JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 52.161.51.146

52.161.51.146 was found in our database!

This IP was reported 214 times. Confidence of Abuse is 100%: ?

100%

ISP	Microsoft Corporation
Usage Type	Data Center/Web Hosting/Transit
ASN	AS8075
Domain Name	microsoft.com
Country	🇺🇸 United States of America
City	Cheyenne, Wyoming

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 52.161.51.146

Whois 52.161.51.146

IP Abuse Reports for 52.161.51.146:

This IP address has been reported a total of 214 times from 147 distinct sources. 52.161.51.146 was first reported on September 10th 2025, and the most recent report was 2 days ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇯🇵 demonsword	2026-06-08 11:24:23 (2 days ago)	Detected by SentinelX honeypot: sent HTTP CONNECT request probing for an open proxy. Connection was ... show more Detected by SentinelX honeypot: sent HTTP CONNECT request probing for an open proxy. Connection was hijacked and held in a tarpit to slow down the scan. Probed target: httpbin.org:443 show less	Open Proxy Port Scan
🇯🇵 demonsword	2026-06-07 11:10:38 (3 days ago)	Detected by SentinelX honeypot: sent HTTP CONNECT request probing for an open proxy. Connection was ... show more Detected by SentinelX honeypot: sent HTTP CONNECT request probing for an open proxy. Connection was hijacked and held in a tarpit to slow down the scan. Probed target: load.vmheaven.io:443 show less	Open Proxy Port Scan
🇧🇾 lns.bz	2026-06-04 00:01:19 (6 days ago)	.env scanning [BY]	Web App Attack
Anonymous	2026-06-03 08:00:00 (1 week ago)	SSH Brute-Force	DDoS Attack Port Scan Hacking Brute-Force SSH
🇩🇪 SwinT	2026-06-03 07:00:04 (1 week ago)	WAF repeated trigger detected by Fail2Ban in plesk-modsecurity jail	Web App Attack
🇨🇿 ICT KnTl	2026-06-03 06:39:41 (1 week ago)	[Wed Jun 03 08:39:31.193061 2026] [php7:error] [pid 876252:tid 876252] [client 52.161.51.146:52514] ... show more [Wed Jun 03 08:39:31.193061 2026] [php7:error] [pid 876252:tid 876252] [client 52.161.51.146:52514] script '/var/www/html/wp-config.php' not found or unable to stat [Wed Jun 03 08:39:36.379810 2026] [php7:error] [pid 876256:tid 876256] [client 52.161.51.146:52994] script '/var/www/html/phpinfo.php' not found or unable to stat [Wed Jun 03 08:39:41.492466 2026] [php7:error] [pid 876251:tid 876251] [client 52.161.51.146:53219] script '/var/www/html/config.php' not found or unable to stat ... show less	Web App Attack
🇩🇪 robinwolff	2026-06-03 06:25:46 (1 week ago)		Web App Attack Hacking
🇺🇸 itsnixk	2026-06-03 06:21:40 (1 week ago)	(mod_security) mod_security (id:920350) triggered by 52.161.51.146 (US/United States/-): 1 in the la ... show more (mod_security) mod_security (id:920350) triggered by 52.161.51.146 (US/United States/-): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: [Wed Jun 03 02:21:39.304483 2026] [security2:error] [pid 1316994:tid 1317473] [client 52.161.51.146:53184] ModSecurity: Access denied with code 406 (phase 1). Pattern match "(?:^([\\\\d.]+\|\\\\[[\\\\da-f:]+\\\\]\|[\\\\da-f:]+)(:[\\\\d]+)?$)" at REQUEST_HEADERS:Host. [file "/etc/modsecurity.d/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "774"] [id "920350"] [msg "Host header is a numeric IP address"] [redacted] [severity "WARNING"] [ver "OWASP_CRS/4.25.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [redacted] [uri "/.git/HEAD"] [unique_id "ah_H8wzvg3uGSv7kHwZxugAAAKg"] show less	Port Scan
🇺🇸 MPL	2026-06-03 05:09:14 (1 week ago)	tcp port scan (14 or more attempts)	Port Scan
🇩🇪 gadix	2026-06-03 04:32:01 (1 week ago)	[03/Jun/2026:06:31:51.773995 +0200] ah-uN4_9wQuNEwD7dKd_SQAAAFU 52.161.51.146 55602 127.0.0.1 7080 [ ... show more [03/Jun/2026:06:31:51.773995 +0200] ah-uN4_9wQuNEwD7dKd_SQAAAFU 52.161.51.146 55602 127.0.0.1 7080 [03/Jun/2026:06:31:57.235043 +0200] ah-uPY_9wQuNEwD7dKd_SwAAAFg 52.161.51.146 43138 127.0.0.1 7080 [03/Jun/2026:06:31:58.304000 +0200] ah-uPo_9wQuNEwD7dKd_TAAAAEA 52.161.51.146 43142 127.0.0.1 7080 ... show less	Web App Attack
🇺🇸 MPL	2026-06-03 04:24:17 (1 week ago)	tcp port scan (4 or more attempts)	Port Scan
🇹🇷 Threat.live	2026-06-03 03:55:05 (1 week ago)	Suspicious Connection Attempts	Brute-Force
🇳🇱 BIV	2026-06-03 03:41:02 (1 week ago)	Honeypot multi-source hit. Sources: dshield:fw,tpot:P0f,tpot:Suricata. Ports: 2082,2083,2086,443,80, ... show more Honeypot multi-source hit. Sources: dshield:fw,tpot:P0f,tpot:Suricata. Ports: 2082,2083,2086,443,80,8080,8443. Automated tiered (T-Pot+DShield). show less	Port Scan Hacking Bad Web Bot
🇺🇸 MPL	2026-06-03 03:30:00 (1 week ago)	tcp port scan (3 or more attempts)	Port Scan
🇺🇸 RAP	2026-06-03 03:22:31 (1 week ago)	2026-06-03 03:22:31 UTC Unauthorized activity to TCP port 8443. Web App	Port Scan Web App Attack

Showing 1 to 15 of 214 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇧🇩 115.127.180.98

🇷🇺 90.150.172.17

🇫🇷 85.217.140.13

🇪🇹 196.188.187.59

🇺🇸 71.6.241.168

🇫🇷 45.81.243.62

🇳🇱 34.178.86.210

🇪🇸 196.196.150.6

🇻🇳 113.163.64.166

🇷🇴 92.118.39.236

🇺🇸 91.230.168.134

🇿🇦 41.181.156.205

🇮🇳 36.50.167.81

🇭🇰 218.190.8.165

🇹🇭 159.192.144.204

🇺🇸 150.136.214.177

🇨🇳 117.69.235.236

🇺🇸 107.174.153.85

🇻🇳 103.69.193.110

🇧🇩 103.65.240.34