🇺🇸
ISPLtd
2026-07-25 09:59:27
(4 hours ago)
Jul 25 06:59:26 52.154.21.49 TCP SPT=18503 DPT=2095 SYN
Jul 25 06:59:26 52.154.21.49 TCP SPT=18502 D ...
show more
Jul 25 06:59:26 52.154.21.49 TCP SPT=18503 DPT=2095 SYN
Jul 25 06:59:26 52.154.21.49 TCP SPT=18502 DPT=2077 SYN
Jul 25 06:59:26 52.154.21.49 TCP SPT=18510 DPT=2096 SYN
...
show less
Port Scan
2026-07-25 09:47:09
(4 hours ago)
denied traffic to a honeypot network. destination port 2082.
Port Scan
Hacking
🇦🇺
crispi
2026-07-25 09:44:36
(4 hours ago)
Port scan from 52.154.21.49
Port Scan
2026-07-01 11:21:02
(3 weeks ago)
Tried our host z.
Port Scan
Hacking
Exploited Host
🇧🇷
ludarkstar99
2026-07-01 09:30:11
(3 weeks ago)
Blocked by os-abuseipdb; 16 hits, proto=tcp, ports=2082,2083,2086,2087,443,80,8080,8443
Port Scan
Hacking
🇺🇸
TPI-Abuse
2026-07-01 08:01:57
(3 weeks ago)
(mod_security) mod_security (id:949110) triggered by 52.154.21.49 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:949110) triggered by 52.154.21.49 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jul 01 04:01:53.315718 2026] [security2:error] [pid 31824:tid 31824] [client 52.154.21.49:35404] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "192.64.150.240"] [uri "/.git/refs/heads/master"] [unique_id "akTJcW4bI57Z6VPFNd_4mAAAAAQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
RAP
2026-06-11 08:47:28
(1 month ago)
2026-06-11 08:47:28 UTC Unauthorized activity to TCP port 8443. Web App
Port Scan
Web App Attack
🇯🇵
mkaraki
2026-06-11 08:00:01
(1 month ago)
1781164800 # Service_probe # SIGNATURE_SEND # source_ip:52.154.21.49 # dst_port:8880
...
Port Scan
🇺🇸
xmission.com
2026-06-11 07:09:17
(1 month ago)
Blocked by UFW (TCP on 8880)
Source port: 47112
TTL: 51
Packet length: 60
TOS: 0x00
This report (fo ...
show more
Blocked by UFW (TCP on 8880)
Source port: 47112
TTL: 51
Packet length: 60
TOS: 0x00
This report (for 52.154.21.49) was generated by:
https://github.com/sefinek/UFW-AbuseIPDB-Reporter
show less
Port Scan
🇺🇸
RAP
2026-06-11 06:20:09
(1 month ago)
2026-06-11 06:20:09 UTC Unauthorized activity to TCP port 8080. Web App
Port Scan
Web App Attack
🇯🇵
jay hung
2026-06-10 04:58:19
(1 month ago)
2026-06-10T04:58:18.365675+00:00 quarktech kernel: [902340.662919] [UFW BLOCK] IN=eth0 OUT= MAC=22:0 ...
show more
2026-06-10T04:58:18.365675+00:00 quarktech kernel: [902340.662919] [UFW BLOCK] IN=eth0 OUT= MAC=22:00:92:2e:84:93:fe:ff:ff:ff:ff:ff:08:00 SRC=52.154.21.49 DST=172.237.20.248 LEN=40 TOS=0x00 PREC=0x00 TTL=106 ID=1 DF PROTO=TCP SPT=18444 DPT=443 WINDOW=0 RES=0x00 ACK RST URGP=0
...
show less
Port Scan
🇺🇸
TPI-Abuse
2026-05-27 08:06:08
(1 month ago)
(mod_security) mod_security (id:210492) triggered by 52.154.21.49 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:210492) triggered by 52.154.21.49 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed May 27 04:06:01.873759 2026] [security2:error] [pid 10180:tid 10180] [client 52.154.21.49:30728] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "kirt.us"] [uri "/config/.env"] [unique_id "ahal6Zk1_xsti1R0MTmLGQAAAA8"], referer: https://outlook.live.com/
show less
Brute-Force
Bad Web Bot
Web App Attack
🇬🇧
Axel
2026-05-27 06:26:53
(1 month ago)
Blocked by ModSecurity. Rule ID: 210492 Message: None Phase: 1 Severity: CRITICAL URI: /.git/config ...
show more
Blocked by ModSecurity. Rule ID: 210492 Message: None Phase: 1 Severity: CRITICAL URI: /.git/config Server: UK-01
show less
Web App Attack
Hacking
SQL Injection
2026-05-27 05:48:30
(1 month ago)
Excessive 404 errors - web scanning/probing
Bad Web Bot
🇺🇸
Rayulcifer
2026-04-16 12:20:00
(3 months ago)
52.154.21.49 - - [16/Apr/2026:07:19:56 -0500] "CONNECT graph.vshield.pro:443 HTTP/1.1" 502 488 "-" " ...
show more
52.154.21.49 - - [16/Apr/2026:07:19:56 -0500] "CONNECT graph.vshield.pro:443 HTTP/1.1" 502 488 "-" "-"
52.154.21.49 - - [16/Apr/2026:07:19:56 -0500] "\x16\x03\x01" 400 392 "-" "-"
...
show less
Open Proxy
Port Scan
Hacking
Web App Attack
SSH