JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 52.161.182.117

52.161.182.117 was found in our database!

This IP was reported 47 times. Confidence of Abuse is 100%: ?

100%

ISP	Microsoft Corporation
Usage Type	Data Center/Web Hosting/Transit
ASN	AS8075
Domain Name	microsoft.com
Country	🇺🇸 United States of America
City	Cheyenne, Wyoming

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 52.161.182.117

Whois 52.161.182.117

IP Abuse Reports for 52.161.182.117:

This IP address has been reported a total of 47 times from 24 distinct sources. 52.161.182.117 was first reported on May 28th 2026, and the most recent report was 22 hours ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇫🇷 masterguru	2026-06-10 03:11:40 (22 hours ago)	Host header is a numeric IP address. Pattern match "^ (920350-131)	Hacking Bad Web Bot
Anonymous	2026-06-10 02:44:51 (22 hours ago)	Drop from IP address 52.161.182.117 to tcp-port 2087	Port Scan
🇺🇸 TPI-Abuse	2026-06-10 02:05:17 (23 hours ago)	(mod_security) mod_security (id:210492) triggered by 52.161.182.117 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210492) triggered by 52.161.182.117 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jun 09 22:05:13.455994 2026] [security2:error] [pid 13661:tid 13661] [client 52.161.182.117:16146] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "192.64.151.6"] [uri "/.git/HEAD"] [unique_id "aijGWXMV_HT8BNrh7sIzCwAAAAY"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-06-10 01:39:28 (23 hours ago)	(mod_security) mod_security (id:210492) triggered by 52.161.182.117 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210492) triggered by 52.161.182.117 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jun 09 21:39:22.684272 2026] [security2:error] [pid 1792:tid 1792] [client 52.161.182.117:16886] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "192.64.151.16"] [uri "/.git/HEAD"] [unique_id "aijASmXl4YyDB7arGM5D2gAAABY"] show less	Brute-Force Bad Web Bot Web App Attack
🇷🇸 Scan	2026-06-10 00:18:43 (1 day ago)	MultiHost/MultiPort Probe, Scan, Hack -	Port Scan Hacking
Anonymous	2026-06-09 23:55:02 (1 day ago)	Tried our host z.	Port Scan Hacking Exploited Host
🇺🇸 MPL	2026-06-09 23:39:17 (1 day ago)	tcp port scan (8 or more attempts)	Port Scan
🇺🇸 Rip	2026-06-09 23:35:37 (1 day ago)	Automated recon attempt targeting restricted and sensitive paths.	Web App Attack
🇺🇸 TPI-Abuse	2026-06-09 23:12:28 (1 day ago)	(mod_security) mod_security (id:210492) triggered by 52.161.182.117 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210492) triggered by 52.161.182.117 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jun 09 19:12:22.898964 2026] [security2:error] [pid 19858:tid 19858] [client 52.161.182.117:15708] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "192.64.150.138"] [uri "/.git/HEAD"] [unique_id "aiid1ulOjEpLjfMWQME2TgAAAAc"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-06-09 22:47:24 (1 day ago)	(mod_security) mod_security (id:210492) triggered by 52.161.182.117 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210492) triggered by 52.161.182.117 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jun 09 18:47:19.950178 2026] [security2:error] [pid 27867:tid 27867] [client 52.161.182.117:16903] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "192.64.150.236"] [uri "/.git/HEAD"] [unique_id "aiiX99j_e9ktu3wB6016kQAAAAA"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-06-09 22:09:24 (1 day ago)	(mod_security) mod_security (id:210492) triggered by 52.161.182.117 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210492) triggered by 52.161.182.117 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jun 09 18:09:17.001998 2026] [security2:error] [pid 20301:tid 20301] [client 52.161.182.117:15492] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "192.64.150.146"] [uri "/.git/HEAD"] [unique_id "aiiPDc1J13kcSHcFP97yyQAAAAk"] show less	Brute-Force Bad Web Bot Web App Attack
🇹🇷 Threat.live	2026-06-09 22:00:05 (1 day ago)	Suspicious Connection Attempts	Brute-Force
🇩🇪 barbarella	2026-06-09 21:59:58 (1 day ago)	Multiple (16) times attack on http port 80: hacking attempt of version control system (GET /.git/HEA ... show more Multiple (16) times attack on http port 80: hacking attempt of version control system (GET /.git/HEAD) 23:59:59 hacking attempt of version control system (GET /.git/config) 23:59:59 Configuration snooping with .env file (GET /.env) 00:00:00 Configuration snooping in .env file (GET /.env.local) 00:00:00 Configuration snooping in .env file (GET /.env.production) 00:00:01 Configuration snooping in .env file (GET /.env.save) 00:00:02 Hacking attempt of vulnerable PHP Script (GET /wp-config.php) 00:00:02 Hacking attempt of Wordpress (GET /wp-config.php.bak) 00:00:03 illegal scan for AWS credentials file (GET /.aws/credentials) show less	Hacking Web App Attack
🇫🇷 HyperSpeeed	2026-06-09 18:54:48 (1 day ago)	2026-06-09T20:54:35.251468+02:00 vmd183731 sshd[507103]: Failed password for invalid user r00t from ... show more 2026-06-09T20:54:35.251468+02:00 vmd183731 sshd[507103]: Failed password for invalid user r00t from 52.161.182.117 port 31793 ssh2 2026-06-09T20:54:33.772180+02:00 vmd183731 sshd[507103]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=52.161.182.117 2026-06-09T20:54:35.251468+02:00 vmd183731 sshd[507103]: Failed password for invalid user r00t from 52.161.182.117 port 31793 ssh2 2026-06-09T20:54:46.070055+02:00 vmd183731 sshd[507172]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=52.161.182.117 user=root 2026-06-09T20:54:47.535320+02:00 vmd183731 sshd[507172]: Failed password for root from 52.161.182.117 port 31793 ssh2 ... show less	Brute-Force SSH
🇺🇸 shadowlab	2026-06-09 18:23:23 (1 day ago)	2026-06-09T11:22:47.311824-07:00 shadownetworks.org sshd[2377622]: Failed password for root from 52. ... show more 2026-06-09T11:22:47.311824-07:00 shadownetworks.org sshd[2377622]: Failed password for root from 52.161.182.117 port 31792 ssh2 2026-06-09T11:22:58.508338-07:00 shadownetworks.org sshd[2377778]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=52.161.182.117 user=root 2026-06-09T11:23:00.502642-07:00 shadownetworks.org sshd[2377778]: Failed password for root from 52.161.182.117 port 31792 ssh2 2026-06-09T11:23:21.466723-07:00 shadownetworks.org sshd[2378125]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=52.161.182.117 user=root 2026-06-09T11:23:22.950374-07:00 shadownetworks.org sshd[2378125]: Failed password for root from 52.161.182.117 port 31795 ssh2 ... show less	Brute-Force SSH

Showing 1 to 15 of 47 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇫🇮 204.168.240.142

🇬🇧 194.50.235.138

🇸🇬 194.5.82.108

🇩🇪 185.249.74.198

🇩🇪 169.150.201.21

🇺🇸 147.182.236.238

🇮🇳 122.176.122.24

🇿🇦 102.37.220.188

🇺🇸 99.92.204.98

🇧🇬 79.124.62.134

🇺🇸 66.132.224.90

🇫🇷 51.38.247.145

🇸🇬 47.79.206.115

🇺🇸 34.71.30.159

🇺🇸 24.144.93.224

🇺🇸 20.169.106.57

🇺🇸 216.218.206.97

🇭🇰 199.45.155.70

🇬🇧 194.50.235.154

🇩🇪 193.228.139.227