JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 52.159.247.234

52.159.247.234 was found in our database!

This IP was reported 13 times. Confidence of Abuse is 66%: ?

66%

ISP	Microsoft Corporation
Usage Type	Data Center/Web Hosting/Transit
ASN	AS8075
Domain Name	microsoft.com
Country	🇺🇸 United States of America
City	San Jose, California

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 52.159.247.234

Whois 52.159.247.234

IP Abuse Reports for 52.159.247.234:

This IP address has been reported a total of 13 times from 13 distinct sources. 52.159.247.234 was first reported on June 10th 2026, and the most recent report was 2 days ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇩🇪 Darki1962	2026-07-02 05:05:01 (2 days ago)	12 hits, proto=tcp, ports=2082,2083,2086,2087,8080,8443	Port Scan Hacking Brute-Force SSH
🇺🇸 TPI-Abuse	2026-07-02 04:47:16 (2 days ago)	(mod_security) mod_security (id:210492) triggered by 52.159.247.234 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210492) triggered by 52.159.247.234 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jul 02 00:47:10.949045 2026] [security2:error] [pid 25633:tid 25633] [client 52.159.247.234:10962] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "192.64.150.238"] [uri "/.git/HEAD"] [unique_id "akXtTtEfo-cPRoa_Y9hqawAAAAg"] show less	Brute-Force Bad Web Bot Web App Attack
🇬🇧 OptimusGO	2026-07-02 04:24:56 (2 days ago)	Malicious activity detected: web_attack Server: commstackbc (185.127.18.66) Attack: web_attack Time ... show more Malicious activity detected: web_attack Server: commstackbc (185.127.18.66) Attack: web_attack Timestamp: 2026-07-02 05:24:56 UTC Log evidence: 07/02/2026-05:24:55.497560 [] [1:1000101:2] SECURITY Port Scan Detected - Multiple Unauthorized Ports [] [Classification: Attempted Information Leak] [Priority: 1] {TCP} 52.159.247.234:10825 -> 185.127.18.66:8443 07/02/2026-05:24:55.495652 [] [1:1000101:2] SECURITY Port Scan Detected - Multiple Unauthorized Ports [] [Classification: Attempted Information Leak] [Priority: 1] {TCP} 52.159.247.234:10836 -> 185.127.18.66:8080 show less	Port Scan Brute-Force
🇺🇸 xmission.com	2026-07-02 04:20:06 (2 days ago)	Blocked by UFW (TCP on 2086) Source port: 10819 TTL: 116 Packet length: 40 TOS: 0x00 This report (f ... show more Blocked by UFW (TCP on 2086) Source port: 10819 TTL: 116 Packet length: 40 TOS: 0x00 This report (for 52.159.247.234) was generated by: https://github.com/sefinek/UFW-AbuseIPDB-Reporter show less	Port Scan
Anonymous	2026-07-02 01:27:24 (2 days ago)	Unauthorized connection attempt	Port Scan Hacking Exploited Host
🇳🇱 SysAdmin Dylan	2026-07-02 00:53:49 (2 days ago)	(mod_security) mod_security (id:210492) triggered by 52.159.247.234 (US/United States/-): 10 in the ... show more (mod_security) mod_security (id:210492) triggered by 52.159.247.234 (US/United States/-): 10 in the last 3600 secs show less	Brute-Force
🇨🇿 Prcek	2026-07-02 00:51:33 (2 days ago)	PortScan:HOST=52.159.247.234,DPORTS=443,2086,2087,8443	Port Scan
🇷🇸 Scan	2026-07-02 00:29:52 (2 days ago)	MultiHost/MultiPort Probe, Scan, Hack -	Port Scan Hacking
🇦🇹 urnilxfgbez	2026-06-11 22:45:00 (3 weeks ago)	Last 24 Hours suspicious: (DPT=445\|DPT=3389\|DPT=22\|DPT=3306\|DPT=8080\|DPT=23\|DPT=5900\|DPT=1433)	Port Scan
🇮🇹 Inartis	2026-06-10 22:05:34 (3 weeks ago)	52.159.247.234 - - [11/Jun/2026:00:05:31 +0200] "GET /.env.local HTTP/1.1" 302 460 "-" "Mozilla/5.0 ... show more 52.159.247.234 - - [11/Jun/2026:00:05:31 +0200] "GET /.env.local HTTP/1.1" 302 460 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)" 52.159.247.234 - - [11/Jun/2026:00:05:33 +0200] "GET /.env.production HTTP/1.1" 302 470 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36" 52.159.247.234 - - [11/Jun/2026:00:05:34 +0200] "GET /.env.backup HTTP/1.1" 302 462 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36" ... show less	Brute-Force Bad Web Bot Web App Attack
🇳🇴 Abuse Buster	2026-06-10 19:00:44 (3 weeks ago)	52.159.247.234 - - [10/Jun/2026:21:00:40 +0200] "GET /.git/config HTTP/1.1" 301 162 "-" "Mozilla/5.0 ... show more 52.159.247.234 - - [10/Jun/2026:21:00:40 +0200] "GET /.git/config HTTP/1.1" 301 162 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_4_1) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.4 Safari/605.1.15" 52.159.247.234 - - [10/Jun/2026:21:00:42 +0200] "GET /.env HTTP/1.1" 301 162 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_4_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36" ... show less	Web App Attack
🇺🇸 MPL	2026-06-10 17:49:16 (3 weeks ago)	tcp port scan (8 or more attempts)	Port Scan
🇺🇸 RAP	2026-06-10 17:33:30 (3 weeks ago)	2026-06-10 17:33:30 UTC Unauthorized activity to TCP port 8080. Web App	Port Scan Web App Attack

Showing 1 to 13 of 13 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇩🇪 193.124.20.233

🇩🇪 193.124.20.231

🇰🇷 169.213.58.63

🇦🇺 13.105.82.156

🇰🇷 219.248.4.146

🇵🇦 190.14.223.70

🇨🇳 106.38.205.224

🇺🇸 104.243.42.167

🇬🇧 35.203.211.85

🇹🇷 159.146.54.178

🇱🇹 77.37.55.131

🇺🇸 66.132.172.230

🇸🇬 52.237.126.164

🇬🇧 45.133.173.250

🇬🇧 35.203.211.169

🇪🇸 207.188.158.216

🇩🇪 194.187.176.154

🇷🇺 185.245.184.230

🇺🇸 185.81.145.232

🇺🇸 156.232.13.161