JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 52.156.104.237

52.156.104.237 was found in our database!

This IP was reported 13 times. Confidence of Abuse is 43%: ?

43%

ISP	Microsoft Corporation
Usage Type	Data Center/Web Hosting/Transit
ASN	AS8075
Domain Name	microsoft.com
Country	🇺🇸 United States of America
City	Moses Lake, Washington

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 52.156.104.237

Whois 52.156.104.237

IP Abuse Reports for 52.156.104.237:

This IP address has been reported a total of 13 times from 6 distinct sources. 52.156.104.237 was first reported on July 27th 2026, and the most recent report was 22 hours ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇩🇪 anycast_ac	2026-07-28 19:37:45 (22 hours ago)	[mirai-detector honeypot] Inbound attack against our honeypot on tcp/9050 (socks). Tried credentials ... show more [mirai-detector honeypot] Inbound attack against our honeypot on tcp/9050 (socks). Tried credentials: b'madison':b'madison' Family fingerprint: proxy-scanner Commands captured: $ socks5 methods offered: ['no-auth', 'user/pass'] $ socks5 auth: 'madison' : 'madison' show less	DDoS Attack
🇩🇪 anycast_ac	2026-07-28 15:22:32 (1 day ago)	[mirai-detector honeypot] Inbound attack against our honeypot on tcp/9050 (socks). Tried credentials ... show more [mirai-detector honeypot] Inbound attack against our honeypot on tcp/9050 (socks). Tried credentials: b'alexander':b'alexander' Family fingerprint: proxy-scanner Commands captured: $ socks5 methods offered: ['no-auth', 'user/pass'] $ socks5 auth: 'alexander' : 'alexander' show less	DDoS Attack
🇩🇪 anycast_ac	2026-07-28 14:16:44 (1 day ago)	[mirai-detector honeypot] Inbound attack against our honeypot on tcp/9050 (socks). Tried credentials ... show more [mirai-detector honeypot] Inbound attack against our honeypot on tcp/9050 (socks). Tried credentials: b'victor':None Family fingerprint: proxy-scanner Commands captured: $ socks4 CONNECT -> 104.26.12.205:443 $ user_id: 'victor' show less	DDoS Attack
🇩🇪 anycast_ac	2026-07-28 00:49:47 (1 day ago)	[mirai-detector honeypot] Inbound attack against our honeypot on tcp/9050 (socks). Tried credentials ... show more [mirai-detector honeypot] Inbound attack against our honeypot on tcp/9050 (socks). Tried credentials: b'madison':None Family fingerprint: proxy-scanner Commands captured: $ socks4a CONNECT -> api.ipify.org:443 $ user_id: 'madison' show less	DDoS Attack
🇩🇪 femboy.cat	2026-07-27 19:40:01 (1 day ago)	Port scan to tcp/1111 from 52.156.104.237	Brute-Force
🇺🇸 bigscoots.com	2026-07-27 18:13:24 (1 day ago)	52.156.104.237 (US/United States/-), 5 distributed sshd attacks on account [ubuntu] in the last 3600 ... show more 52.156.104.237 (US/United States/-), 5 distributed sshd attacks on account [ubuntu] in the last 3600 secs; Ports: *; Direction: 1; Trigger: LF_DISTATTACK; Logs: Jul 27 13:03:26 15736 sshd[19831]: Invalid user ubuntu from 92.169.226.130 port 53176 Jul 27 13:03:28 15736 sshd[19831]: Failed password for invalid user ubuntu from 92.169.226.130 port 53176 ssh2 Jul 27 13:13:11 15736 sshd[26237]: Invalid user ubuntu from 52.156.104.237 port 41258 Jul 27 12:58:39 15736 sshd[16654]: Invalid user ubuntu from 197.248.233.55 port 61107 Jul 27 12:58:40 15736 sshd[16654]: Failed password for invalid user ubuntu from 197.248.233.55 port 61107 ssh2 IP Addresses Blocked: 92.169.226.130 (FR/France/lfbn-idf2-1-1423-130.w92-169.abo.wanadoo.fr) show less	Brute-Force SSH
