JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 52.152.180.198

52.152.180.198 was found in our database!

This IP was reported 29 times. Confidence of Abuse is 73%: ?

73%

ISP	Microsoft Corporation
Usage Type	Data Center/Web Hosting/Transit
ASN	AS8075
Domain Name	microsoft.com
Country	🇺🇸 United States of America
City	Washington, Virginia

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 52.152.180.198

Whois 52.152.180.198

IP Abuse Reports for 52.152.180.198:

This IP address has been reported a total of 29 times from 24 distinct sources. 52.152.180.198 was first reported on April 11th 2026, and the most recent report was 3 weeks ago.

Old Reports: The most recent abuse report for this IP address is from 3 weeks ago . It is possible that this IP is no longer involved in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇺🇸 gu-alvareza	2026-06-03 07:05:24 (3 weeks ago)	Spring.Boot.Actuator.Unauthorized.Access	Brute-Force
🇦🇹 urnilxfgbez	2026-06-02 22:45:00 (3 weeks ago)	Last 24 Hours suspicious: (DPT=445\|DPT=3389\|DPT=22\|DPT=3306\|DPT=8080\|DPT=23\|DPT=5900\|DPT=1433)	Port Scan
🇺🇸 xmission.com	2026-06-02 22:11:57 (3 weeks ago)	Blocked by UFW (TCP on 2083) Source port: 21568 TTL: 48 Packet length: 60 TOS: 0x00 This report (fo ... show more Blocked by UFW (TCP on 2083) Source port: 21568 TTL: 48 Packet length: 60 TOS: 0x00 This report (for 52.152.180.198) was generated by: https://github.com/sefinek/UFW-AbuseIPDB-Reporter show less	Port Scan
🇺🇸 TPI-Abuse	2026-06-02 21:57:24 (3 weeks ago)	(mod_security) mod_security (id:210492) triggered by 52.152.180.198 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210492) triggered by 52.152.180.198 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jun 02 17:57:17.178869 2026] [security2:error] [pid 27720:tid 27735] [client 52.152.180.198:34090] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "192.64.150.124"] [uri "/.git/HEAD"] [unique_id "ah9RvSeUPVZtHKUoPm4GvQAAAIo"] show less	Brute-Force Bad Web Bot Web App Attack
Anonymous	2026-06-02 21:52:56 (3 weeks ago)	Reported from Nginx log analysis 16. Log: 52.152.180.198 - - [02/Jun/2026:xx:xx:xx 0200] "GET /.git ... show more Reported from Nginx log analysis 16. Log: 52.152.180.198 - - [02/Jun/2026:xx:xx:xx 0200] "GET /.git/HEAD HTTP/1.1" xxx xxx "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36" "-" "US United States Washington" "AS8075" "Microsoft Corporation" show less	Port Scan Brute-Force SSH
🇮🇹 A000Z	2026-06-02 21:39:06 (3 weeks ago)	Fail2Ban: 52.152.180.198 was banned for Aggressive Bad Bot detected by Nginx/Fail2Ban. UA: Mozilla/5 ... show more Fail2Ban: 52.152.180.198 was banned for Aggressive Bad Bot detected by Nginx/Fail2Ban. UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0 show less	Bad Web Bot
🇺🇸 mnsf	2026-06-02 21:06:14 (3 weeks ago)	Too many Status 50X (22)	Brute-Force Web App Attack
🇬🇧 PeravixGroup	2026-06-02 20:56:52 (3 weeks ago)	Honeypot detection: Web application scanning / reconnaissance attempt on port 8080. Severity: LOW. A ... show more Honeypot detection: Web application scanning / reconnaissance attempt on port 8080. Severity: LOW. Aaran.cloud show less	Port Scan Bad Web Bot
