AbuseIPDB » 52.138.237.52

52.138.237.52 was found in our database!

This IP was reported 86 times. Confidence of Abuse is 1%: ?

ISP	Microsoft Corporation
Usage Type	Data Center/Web Hosting/Transit
ASN	AS8075
Domain Name	microsoft.com
Country	Ireland
City	Dublin, Leinster

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated biweekly.

Report 52.138.237.52

Whois 52.138.237.52

IP Abuse Reports for 52.138.237.52:

This IP address has been reported a total of 86 times from 55 distinct sources. 52.138.237.52 was first reported on November 14th 2024, and the most recent report was 1 month ago.

Old Reports: The most recent abuse report for this IP address is from 1 month ago. It is possible that this IP is no longer involved in abusive activities.

Reporter	IoA Timestamp in UTC	Comment	Categories
Anonymous	2024-11-18 16:19:40 (2 months ago)	Ports: 80,443; Direction: 0; Trigger: LF_CUSTOMTRIGGER	Brute-Force SSH
strefapi_com	2024-11-18 13:59:45 (2 months ago)	Brute-force web ...	Hacking Brute-Force Web App Attack
evr	2024-11-18 08:55:12 (2 months ago)	[Fail2Ban]: Jail apache-noscript triggered 5 time(s) for 52.138.237.52. [Mon Nov 18 09:55:02.4 ... show more[Fail2Ban]: Jail apache-noscript triggered 5 time(s) for 52.138.237.52. [Mon Nov 18 09:55:02.433717 2024] [proxy_fcgi:error] [pid 28816:tid 28983] [client 52.138.237.52:0] AH01071: Got error 'Primary script unknown' [Mon Nov 18 09:55:03.021884 2024] [proxy_fcgi:error] [pid 28816:tid 28974] [client 52.138.237.52:0] AH01071: Got error 'Primary script unknown' [Mon Nov 18 09:55:04.361226 2024] [proxy_fcgi:error] [pid 29011:tid 29050] [client 52.138.237.52:0] AH01071: Got error 'Primary script unknown' [Mon Nov 18 09:55:09.796626 2024] [proxy_fcgi:error] [pid 29011:tid 29053] [client 52.138.237.52:0] AH01071: Got error 'Primary script unknown' [Mon Nov 18 09:55:11.345440 2024] [proxy_fcgi:error] [pid 29011:tid 29062] [client 52.138.237.52:0] AH01071: Got error 'Primary script unknown' ... show less	Hacking Web App Attack
FeG Deutschland	2024-11-18 04:31:31 (2 months ago)	Looking for CMS/PHP/SQL vulnerablilities - 13	Exploited Host Web App Attack
COMAITE	2024-11-18 00:02:27 (2 months ago)	Multiple web server 400 error codes from same source ip 52.138.237.52.	Web App Attack
4server	2024-11-17 21:27:28 (2 months ago)	[SunNov1722:27:20.7648492024][security2:error][pid2819847:tid2820040][client52.138.237.52:0][client5 ... show more[SunNov1722:27:20.7648492024][security2:error][pid2819847:tid2820040][client52.138.237.52:0][client52.138.237.52]ModSecurity:Accessdeniedwithcode403\(phase2\).Patternmatch\"wp-content/uploads/.\\\\\\\\\.ph\(\?:p\\|tml\\|t\)\"atREQUEST_FILENAME.[file\"/etc/apache2/conf.d/modsec_rules/99_asl_jitp.conf\"][line\"5062\"][id\"382238\"][rev\"2\"][msg\"Atomicorp.comWAFRules-VirtualJustInTimePatch:PHPfileexecutioninuploadsdirectorydenied\"][data\"wp-content/uploads/wp-login.php\"][severity\"CRITICAL\"][hostname\"newbeauty-pully.ch\"][uri\"/wp-content/uploads/wp-login.php\"][unique_id\"ZzpfuJKr7DjOoMcbLnP1DwAAAJM\"][SunNov1722:27:21.1818102024][security2:error][pid2819847:tid2820040][client52.138.237.52:0][client52.138.237.52]ModSecurity:Accessdeniedwithcode403\(phase2\).Patternmatch\"wp-content/uploads/.\\\\\\\\\.ph\(\?:p\\|tml\\|t\)\"atREQUEST_FILENAME.[file\"/etc/apache2/conf.d/modsec_rules/99_asl_jitp.conf\"][line\"5062\"][id\"382238\"][rev\"2\"][msg\"Atomicorp.comWAFRules-VirtualJustInTimePatch:PHPfileexecutioninupl show less	Port Scan Brute-Force Web App Attack
Anonymous	2024-11-17 21:26:05 (2 months ago)	Fail2Ban apache-noscript	Bad Web Bot
mashamal	2024-11-17 21:25:08 (2 months ago)	Vulnerability Probe ...	Web App Attack
Anonymous	2024-11-17 21:10:19 (2 months ago)	Action: Block, Reason: DDOS attack detected	DDoS Attack
Floofie	2024-11-17 20:11:16 (2 months ago)	52.138.237.52 - - [16/Nov/2024:12:47:02 -0500] "GET /.well-known/acme-challenge/mariju.php HTTP/2.0" ... show more52.138.237.52 - - [16/Nov/2024:12:47:02 -0500] "GET /.well-known/acme-challenge/mariju.php HTTP/2.0" 403 106 "-" "-" 52.138.237.52 - - [17/Nov/2024:15:11:14 -0500] "GET /.well-known/acme-challenge/autoload_classmap.php HTTP/2.0" 403 106 "-" "-" 52.138.237.52 - - [17/Nov/2024:15:11:15 -0500] "GET /.well-known/acme-challenge/worksec.php HTTP/2.0" 403 106 "-" "-" ... show less	Brute-Force Bad Web Bot Web App Attack
Anonymous	2024-11-17 19:20:27 (2 months ago)	Ports: 80,443; Direction: 0; Trigger: LF_APACHE_403	Brute-Force SSH
4server	2024-11-17 17:28:42 (2 months ago)	[SunNov1718:28:35.1203832024][security2:error][pid2819847:tid2820031][client52.138.237.52:0][client5 ... show more[SunNov1718:28:35.1203832024][security2:error][pid2819847:tid2820031][client52.138.237.52:0][client52.138.237.52]ModSecurity:Accessdeniedwithcode403\(phase2\).Patternmatch\"wp-content/uploads/.\\\\\\\\\.ph\(\?:p\\|tml\\|t\)\"atREQUEST_FILENAME.[file\"/etc/apache2/conf.d/modsec_rules/99_asl_jitp.conf\"][line\"5062\"][id\"382238\"][rev\"2\"][msg\"Atomicorp.comWAFRules-VirtualJustInTimePatch:PHPfileexecutioninuploadsdirectorydenied\"][data\"wp-content/uploads/wp-login.php\"][severity\"CRITICAL\"][hostname\"hosting-royal.ch\"][uri\"/wp-content/uploads/wp-login.php\"][unique_id\"Zzonw5Kr7DjOoMcbLnPiHgAAAIo\"][SunNov1718:28:35.9408642024][security2:error][pid2819847:tid2820031][client52.138.237.52:0][client52.138.237.52]ModSecurity:Accessdeniedwithcode403\(phase2\).Patternmatch\"wp-content/uploads/.\\\\\\\\\.ph\(\?:p\\|tml\\|t\)\"atREQUEST_FILENAME.[file\"/etc/apache2/conf.d/modsec_rules/99_asl_jitp.conf\"][line\"5062\"][id\"382238\"][rev\"2\"][msg\"Atomicorp.comWAFRules-VirtualJustInTimePatch:PHPfileexecutioninuploa show less	Port Scan Brute-Force Web App Attack
rellik	2024-11-17 14:34:00 (2 months ago)	Scanning Critical File	Hacking Web App Attack
smallbottle小瓶	2024-11-17 12:51:00 (2 months ago)	web scraper total 36 requests Mitigation Block by Custom rules User agent None< ... show moreweb scraper total 36 requests Mitigation Block by Custom rules User agent None Method GET Scheme HTTP/1.1 Host {mydomian}.top show less	Web Spam Bad Web Bot
4server	2024-11-17 12:50:41 (2 months ago)	[SunNov1713:50:30.9545072024][security2:error][pid2899301:tid2899341][client52.138.237.52:0][client5 ... show more[SunNov1713:50:30.9545072024][security2:error][pid2899301:tid2899341][client52.138.237.52:0][client52.138.237.52]ModSecurity:Accessdeniedwithcode403\(phase2\).Patternmatch\"wp-content/uploads/.\\\\\\\\\.ph\(\?:p\\|tml\\|t\)\"atREQUEST_FILENAME.[file\"/etc/apache2/conf.d/modsec_rules/99_asl_jitp.conf\"][line\"5062\"][id\"382238\"][rev\"2\"][msg\"Atomicorp.comWAFRules-VirtualJustInTimePatch:PHPfileexecutioninuploadsdirectorydenied\"][data\"wp-content/uploads/wp-login.php\"][severity\"CRITICAL\"][hostname\"enricoalbertini.com\"][uri\"/wp-content/uploads/wp-login.php\"][unique_id\"Zznmll_OhiE5r47zu9ynMgAAAAo\"][SunNov1713:50:31.7709842024][security2:error][pid2899301:tid2899341][client52.138.237.52:0][client52.138.237.52]ModSecurity:Accessdeniedwithcode403\(phase2\).Patternmatch\"wp-content/uploads/.\\\\\\\\\.ph\(\?:p\\|tml\\|t\)\"atREQUEST_FILENAME.[file\"/etc/apache2/conf.d/modsec_rules/99_asl_jitp.conf\"][line\"5062\"][id\"382238\"][rev\"2\"][msg\"Atomicorp.comWAFRules-VirtualJustInTimePatch:PHPfileexecutioninup show less	Port Scan Brute-Force Web App Attack