🇺🇸 bigscoots.com	2026-07-27 16:06:58 (2 days ago)	52.156.104.237 (US/United States/-), 5 distributed sshd attacks on account [ubuntu] in the last 3600 ... show more 52.156.104.237 (US/United States/-), 5 distributed sshd attacks on account [ubuntu] in the last 3600 secs; Ports: *; Direction: 1; Trigger: LF_DISTATTACK; Logs: Jul 27 11:06:38 14967 sshd[8525]: Invalid user ubuntu from 43.155.86.225 port 58053 Jul 27 11:01:40 14967 sshd[8022]: Invalid user ubuntu from 57.153.84.77 port 50572 Jul 27 11:01:42 14967 sshd[8022]: Failed password for invalid user ubuntu from 57.153.84.77 port 50572 ssh2 Jul 27 10:56:32 14967 sshd[7516]: Invalid user ubuntu from 52.156.104.237 port 56332 Jul 27 10:56:34 14967 sshd[7516]: Failed password for invalid user ubuntu from 52.156.104.237 port 56332 ssh2 IP Addresses Blocked: 43.155.86.225 (HK/Hong Kong/-) 57.153.84.77 (NL/The Netherlands/-) show less	Brute-Force SSH
🇩🇪 invalidLuca	2026-07-27 16:04:06 (2 days ago)	[SSH2] Unauthorized connection attempt from 52.156.104.237	Brute-Force SSH
🇺🇸 bigscoots.com	2026-07-27 15:46:55 (2 days ago)	52.156.104.237 (US/United States/-), 5 distributed sshd attacks on account [ubuntu] in the last 3600 ... show more 52.156.104.237 (US/United States/-), 5 distributed sshd attacks on account [ubuntu] in the last 3600 secs; Ports: *; Direction: 1; Trigger: LF_DISTATTACK; Logs: Jul 27 10:02:37 14140 sshd[17160]: Invalid user ubuntu from 52.156.104.237 port 53868 Jul 27 10:02:40 14140 sshd[17160]: Failed password for invalid user ubuntu from 52.156.104.237 port 53868 ssh2 Jul 27 10:32:10 14140 sshd[1041]: Invalid user ubuntu from 144.79.133.90 port 57858 Jul 27 10:32:12 14140 sshd[1041]: Failed password for invalid user ubuntu from 144.79.133.90 port 57858 ssh2 Jul 27 10:46:47 14140 sshd[8997]: Invalid user ubuntu from 154.90.37.55 port 49432 IP Addresses Blocked: show less	Brute-Force SSH
🇺🇸 drewf.ink	2026-07-27 13:29:52 (2 days ago)	[13:29] Attempted SSH login with credentials root:ab******6!	Brute-Force SSH
🇩🇪 Bigbear3	2026-07-27 12:06:21 (2 days ago)	Report-by-bigbear3	Brute-Force SSH
🇺🇸 drewf.ink	2026-07-27 11:47:41 (2 days ago)	[11:47] Attempted SSH login with credentials root:zx*****SD	Brute-Force SSH
🇺🇸 bigscoots.com	2026-07-27 10:48:11 (2 days ago)	52.156.104.237 (US/United States/-), 5 distributed sshd attacks on account [root] in the last 3600 s ... show more 52.156.104.237 (US/United States/-), 5 distributed sshd attacks on account [root] in the last 3600 secs; Ports: *; Direction: 1; Trigger: LF_DISTATTACK; Logs: Jul 27 05:39:14 14190 sshd[12505]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=52.156.104.237 user=root Jul 27 05:39:16 14190 sshd[12505]: Failed password for root from 52.156.104.237 port 46536 ssh2 Jul 27 05:47:50 14190 sshd[16867]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.166.153.18 user=root Jul 27 05:43:34 14190 sshd[14692]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=154.57.213.93 user=root Jul 27 05:43:36 14190 sshd[14692]: Failed password for root from 154.57.213.93 port 51676 ssh2 IP Addresses Blocked: show less	Brute-Force SSH

Showing 1 to 13 of 13 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇩🇪 213.209.159.108

🇨🇳 58.255.34.3

🇺🇸 47.89.247.18

🇨🇳 203.110.233.225

🇺🇸 195.184.76.67

🇺🇸 195.184.76.34

🇧🇷 191.183.37.205

🇧🇷 189.56.0.19

🇨🇳 183.6.64.180

🇸🇬 172.217.44.220

🇺🇸 162.216.18.113

🇵🇰 154.192.128.231

🇨🇳 123.145.12.44

🇨🇳 116.181.10.110

🇺🇸 20.65.193.163

🇨🇳 14.103.127.233

🇧🇴 190.129.122.12

🇲🇽 189.245.244.46

🇪🇨 177.53.215.134

🇮🇳 165.101.250.39