JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 52.161.180.228

52.161.180.228 was found in our database!

This IP was reported 16 times. Confidence of Abuse is 53%: ?

53%

ISP	Microsoft Corporation
Usage Type	Data Center/Web Hosting/Transit
ASN	AS8075
Domain Name	microsoft.com
Country	🇺🇸 United States of America
City	Cheyenne, Wyoming

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 52.161.180.228

Whois 52.161.180.228

IP Abuse Reports for 52.161.180.228:

This IP address has been reported a total of 16 times from 11 distinct sources. 52.161.180.228 was first reported on April 18th 2026, and the most recent report was 12 hours ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇳🇱 lns.bz	2026-06-29 00:00:15 (12 hours ago)	.env scanning [DOOZ]	Web App Attack
🇺🇸 mccsoft.io	2026-06-28 07:57:34 (1 day ago)	Web application attack / vulnerability scanning against our public nginx web server (TCP 80/443). So ... show more Web application attack / vulnerability scanning against our public nginx web server (TCP 80/443). Source matched a blocked-path security rule (jail nginx-444); server returned HTTP 444 (connection closed without response). TCP three-way handshake completed (full HTTP request received). show less	Bad Web Bot Web App Attack
🇫🇷 dynamix	2026-06-28 07:38:05 (1 day ago)	Multiple WAF Violations	Web App Attack
🇺🇸 RH5	2026-06-28 07:34:55 (1 day ago)	Restricted URL probing (/.git) (UTC 2026-06-28 07:34)	Web App Attack
🇳🇱 lns.bz	2026-06-28 06:39:16 (1 day ago)	Too many 404 requests [DOOZ]	Web App Attack
Anonymous	2026-06-28 06:19:48 (1 day ago)	Unauthorized connection attempt	Port Scan Hacking Exploited Host
🇦🇺 HostFission	2026-06-28 06:14:24 (1 day ago)	PSAD port scan detected	Port Scan
🇺🇸 cazae	2026-06-28 06:07:09 (1 day ago)	Unauthorized attempt on debian [2087/tcp] Source port: 8112 TTL: 49 Packet length: 60 TOS: 0x00 htt ... show more Unauthorized attempt on debian [2087/tcp] Source port: 8112 TTL: 49 Packet length: 60 TOS: 0x00 https://github.com/sefinek/UFW-AbuseIPDB-Reporter show less	Port Scan
🇳🇱 homeshowdomain.nl	2026-05-24 22:01:22 (1 month ago)	Auto-ban: >3000 req/min op 2026-05-24	Web App Attack SSH Hacking
Anonymous	2026-05-24 02:16:29 (1 month ago)	(caddyscan) Scanner path probe from 52.161.180.228 (US/United States/-): 5 in the last 3600 secs; Po ... show more (caddyscan) Scanner path probe from 52.161.180.228 (US/United States/-): 5 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: [REDACTED] 200 2627 52.161.180.228 - - [24/May/2026:02:15:15 +0000] "GET /.env HTTP/1.1" [REDACTED] 200 2627 52.161.180.228 - - [24/May/2026:02:15:21 +0000] "GET /.git/config HTTP/1.1" [REDACTED] 200 2627 52.161.180.228 - - [24/May/2026:02:15:23 +0000] "GET /.git/config HTTP/1.1" [REDACTED] 200 2627 52.161.180.228 - - [24/May/2026:02:15:25 +0000] "GET /.env HTTP/1.1" [REDACTED] 200 2627 52.161.180.228 - - [24/May/2026:02:15:26 +0000] "GET /.env HTTP/1.1" show less	Port Scan
Anonymous	2026-05-24 01:48:39 (1 month ago)	(PERMBLOCK) 52.161.180.228 (US/United States/-) has had more than 4 temp blocks in the last 86400 se ... show more (PERMBLOCK) 52.161.180.228 (US/United States/-) has had more than 4 temp blocks in the last 86400 secs; Ports: *; Direction: inout; Trigger: LF_PERMBLOCK_COUNT; Logs: show less	Port Scan
