JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 52.141.18.191

52.141.18.191 was found in our database!

This IP was reported 438 times. Confidence of Abuse is 0%: ?

ISP	Microsoft Corporation
Usage Type	Data Center/Web Hosting/Transit
ASN	AS8075
Domain Name	microsoft.com
Country	🇰🇷 Korea (the Republic of)
City	Seoul, Seoul

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 52.141.18.191

Whois 52.141.18.191

IP Abuse Reports for 52.141.18.191:

This IP address has been reported a total of 438 times from 215 distinct sources. 52.141.18.191 was first reported on February 21st 2026, and the most recent report was 4 months ago.

Old Reports: The most recent abuse report for this IP address is from 4 months ago . It is possible that this IP is no longer involved in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇹🇷 rtbh.com.tr	2026-03-04 20:11:53 (4 months ago)	list.rtbh.com.tr report: tcp/0	Brute-Force
🇺🇸 bazter.pro	2026-03-02 22:59:38 (4 months ago)	Auto-Ban [2026-03-03 00:59:22]: CRITICAL: Sensitive files (25); DC: Microsoft Corporation [Paths: 52 ... show more Auto-Ban [2026-03-03 00:59:22]: CRITICAL: Sensitive files (25); DC: Microsoft Corporation [Paths: 52] \| Details: Sensitive files/paths: /xmlrpc.php, /admin.php, /wp-admin/images/, /wp-content/admin.php, /adminfuns.php \| 404 errors (78): /about.php, /wp-content/uploads/index.php, /wp-includes/Requests/src/Response/about.php, /defaults.php, /sf.php, /classwithtostring.php, /wk/index.php, /abcd.php, /wp-conf.php, /wp-content/themes/hideo/network.php (and 26 more) \| 403 errors (28): /wp-includes/, /wp-includes/html-api/, /wp-includes/images/, /wp-admin/images/, /.well-known/, /wp-admin/css/colors/ectoplasm/, /wp-content/uploads/, /wp-includes/PHPMailer/ \| Other paths: /uploads/, /wp-content/plugins/WordPressCore/, /wp-login.php, /wp-content/plugins/index.php, /cgi-bin/, /wp-admin/user/index.php, /wp-content/themes/index.php, /xmlrpc.php show less	Web App Attack Hacking
🇫🇮 kumiko	2026-02-28 22:00:27 (4 months ago)	[2026-03-01 00:00:04] Persistent attack/probing over several days.	Port Scan Brute-Force Bad Web Bot
🇸🇬 fazar	2026-02-28 16:00:03 (4 months ago)	wp-login-scan: 3 attempts from 52.141.18.191 on node: sgp01	Exploited Host Web App Attack
🇹🇷 rtbh.com.tr	2026-02-26 20:11:46 (4 months ago)	list.rtbh.com.tr report: tcp/0	Brute-Force
🇫🇮 bittiguru.fi	2026-02-24 21:00:09 (4 months ago)	WordPress brute force	Brute-Force
🇹🇷 rtbh.com.tr	2026-02-24 20:11:44 (4 months ago)	list.rtbh.com.tr report: tcp/0	Brute-Force
🇮🇹 mgarofano80	2026-02-24 18:32:52 (4 months ago)		Brute-Force Web App Attack
🇺🇸 myagent.site	2026-02-24 17:27:17 (4 months ago)	Blocking for trying to access an exploit file: /wp-class.php	Hacking
🇫🇮 Christopher Hughes	2026-02-24 17:05:52 (4 months ago)	[Tue Feb 24 17:05:50.640715 2026] [proxy_fcgi:error] [pid 427517:tid 139768092419648] [client 52.141 ... show more [Tue Feb 24 17:05:50.640715 2026] [proxy_fcgi:error] [pid 427517:tid 139768092419648] [client 52.141.18.191:10206] AH01071: Got error 'Primary script unknown' [Tue Feb 24 17:05:50.885171 2026] [proxy_fcgi:error] [pid 427517:tid 139768075634240] [client 52.141.18.191:10206] AH01071: Got error 'Primary script unknown' [Tue Feb 24 