Anonymous	2026-06-02 20:22:23 (3 weeks ago)	Probing for known exploit paths (.env, .git, wp-admin, shell files, etc.). Single-strike ban policy ... show more Probing for known exploit paths (.env, .git, wp-admin, shell files, etc.). Single-strike ban policy — zero tolerance for exploit scanning. Banned Jun 2, 20:22 UTC. Origin: United States, Washington. show less	Hacking Bad Web Bot Web App Attack
🇺🇸 RAP	2026-06-02 20:20:01 (3 weeks ago)	2026-06-02 20:20:01 UTC Unauthorized activity to TCP port 8080. Web App	Port Scan Web App Attack
🇫🇮 6kilowatti	2026-06-02 20:13:16 (3 weeks ago)	2026-06-02T23:13:15.226622+03:00 oh6ah kernel: [UFW BLOCK] IN=enp2s0 OUT= MAC=00:26:18:a8:d6:75:2e:2 ... show more 2026-06-02T23:13:15.226622+03:00 oh6ah kernel: [UFW BLOCK] IN=enp2s0 OUT= MAC=00:26:18:a8:d6:75:2e:2d:5e:71:aa:73:08:00 SRC=52.152.180.198 DST=192.168.0.102 LEN=60 TOS=0x00 PREC=0x00 TTL=45 ID=14966 DF PROTO=TCP SPT=33959 DPT=8443 WINDOW=64240 RES=0x00 SYN URGP=0 ... show less	Port Scan
🇺🇸 kosada.com	2026-06-02 20:04:52 (3 weeks ago)	Web vulnerability probing: /.env.backup (bogus vhost/SNI)	Web App Attack
🇺🇸 xmission.com	2026-06-02 19:58:34 (3 weeks ago)	Blocked by UFW (TCP on 2087) Source port: 21552 TTL: 111 Packet length: 40 TOS: 0x00 This report (f ... show more Blocked by UFW (TCP on 2087) Source port: 21552 TTL: 111 Packet length: 40 TOS: 0x00 This report (for 52.152.180.198) was generated by: https://github.com/sefinek/UFW-AbuseIPDB-Reporter show less	Port Scan
🇺🇸 TPI-Abuse	2026-06-02 18:24:52 (3 weeks ago)	(mod_security) mod_security (id:210492) triggered by 52.152.180.198 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210492) triggered by 52.152.180.198 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jun 02 14:24:48.957775 2026] [security2:error] [pid 18268:tid 18356] [client 52.152.180.198:34511] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "192.64.150.18"] [uri "/.git/HEAD"] [unique_id "ah8f8HedKbtR04LSrcmYSAAAAIs"] show less	Brute-Force Bad Web Bot Web App Attack
🇩🇪 tall1oN	2026-06-02 17:56:18 (3 weeks ago)	52.152.180.198 - - [02/Jun/2026:19:56:15 +0200] "GET /.git/HEAD HTTP/1.1" 200 4096 "-" "Mozilla/5.0 ... show more 52.152.180.198 - - [02/Jun/2026:19:56:15 +0200] "GET /.git/HEAD HTTP/1.1" 200 4096 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_4_1) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.4 Safari/605.1.15" "178.20.92.35" 52.152.180.198 - - [02/Jun/2026:19:56:17 +0200] "GET /.git/config HTTP/1.1" 200 4096 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_4_1) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.4 Safari/605.1.15" "178.20.92.35" ... show less	Web App Attack Port Scan Hacking

Showing 1 to 15 of 29 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇨🇳 221.8.22.30

🇧🇷 200.222.100.134

🇧🇷 177.154.231.246

🇮🇳 152.57.13.85

🇳🇱 45.148.10.147

🇷🇺 45.89.67.68

🇧🇷 200.187.130.246

🇮🇹 185.30.47.121

🇯🇵 43.167.187.11

🇺🇸 13.89.125.21

🇦🇺 220.240.104.100

🇰🇷 219.248.65.30

🇭🇰 156.245.239.180

🇰🇭 124.248.167.50

🇨🇳 124.115.65.228

🇺🇸 91.209.228.51

🇳🇱 91.92.40.13

🇺🇸 65.49.1.218

🇺🇸 24.253.154.24

🇨🇦 20.63.8.12