JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 52.159.244.71

52.159.244.71 was found in our database!

This IP was reported 50 times. Confidence of Abuse is 72%: ?

72%

ISP	Microsoft Corporation
Usage Type	Data Center/Web Hosting/Transit
ASN	AS8075
Domain Name	microsoft.com
Country	🇺🇸 United States of America
City	San Jose, California

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 52.159.244.71

Whois 52.159.244.71

IP Abuse Reports for 52.159.244.71:

This IP address has been reported a total of 50 times from 41 distinct sources. 52.159.244.71 was first reported on December 6th 2025, and the most recent report was 1 day ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇷🇸 Scan	2026-07-26 00:19:44 (1 day ago)	MultiHost/MultiPort Probe, Scan, Hack -	Port Scan Hacking
🇪🇸 bohl-aiG5aef	2026-07-25 23:50:41 (1 day ago)	Suricata Alert [SID:2019526] ET WEB_SERVER WEB-PHP phpinfo access	Web App Attack
🇩🇪 kivitendo.de	2026-07-25 23:38:26 (1 day ago)	{"reqId":"8x44Y9Lh9LHBp3G2qUhP","level":1,"time":"2026-07-25T23:38:14+00:00","remoteAddr":"52.159.24 ... show more {"reqId":"8x44Y9Lh9LHBp3G2qUhP","level":1,"time":"2026-07-25T23:38:14+00:00","remoteAddr":"52.159.244.71","user":"--","app":"core","method":"GET","url":"/.git/HEAD","scriptName":"/index.php","message":"Trusted domain error. \"52.159.244.71\" tried to access using \"37.24.44.97\" as host.","userAgent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 14_4_1) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.4 Safari/605.1.15","version":"32.0.12.1","data":{"app":"core"}} {"reqId":"4qUpyncP5xkNZdUy2Hpm","level":1,"time":"2026-07-25T23:38:19+00:00","remoteAddr":"52.159.244.71","user":"--","app":"core","method":"GET","url":"/.git/logs/HEAD","scriptName":"/index.php","message":"Trusted domain error. \"52.159.244.71\" tried to access using \"37.24.44.97\" as host.","userAgent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 14_4_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36","version":"32.0.12.1","data":{"app":"core"}} {"reqId":"96szO4ouAQvCrL6Jn3xc","level":1,"time":"2026-07-25T23 ... show less	Brute-Force Web App Attack
🇺🇸 sumnone	2026-07-25 22:46:43 (1 day ago)	Port probing on unauthorized port 2078	Port Scan Hacking Exploited Host
🇩🇪 initsol	2026-07-25 21:44:10 (1 day ago)	[Sat Jul 25 23:43:57.187601 2026] [php:error] [pid 1851564:tid 1851564] [client 52.159.244.71:65185] ... show more [Sat Jul 25 23:43:57.187601 2026] [php:error] [pid 1851564:tid 1851564] [client 52.159.244.71:65185] script '/var/www/html/wp-config.php' not found or unable to stat [Sat Jul 25 23:44:09.130194 2026] [php:error] [pid 1830837:tid 1830837] [client 52.159.244.71:65169] script '/var/www/html/phpinfo.php' not found or unable to stat [Sat Jul 25 23:44:10.554096 2026] [php:error] [pid 1830838:tid 1830838] [client 52.159.244.71:65155] script '/var/www/html/info.php' not found or unable to stat ... show less	Brute-Force
🇺🇸 mnsf	2026-07-25 20:05:06 (1 day ago)	Too many Status 50X (24) Scanning/Probing (17)	Brute-Force Web App Attack
🇬🇧 rakkor	2026-07-25 19:12:02 (1 day ago)	2026-07-25T20:12:01+01:00 NAS [Sat Jul 25 20:12:01.901575 2026] [authz_core:error] [pid 4639:tid 465 ... show more 2026-07-25T20:12:01+01:00 NAS [Sat Jul 25 20:12:01.901575 2026] [authz_core:error] [pid 4639:tid 4655] [client 52.159.244.71:51904] AH01630: client denied by server configuration: /var/services/web/.htpasswd ... show less	Brute-Force Hacking
Anonymous	2026-07-02 04:04:34 (3 weeks ago)	PORT & IP Scan.	Port Scan Brute-Force
🇩🇪 fleckenbase	2026-07-02 03:44:38 (3 weeks ago)	apache-noscript ...	Brute-Force Web App Attack
🇵🇱 Wepted	2026-07-02 03:08:14 (3 weeks ago)	Port scan detected by honeypot	Port Scan Hacking
🇷🇸 Scan	2026-07-02 02:13:48 (3 weeks ago)	MultiHost/MultiPort Probe, Scan, Hack -	Port Scan Hacking
🇯🇵 SentinalX by uzumaru	2026-06-30 03:47:11 (3 weeks ago)	Detected by SentinelX honeypot: sent HTTP CONNECT request probing for an open proxy. Connection was ... show more Detected by SentinelX honeypot: sent HTTP CONNECT request probing for an open proxy. Connection was hijacked and held in a tarpit to slow down the scan. Probed target: ptlogin.4399.com:443 show less	Open Proxy Port Scan
🇺🇸 TPI-Abuse	2026-06-29 13:24:17 (3 weeks ago)	(mod_security) mod_security (id:210492) triggered by 52.159.244.71 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:210492) triggered by 52.159.244.71 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jun 29 09:24:09.905129 2026] [security2:error] [pid 13083:tid 13087] [client 52.159.244.71:28418] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "192.64.150.82"] [uri "/.git/HEAD"] [unique_id "akJx-VFj7tatVV5EQ52CXQAAAEI"] show less	Brute-Force Bad Web Bot Web App Attack
🇳🇱 Savvii	2026-06-29 11:31:35 (3 weeks ago)	15 attempts against mh-modsecurity-ban on hostbillst	Brute-Force Web App Attack
🇧🇪 delabiemedia.be	2026-06-27 01:34:10 (1 month ago)	52.159.244.71 - - [27/Jun/2026:03:34:07 +0200] "GET /.git/HEAD HTTP/1.1" 404 196 "-" "Mozilla/5.0 (M ... show more 52.159.244.71 - - [27/Jun/2026:03:34:07 +0200] "GET /.git/HEAD HTTP/1.1" 404 196 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36" 52.159.244.71 - - [27/Jun/2026:03:34:09 +0200] "GET /.git/config HTTP/1.1" 404 196 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36" ... show less	Web App Attack

Showing 1 to 15 of 50 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇳🇱 212.8.242.38

🇺🇸 173.239.218.85

🇮🇩 114.10.101.46

🇺🇸 44.201.127.28

🇺🇸 2604:a880:400:d1:0:4:6c6e:2001

🇰🇷 222.99.237.249

🇻🇳 171.251.238.10

🇸🇬 146.190.82.219

🇻🇳 113.170.154.118

🇧🇩 103.148.52.244

🇺🇸 91.230.168.213

🇺🇸 85.239.151.10

🇱🇧 80.83.30.196

🇯🇵 16.208.72.14

🇺🇸 2607:f8b0:4004:1000::122

🇩🇪 213.209.159.175

🇷🇸 212.200.181.156

🇺🇸 207.90.244.19

🇺🇸 205.210.31.72

🇩🇪 195.182.16.23