17:05:51.134691 2026] [proxy_fcgi:error] [pid 427517:tid 139766985107008] [client 52.141.18.191:10206] AH01071: Got error 'Primary script unknown' [Tue Feb 24 17:05:51.390472 2026] [proxy_fcgi:error] [pid 427517:tid 139768315668032] [client 52.141.18.191:10206] AH01071: Got error 'Primary script unknown' [Tue Feb 24 17:05:51.653307 2026] [proxy_fcgi:error] [pid 427517:tid 139768332453440] [client 52.141.18.191:10206] AH01071: Got error 'Primary script unknown' ... show less	Web App Attack
🇳🇱 Mangelot Hosting	2026-02-24 15:08:48 (4 months ago)	(upload_shell) srv103 Shell upload 52.141.18.191 (KR/South Korea/-): 1 in the last 3600 secs; Ports: ... show more (upload_shell) srv103 Shell upload 52.141.18.191 (KR/South Korea/-): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: show less	Web App Attack
🇫🇮 Christopher Hughes	2026-02-24 14:54:25 (4 months ago)	[Tue Feb 24 14:54:23.185168 2026] [proxy_fcgi:error] [pid 427517:tid 139768324060736] [client 52.141 ... show more [Tue Feb 24 14:54:23.185168 2026] [proxy_fcgi:error] [pid 427517:tid 139768324060736] [client 52.141.18.191:8065] AH01071: Got error 'Primary script unknown' [Tue Feb 24 14:54:23.442528 2026] [proxy_fcgi:error] [pid 427517:tid 139767958201920] [client 52.141.18.191:8065] AH01071: Got error 'Primary script unknown' [Tue Feb 24 14:54:23.984261 2026] [proxy_fcgi:error] [pid 427517:tid 139767949809216] [client 52.141.18.191:8065] AH01071: Got error 'Primary script unknown' [Tue Feb 24 14:54:24.241433 2026] [proxy_fcgi:error] [pid 427517:tid 139768092419648] [client 52.141.18.191:8065] AH01071: Got error 'Primary script unknown' [Tue Feb 24 14:54:24.755145 2026] [proxy_fcgi:error] [pid 427517:tid 139767916238400] [client 52.141.18.191:8065] AH01071: Got error 'Primary script unknown' ... show less	Web App Attack
🇦🇹 penguin-solutions.at	2026-02-24 14:37:28 (4 months ago)	Excessive 403/404 errors ...	Brute-Force Web App Attack
🇪🇸 el-brujo	2026-02-24 14:30:47 (4 months ago)	Cloudflare WAF: Request Path: /xmlrpc.php Request Query: Host: hwagm.elhacker.net userAgent: Mozill ... show more Cloudflare WAF: Request Path: /xmlrpc.php Request Query: Host: hwagm.elhacker.net userAgent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Action: managed_challenge Source: firewallManaged ASN Description: MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation Country: KR Method: GET Timestamp: 2026-02-24T14:30:47Z ruleId: 5de7edfa648c4d6891dc3e7f84534ffa. Report generated by Cloudflare-WAF-to-AbuseIPDB (https://github.com/MHG-LAB/Cloudflare-WAF-to-AbuseIPDB). show less	Hacking SQL Injection Web App Attack
🇩🇪 Dennis	2026-02-24 14:02:45 (4 months ago)	52.141.18.191 has been banned for triggering http-probing (11 events over 2.326033069s).	Brute-Force Web App Attack

Showing 1 to 15 of 438 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇭🇰 165.154.42.209

🇻🇳 103.221.220.62

🇸🇬 101.47.159.50

🇨🇳 60.29.128.122

🇺🇸 2604:4500:6:26:1c00:3aff:fe00:10d

🇵🇱 176.53.159.197

🇳🇱 158.94.210.171

🇹🇭 118.193.57.59

🇵🇰 103.120.71.217

🇺🇸 34.73.217.140

🇷🇴 193.46.255.86

🇵🇾 181.124.196.115

🇨🇳 101.201.104.216

🇺🇸 98.97.49.157

🇺🇸 66.132.224.18

🇳🇱 45.148.10.183

🇺🇸 20.168.7.10

🇺🇸 18.236.189.2

🇧🇴 190.181.27.37

🇮🇩 103.245.38.203