csMwAAAAU"] show less	Brute-Force Bad Web Bot Web App Attack
Anonymous	2025-02-23 00:57:54 UTC · (1 year ago)	Inappropriate script execution attempts	Hacking Brute-Force
🇩🇪 LRob	2025-02-23 00:10:17 UTC · (1 year ago)	Repeated attacks detected by Fail2Ban in recidive jail	Hacking
🇫🇷 Savoie	2025-02-22 23:22:00 UTC · (1 year ago)	52.138.172.183 *.* - [23/Feb/2025:00:22:27 +0100] "GET /wp-includes/Text/network.php HTTP/1.1" 302 224 "-" "-"	Bad Web Bot Web App Attack

Showing 1 to 15 of 54 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown

Recently Reported IPs:

🇨🇳 223.109.207.77

🇺🇸 184.183.93.106

🇧🇷 177.207.248.141

🇺🇸 66.132.195.19

🇧🇪 35.206.162.201

🇺🇸 20.29.63.121

🇦🇷 181.80.224.66

🇵🇱 172.69.155.43

🇵🇱 172.64.200.23

🇵🇱 172.64.198.180

🇵🇱 145.239.89.124

🇺🇸 136.144.42.137

🇺🇸 104.22.118.71

🇺🇸 104.22.118.32

🇺🇸 66.132.186.248

🇺🇸 65.130.105.206

🇮🇳 49.204.74.149

🇩🇪 45.3.55.167

🇧🇪 35.210.110.106

🇮🇳 14.1.119.12