JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

52.161.82.118

Neutral Activity

Abuse Confidence Score

0% Low Risk

13 reports

11 reporters · latest 2 months ago

ISP: Microsoft Corporation
Usage Type: Data Center/Web Hosting/Transit
ASN: AS8075
Domain Name: microsoft.com
Country: 🇺🇸 United States of America
City: Cheyenne, Wyoming

ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report Whois

No reports in the last 60 days

52.161.82.118 has been reported 13 times. The most recent report is from 2 months ago.

The full history is preserved below and remains searchable. A 0% score reflects the absence of recent activity, but this is not a guarantee that earlier reports were invalid. Abuse confidence score decays, naturally, over time, when the abusive activity stops.

Abuse Reports

Export reports CSV

Total reports

13 from 11 distinct reporters

First reported

January 13th 2026

Most recent report

2 months ago

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇯🇵 SentinalX by uzumaru	2026-08-20 00:53:09 UTC · (2 months ago)	Detected by SentinelX honeypot: sent HTTP CONNECT request probing for an open proxy. Connection was hijacked and held in a tarpit to slow down the scan. Probed target: proof.ovh.net:443	Open Proxy Port Scan
🇫🇷 geot	2026-06-08 11:51:43 UTC · (5 months ago)	18 requests, including : GET /server-status HTTP/1.1 GET /app/config/parameters.yml HTTP/1.1 GET /dump.sql HTTP/1.1 GET /.env HTTP/1.1 GET /backup.sql HTTP/1.1 GET /.DS_Store HTTP/1.1 GET /.aws/credentials HTTP/1.1 GET /wp-config.php.bak HTTP/1.1 GE ... show more 18 requests, including : GET /server-status HTTP/1.1 GET /app/config/parameters.yml HTTP/1.1 GET /dump.sql HTTP/1.1 GET /.env HTTP/1.1 GET /backup.sql HTTP/1.1 GET /.DS_Store HTTP/1.1 GET /.aws/credentials HTTP/1.1 GET /wp-config.php.bak HTTP/1.1 GET /actuator/env HTTP/1.1 GET /.htpasswd HTTP/1.1 GET /.env.save HTTP/1.1 GET /wp-config.php HTTP/1.1 GET /.git/HEAD HTTP/1.1 POST /___proxy_subdomain_whm/login/?login_only=1 HTTP/1.1 GET /.env.backup HTTP/1.1 GET /___proxy_subdomain_whm/login/ HTTP/1.1 GET /config/database.yml HTTP/1.1 show less	Hacking Bad Web Bot Web App Attack
🇵🇹 nuno	2026-06-07 20:10:03 UTC · (5 months ago)	52.161.82.118 - - [07/Jun/2026:21:09:59 +0100] host:80 "GET /.git/config HTTP/1.1" 404 780 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36" "-" 0.000 - 52.161.82.118 - - [07/Jun/202 ... show more 52.161.82.118 - - [07/Jun/2026:21:09:59 +0100] host:80 "GET /.git/config HTTP/1.1" 404 780 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36" "-" 0.000 - 52.161.82.118 - - [07/Jun/2026:21:10:01 +0100] host:443 "GET /.env HTTP/1.1" 404 780 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36" "-" 0.000 - ... show less	Web App Attack
🇹🇼 kk_it_man	2026-06-07 19:43:03 UTC · (5 months ago)	ET INFO Request to Hidden Environment File - Inbound ET WEB_SERVER WEB-PHP phpinfo access GPL WEB_SERVER .htpasswd access	Port Scan
🇺🇸 TPI-Abuse	2026-06-07 19:15:11 UTC · (5 months ago)	(mod_security) mod_security (id:210492) triggered by 52.161.82.118 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Jun 07 15:15:06.377077 2026] [security2:error] [pid 15268:tid 15268] [client 52.161.82.118:13199] M ... show more (mod_security) mod_security (id:210492) triggered by 52.161.82.118 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Jun 07 15:15:06.377077 2026] [security2:error] [pid 15268:tid 15268] [client 52.161.82.118:13199] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "192.64.150.91"] [uri "/.git/HEAD"] [unique_id "aiXDOvEHNZBqfqh2OTYJFwAAAAk"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-06-07 18:41:05 UTC · (5 months ago)	(mod_security) mod_security (id:210492) triggered by 52.161.82.118 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Jun 07 14:40:58.643686 2026] [security2:error] [pid 529:tid 529] [client 52.161.82.118:13214] ModSe ... show more (mod_security) mod_security (id:210492) triggered by 52.161.82.118 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Jun 07 14:40:58.643686 2026] [security2:error] [pid 529:tid 529] [client 52.161.82.118:13214] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "192.64.150.76"] [uri "/.git/HEAD"] [unique_id "aiW7OlcW9z-8BbLBePw7AgAAAAk"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 Starburst SysOp Team	2026-06-07 17:51:05 UTC · (5 months ago)	Host header is a numeric IP address. Pattern match "(?:^( (920350-stl2-17)	Hacking Bad Web Bot
🇪🇸 loadsoporte	2026-06-07 17:30:11 UTC · (5 months ago)	RdpGuard detected brute-force attempt on HTTP	Brute-Force
🇺🇸 TPI-Abuse	2026-06-07 16:21:15 UTC · (5 months ago)	(mod_security) mod_security (id:210492) triggered by 52.161.82.118 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Jun 07 12:21:08.443011 2026] [security2:error] [pid 14664:tid 14690] [client 52.161.82.118:12191] M ... show more (mod_security) mod_security (id:210492) triggered by 52.161.82.118 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Jun 07 12:21:08.443011 2026] [security2:error] [pid 14664:tid 14690] [client 52.161.82.118:12191] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "192.64.150.132"] [uri "/.git/HEAD"] [unique_id "aiWadGEkvpyTem-mwzDoIQAAAJg"] show less	Brute-Force Bad Web Bot Web App Attack
🇦🇺 dyln	2026-06-07 15:11:24 UTC · (5 months ago)	Dyls honeypot brute-force: proto8 (22 total hits)	Brute-Force
🇬🇧 PeravixGroup	2026-06-07 14:30:01 UTC · (5 months ago)	Imunify360 WAF block (graylisted)	Web App Attack
🇨🇳 ThreatBook.io	2026-01-14 00:57:10 UTC · (9 months ago)	ThreatBook Intelligence: Info more details on http://threatbook.io/ip/52.161.82.118	SSH
Anonymous	2026-01-13 05:31:17 UTC · (9 months ago)	Unauthorized connection attempt on Port 23	Port Scan Hacking Exploited Host

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown

Recently Reported IPs:

🇬🇧 213.166.84.35

🇺🇸 107.174.120.99

🇮🇩 103.144.18.42

🇺🇸 57.154.242.239

🇧🇪 35.210.133.236

🇮🇹 2.37.205.12

🇲🇽 189.217.215.2

🇦🇷 181.46.71.55

🇫🇷 169.58.109.98

🇮🇩 122.102.44.89

🇻🇳 117.6.201.220

🇺🇸 103.199.247.79

🇺🇸 96.78.175.36

🇳🇱 85.11.167.160

🇵🇱 80.68.146.26

🇸🇬 47.128.17.194

🇧🇷 45.234.137.63

🇺🇸 45.79.145.34

🇭🇰 45.64.112.230

🇨🇳 36.250.107.142