JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 52.154.20.194

52.154.20.194 was found in our database!

This IP was reported 41 times. Confidence of Abuse is 100%: ?

100%

ISP	Microsoft Corporation
Usage Type	Data Center/Web Hosting/Transit
ASN	AS8075
Domain Name	microsoft.com
Country	🇺🇸 United States of America
City	Des Moines, Iowa

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 52.154.20.194

Whois 52.154.20.194

IP Abuse Reports for 52.154.20.194:

This IP address has been reported a total of 41 times from 31 distinct sources. 52.154.20.194 was first reported on August 8th 2025, and the most recent report was 1 day ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇺🇸 TPI-Abuse	2026-06-11 20:20:45 (1 day ago)	(mod_security) mod_security (id:225170) triggered by 52.154.20.194 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:225170) triggered by 52.154.20.194 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jun 11 16:20:38.231298 2026] [security2:error] [pid 16106:tid 16106] [client 52.154.20.194:45224] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)\|\|www.peacecampus.org\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "www.peacecampus.org"] [uri "/wp-json/wp/v2/users/"] [unique_id "aisYlq5eCRR5YuqRUmtobwAAAAE"] show less	Brute-Force Bad Web Bot Web App Attack
🇧🇪 cmbplf	2026-06-11 20:04:55 (1 day ago)	4.270 requests from abuseipdb.com blacklisted IP (3mos2w3d)	Brute-Force Bad Web Bot
🇧🇪 taivas.nl	2026-06-11 20:02:12 (1 day ago)	Wordpress_xmlrpc_attack	Bad Web Bot
🇵🇱 tomkolp	2026-06-11 20:00:02 (1 day ago)	CSF/LFD block: XMLRPC - WP XMLPRC Attack 52.154.20.194 (US/United States/-): 5 in the last 3600 secs	Bad Web Bot Web App Attack Hacking
Anonymous	2026-06-11 19:48:58 (1 day ago)	(wordpress) Failed wordpress login from 52.154.20.194 (US/United States/Iowa/Des Moines/-/[redacted] ... show more (wordpress) Failed wordpress login from 52.154.20.194 (US/United States/Iowa/Des Moines/-/[redacted]) show less	Brute-Force
🇩🇪 LRob.fr	2026-06-11 19:45:20 (1 day ago)	Repeated requests on blocked xmlrpc.php, blocked by fail2ban in custom-503-xmlrpc jail	Bad Web Bot Web App Attack
Anonymous	2026-06-11 19:28:43 (1 day ago)	Failed Wordpress Logins	Web App Attack
🇮🇹 Inartis	2026-06-11 19:22:15 (1 day ago)	52.154.20.194 - - [11/Jun/2026:21:22:14 +0200] "POST /xmlrpc.php HTTP/2.0" 403 253 "-" "Mozilla/5.0 ... show more 52.154.20.194 - - [11/Jun/2026:21:22:14 +0200] "POST /xmlrpc.php HTTP/2.0" 403 253 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.124 Safari/537.37" ... show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-06-11 19:15:37 (1 day ago)	(mod_security) mod_security (id:225170) triggered by 52.154.20.194 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:225170) triggered by 52.154.20.194 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jun 11 15:15:33.287530 2026] [security2:error] [pid 7759:tid 7759] [client 52.154.20.194:45573] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)\|\|www.wholesalelivelobsters.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "www.wholesalelivelobsters.com"] [uri "/wp-json/wp/v2/users/"] [unique_id "aisJVQPxHLqYWMFzLFhaLQAAABs"] show less	Brute-Force Bad Web Bot Web App Attack
