Log in to view charts and search reports for this IP.
Log In
Top Reporter Countries (Last 60 Days)
Example preview
Report Categories (Last 60 Days)
Example preview
Reports Activity
Example preview
Account required for the enhanced features
Log inSign up
IP Abuse Reports for 52.161.45.228:
This IP address has been reported a total of
30
times from
24 distinct
sources.
52.161.45.228 was first reported on
, and the most recent report was
.
In the last 60 days, the top reporter locations were:
Czechia
with 2
reports;
United Kingdom of Great Britain and Northern Ireland
with 2
reports;
Germany
with 1
report.
The most common categories in these recent reports were:
Port Scan
5
times;
Brute-Force
2
times;
Web App Attack
2
times.
Recent Reports
We have received reports of abusive activity from this IP address within the last week. It is
potentially still actively engaged in abusive activities.
Automated scan detection against redacted protected targets. Hits=1; port 2086 proto 6 detection dar ...
show moreAutomated scan detection against redacted protected targets. Hits=1; port 2086 proto 6 detection dark_ip
show less
Direct ip access to website TCP 80/443, path "/.git/HEAD" [Mozilla/5.0 (Windows NT 10.0; Win64; x64; ...
show moreDirect ip access to website TCP 80/443, path "/.git/HEAD" [Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/201001].
show less
Blocked by UFW (TCP on port 2096).
Source port: 56370
TTL: 104
Packet length: 40
TOS: 0x00
This rep ...
show moreBlocked by UFW (TCP on port 2096).
Source port: 56370
TTL: 104
Packet length: 40
TOS: 0x00
This report (for 52.161.45.228) was generated by:
https://github.com/sefinek/UFW-AbuseIPDB-Reporter
show less
[SatMay2322:41:00.8178772026][security2:error][pid4090393:tid4090735][client52.161.45.228:0]ModSecur ...
show more[SatMay2322:41:00.8178772026][security2:error][pid4090393:tid4090735][client52.161.45.228:0]ModSecurity:Accessdeniedwithcode403\(phase1\).Matchedphrase\".env\"atREQUEST_URI.[file\"/etc/apache2/conf.d/modsec_custom_rules.conf\"][line\"364\"][id\"960720\"][msg\"Forbiddenfileaccess\"][hostname\"hostingedominio.com.81-17-25-250.cpanel.site\"][uri\"/.env\"][unique_id\"ahIQ3OYY8I0BrEl1b8_OjgAAARg\"]
show less
(mod_security) mod_security (id:210492) triggered by 52.161.45.228 (-): 1 in the last 300 secs; Port ...
show more(mod_security) mod_security (id:210492) triggered by 52.161.45.228 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat May 23 16:05:46.729532 2026] [security2:error] [pid 9659:tid 9659] [client 52.161.45.228:7686] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "easyweb-publishing.com"] [uri "/.env"] [unique_id "ahIImqrXa-QpK8ePan9-ZQAAAAU"], referer: https://www.google.com/
show less
Brute-Force
Bad Web Bot
Web App Attack
Anonymous
(PERMBLOCK) 52.161.45.228 (US/United States/-) has had more than 4 temp blocks in the last 86400 sec ...
show more(PERMBLOCK) 52.161.45.228 (US/United States/-) has had more than 4 temp blocks in the last 86400 secs; Ports: *; Direction: inout; Trigger: LF_PERMBLOCK_COUNT; Logs:
show less
Port Scan
Anonymous
(caddyscan) Scanner path probe from 52.161.45.228 (US/United States/-): 5 in the last 3600 secs; Por ...
show more(caddyscan) Scanner path probe from 52.161.45.228 (US/United States/-): 5 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: [REDACTED] 200 2627 52.161.45.228 - - [23/May/2026:17:53:32 +0000] "GET /.env HTTP/1.1"
[REDACTED] 200 2627 52.161.45.228 - - [23/May/2026:17:53:32 +0000] "GET /config/.env HTTP/1.1"
[REDACTED] 200 2627 52.161.45.228 - - [23/May/2026:17:53:32 +0000] "GET /config/.env HTTP/1.1"
[REDACTED] 200 2627 52.161.45.228 - - [23/May/2026:17:53:32 +0000] "GET /.env HTTP/1.1"
[REDACTED] 200 2627 52.161.45.228 - - [23/May/2026:17:53:32 +0000] "GET /.env HTTP/1.1"
show less
Port Scan
Anonymous
(caddyscan) Scanner path probe from 52.161.45.228 (US/United States/-): 5 in the last 3600 secs; Por ...
show more(caddyscan) Scanner path probe from 52.161.45.228 (US/United States/-): 5 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: [REDACTED] 200 2627 52.161.45.228 - - [23/May/2026:16:53:27 +0000] "GET /.git/config HTTP/1.1"
[REDACTED] 200 2627 52.161.45.228 - - [23/May/2026:16:53:27 +0000] "GET /.env HTTP/1.1"
[REDACTED] 200 2627 52.161.45.228 - - [23/May/2026:16:53:27 +0000] "GET /.env HTTP/1.1"
[REDACTED] 200 2627 52.161.45.228 - - [23/May/2026:16:53:27 +0000] "GET /@fs/.env?import&raw HTTP/1.1"
[REDACTED] 200 2627 52.161.45.228 - - [23/May/2026:16:53:27 +0000] "GET /@fs/.env.local?import&raw HTTP/1.1"
show less
Port Scan
Anonymous
(caddyscan) Scanner path probe from 52.161.45.228 (US/United States/-): 5 in the last 3600 secs; Por ...
show more(caddyscan) Scanner path probe from 52.161.45.228 (US/United States/-): 5 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: [REDACTED] 200 2627 52.161.45.228 - - [23/May/2026:15:53:11 +0000] "GET /@fs/.git/config?import&raw HTTP/1.1"
[REDACTED] 200 2627 52.161.45.228 - - [23/May/2026:15:53:11 +0000] "GET /@fs/.git/config?import?raw HTTP/1.1"
[REDACTED] 200 2627 52.161.45.228 - - [23/May/2026:15:53:11 +0000] "GET /@fs/.git/config?import&raw HTTP/1.1"
[REDACTED] 200 2627 52.161.45.228 - - [23/May/2026:15:53:11 +0000] "GET /@fs/.git/config?import?raw HTTP/1.1"
[REDACTED] 200 2627 52.161.45.228 - - [23/May/2026:15:53:21 +0000] "GET /@fs/.git/config?import&raw HTTP/1.1"
show less