Anonymous	2026-05-24 01:30:20 (1 month ago)	(caddyscan) Scanner path probe from 52.161.180.228 (US/United States/-): 5 in the last 3600 secs; Po ... show more (caddyscan) Scanner path probe from 52.161.180.228 (US/United States/-): 5 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: [REDACTED] 200 2627 52.161.180.228 - - [24/May/2026:01:30:19 +0000] "GET /.git/config HTTP/1.1" [REDACTED] 200 2627 52.161.180.228 - - [24/May/2026:01:30:19 +0000] "GET /.env HTTP/1.1" [REDACTED] 200 2627 52.161.180.228 - - [24/May/2026:01:30:19 +0000] "GET /.env HTTP/1.1" [REDACTED] 200 2627 52.161.180.228 - - [24/May/2026:01:30:19 +0000] "GET /@fs/.env?import&raw HTTP/1.1" [REDACTED] 200 2627 52.161.180.228 - - [24/May/2026:01:30:19 +0000] "GET /@fs/.env.local?import&raw HTTP/1.1" show less	Port Scan
Anonymous	2026-05-24 00:55:27 (1 month ago)	(caddyscan) Scanner path probe from 52.161.180.228 (US/United States/-): 5 in the last 3600 secs; Po ... show more (caddyscan) Scanner path probe from 52.161.180.228 (US/United States/-): 5 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: [REDACTED] 200 2627 52.161.180.228 - - [24/May/2026:00:55:25 +0000] "GET /.env HTTP/1.1" [REDACTED] 200 2627 52.161.180.228 - - [24/May/2026:00:55:25 +0000] "GET /.env HTTP/1.1" [REDACTED] 200 2627 52.161.180.228 - - [24/May/2026:00:55:25 +0000] "GET /@fs/.env?import&raw HTTP/1.1" [REDACTED] 200 2627 52.161.180.228 - - [24/May/2026:00:55:25 +0000] "GET /@fs/.env.local?import&raw HTTP/1.1" [REDACTED] 200 2627 52.161.180.228 - - [24/May/2026:00:55:25 +0000] "GET /@fs/.env.development?import&raw HTTP/1.1" show less	Port Scan
🇩🇪 FeG Deutschland	2026-05-24 00:07:26 (1 month ago)	Looking for CMS/PHP/SQL vulnerablilities/excessive crawling - 124	Exploited Host Web App Attack
Anonymous	2026-05-23 23:53:59 (1 month ago)	(caddyscan) Scanner path probe from 52.161.180.228 (US/United States/-): 5 in the last 3600 secs; Po ... show more (caddyscan) Scanner path probe from 52.161.180.228 (US/United States/-): 5 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: [REDACTED] 200 2627 52.161.180.228 - - [23/May/2026:23:53:58 +0000] "GET /.env HTTP/1.1" [REDACTED] 200 2627 52.161.180.228 - - [23/May/2026:23:53:58 +0000] "GET /.git/config HTTP/1.1" [REDACTED] 200 2627 52.161.180.228 - - [23/May/2026:23:53:58 +0000] "GET /.env HTTP/1.1" [REDACTED] 200 2627 52.161.180.228 - - [23/May/2026:23:53:58 +0000] "GET /.env HTTP/1.1" [REDACTED] 200 2627 52.161.180.228 - - [23/May/2026:23:53:58 +0000] "GET /@fs/.env?import&raw HTTP/1.1" show less	Port Scan

Showing 1 to 15 of 16 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇧🇩 202.125.67.28

🇺🇸 191.102.159.207

🇦🇷 181.116.220.251

🇭🇰 152.32.131.10

🇨🇳 113.70.16.31

🇧🇪 158.173.67.150

🇿🇦 154.7.224.24

🇨🇳 113.67.8.36

🇨🇳 113.66.46.3

🇨🇳 113.57.187.67

🇺🇸 107.151.204.50

🇮🇳 106.51.92.180

🇱🇹 45.227.254.170

🇯🇵 8.209.228.224

🇺🇿 213.230.93.43

🇲🇽 201.234.96.65

🇳🇱 195.178.110.30

🇺🇿 185.213.230.23

🇻🇳 171.231.177.148

🇮🇳 117.195.200.44