🇵🇱 tomkolp	2026-06-11 19:10:53 (1 day ago)	CrowdSec - Scenario: crowdsecurity/http-bf-wordpress_bf_xmlrpc. Duration: 4h.	Brute-Force Web App Attack
🇳🇱 Site.eu	2026-06-11 19:08:41 (1 day ago)	Repeated wp-login/xmlrpc attempts	Brute-Force SSH
🇫🇮 bittiguru.fi	2026-06-11 19:05:54 (1 day ago)	52.154.20.194 - [11/Jun/2026:22:05:52 +0300] "POST /xmlrpc.php HTTP/2.0" 404 7296 "-" "Mozilla/5.0 ( ... show more 52.154.20.194 - [11/Jun/2026:22:05:52 +0300] "POST /xmlrpc.php HTTP/2.0" 404 7296 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.124 Safari/537.37" "4.02" 52.154.20.194 - [11/Jun/2026:22:05:53 +0300] "POST /wp/xmlrpc.php HTTP/2.0" 403 742 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.124 Safari/537.37" "2.37" ... show less	Hacking Brute-Force Web App Attack
Anonymous	2026-06-11 18:55:56 (1 day ago)	[redacted] 52.154.20.194 - - [11/Jun/2026:20:55:53 +0200] "POST /xmlrpc.php HTTP/2.0" 405 428 "-" "M ... show more [redacted] 52.154.20.194 - - [11/Jun/2026:20:55:53 +0200] "POST /xmlrpc.php HTTP/2.0" 405 428 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.124 Safari/537.37" [redacted] 52.154.20.194 - - [11/Jun/2026:20:55:54 +0200] "POST /xmlrpc.php HTTP/2.0" 405 428 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.124 Safari/537.36" [redacted] 52.154.20.194 - - [11/Jun/2026:20:55:55 +0200] "POST /xmlrpc.php HTTP/2.0" 405 428 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.124 Safari/537.36" [redacted] 52.154.20.194 - - [11/Jun/2026:20:55:55 +0200] "POST /xmlrpc.php HTTP/2.0" 405 428 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.124 Safari/537.36" [redacted] 52.154.20.194 - - [11/Jun/2026:20:55:55 +0200] "POST /xmlrpc.php HTTP/2.0" 405 428 "-" "Mozilla/5.0 (Windo ... show less	Hacking Web App Attack
🇺🇸 TPI-Abuse	2026-06-11 18:49:59 (1 day ago)	(mod_security) mod_security (id:225170) triggered by 52.154.20.194 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:225170) triggered by 52.154.20.194 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jun 11 14:49:54.047377 2026] [security2:error] [pid 23371:tid 23371] [client 52.154.20.194:45756] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)\|\|www.caddydad.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "www.caddydad.com"] [uri "/wp-json/wp/v2/users/"] [unique_id "aisDUtxyAiO1KscwpwidLwAAAAo"] show less	Brute-Force Bad Web Bot Web App Attack
🇵🇱 sefinek.net	2026-06-11 18:49:05 (1 day ago)	Triggered Cloudflare WAF (firewallCustom) from US. Action: MANAGED_CHALLENGE \| Protocol: HTTP/2 (GET ... show more Triggered Cloudflare WAF (firewallCustom) from US. Action: MANAGED_CHALLENGE \| Protocol: HTTP/2 (GET) \| Endpoint: / \| UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.124 Safari/537.36 • Generated by: github.com/sefinek/Cloudflare-WAF-To-AbuseIPDB show less	Bad Web Bot

Showing 1 to 15 of 41 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇹🇼 198.235.24.46

🇮🇳 159.65.148.75

🇫🇷 91.231.89.64

🇱🇹 45.227.254.170

🇨🇦 4.206.92.183

🇩🇪 87.106.210.86

🇩🇪 47.245.143.8

🇸🇬 43.128.120.247

🇷🇴 2.57.121.25

🇳🇱 195.178.110.30

🇩🇪 188.101.162.157

🇨🇳 113.117.73.117

🇭🇰 103.226.124.223

🇺🇦 93.171.247.130

🇷🇸 93.87.41.36

🇩🇪 2.26.1.31

🇧🇷 205.210.31.224

🇨🇳 183.222.230.188

🇯🇵 101.33.55.172

🇺🇸 9.234.8.54