AbuseIPDB » 52.161.59.99
52.161.59.99
This IP was reported 9 times. Confidence of
Abuse
is 56% : ?
ISP
Microsoft Corporation
Usage Type
Data Center/Web Hosting/Transit
ASN
AS8075
Domain Name
microsoft.com
Country
🇺🇸
United States of America
City
Cheyenne, Wyoming
IP info including ISP, Usage Type, and Location provided
by IPInfo . Updated weekly.
IP Abuse Reports for 52.161.59.99 :
This IP address has been reported a total of
9
times from
9 distinct
sources.
52.161.59.99 was first reported on
April 16th 2026 , and the most recent report was
2 days ago
Recent Reports:
We have received reports of abusive activity from this IP address within the last week. It is
potentially still actively engaged in abusive activities.
Reporter
IoA Timestamp (UTC)
Comment
Categories
🇫🇷
dynamix
2026-06-03 04:54:28
(2 days ago)
Multiple WAF Violations
Web App Attack
🇬🇧
PeravixGroup
2026-06-03 04:54:03
(2 days ago)
Honeypot detection: Web application scanning / reconnaissance attempt on port 8443. Severity: LOW. A ...
show more
Honeypot detection: Web application scanning / reconnaissance attempt on port 8443. Severity: LOW. Aaran.cloud
show less
Port Scan
Bad Web Bot
🇺🇸
TPI-Abuse
2026-06-03 04:47:14
(2 days ago)
(mod_security) mod_security (id:210492) triggered by 52.161.59.99 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:210492) triggered by 52.161.59.99 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jun 03 00:47:07.988565 2026] [security2:error] [pid 10117:tid 10117] [client 52.161.59.99:14416] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "192.64.150.99"] [uri "/.git/HEAD"] [unique_id "ah-xy83XK6kF1RkMqme-QwAAAAo"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇯🇵
jay hung
2026-06-03 04:35:16
(2 days ago)
2026-06-03T04:35:15.305070+00:00 quarktech kernel: [296155.471925] [UFW BLOCK] IN=eth0 OUT= MAC=22:0 ...
show more
2026-06-03T04:35:15.305070+00:00 quarktech kernel: [296155.471925] [UFW BLOCK] IN=eth0 OUT= MAC=22:00:92:2e:84:93:fe:ff:ff:ff:ff:ff:08:00 SRC=52.161.59.99 DST=172.237.20.248 LEN=40 TOS=0x00 PREC=0x00 TTL=105 ID=1 DF PROTO=TCP SPT=14957 DPT=443 WINDOW=0 RES=0x00 ACK RST URGP=0
...
show less
Port Scan
🇺🇸
MPL
2026-06-03 03:58:11
(2 days ago)
tcp port scan (8 or more attempts)
Port Scan
🇺🇸
xmission.com
2026-06-03 03:10:58
(2 days ago)
Blocked by UFW (TCP on 80)
Source port: 15312
TTL: 52
Packet length: 60
TOS: 0x00
This report (for ...
show more
Blocked by UFW (TCP on 80)
Source port: 15312
TTL: 52
Packet length: 60
TOS: 0x00
This report (for 52.161.59.99) was generated by:
https://github.com/sefinek/UFW-AbuseIPDB-Reporter
show less
Port Scan
Web App Attack
🇳🇱
ParaBug
2026-06-03 03:01:14
(2 days ago)
52.161.59.99 - - [03/Jun/2026:05:01:13 +0200] "GET /.env.save HTTP/1.1" 403 403 "-" "Mozilla/5.0 (Ma ...
show more
52.161.59.99 - - [03/Jun/2026:05:01:13 +0200] "GET /.env.save HTTP/1.1" 403 403 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36"
...
show less
Phishing
Brute-Force
Web App Attack
2026-06-03 02:23:24
(2 days ago)
Unauthorized connection attempt
Port Scan
Hacking
Exploited Host
🇬🇧
2048
2026-04-16 07:24:52
(1 month ago)
2026-04-16T08:24:49.341804+01:00 machodeer kernel: [4581109.363553] [UFW BLOCK] IN=ens3 OUT= MAC=RED ...
show more
2026-04-16T08:24:49.341804+01:00 machodeer kernel: [4581109.363553] [UFW BLOCK] IN=ens3 OUT= MAC=REDACTED SRC=52.161.59.99 DST=REDACTED LEN=60 TOS=0x00 PREC=0x00 TTL=39 ID=11621 DF PROTO=TCP SPT=53383 DPT=443 WINDOW=64240 RES=0x00 SYN URGP=0
2026-04-16T08:24:50.382784+01:00 machodeer kernel: [4581110.405062] [UFW BLOCK] IN=ens3 OUT= MAC=REDACTED SRC=52.161.59.99 DST=REDACTED LEN=60 TOS=0x00 PREC=0x00 TTL=39 ID=11622 DF PROTO=TCP SPT=53383 DPT=443 WINDOW=64240 RES=0x00 SYN URGP=0
2026-04-16T08:24:51.406788+01:00 machodeer kernel: [4581111.429130] [UFW BLOCK] IN=ens3 OUT= MAC=REDACTED SRC=52.161.59.99 DST=REDACTED LEN=60 TOS=0x00 PREC=0x00 TTL=39 ID=11623 DF PROTO=TCP SPT=53383 DPT=443 WINDOW=64240 RES=0x00 SYN URGP=0
show less
Port Scan
Showing 1 to
9
of 9 reports
Think this IP has been falsely reported? You may request to have the associated
reports reviewed and removed.
Request Takedown 🚩
Recently Reported IPs: