JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

52.169.237.21

Neutral Activity

Abuse Confidence Score

0% Low Risk

45 reports

25 reporters · latest 1 year ago

ISP: Microsoft Corporation
Usage Type: Data Center/Web Hosting/Transit
ASN: AS8075
Domain Name: microsoft.com
Country: 🇮🇪 Ireland
City: Dublin, Leinster

ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report Whois

No reports in the last 60 days

52.169.237.21 has been reported 45 times. The most recent report is from 1 year ago.

The full history is preserved below and remains searchable. A 0% score reflects the absence of recent activity, but this is not a guarantee that earlier reports were invalid. Abuse confidence score decays, naturally, over time, when the abusive activity stops.

Abuse Reports

Export reports CSV

Total reports

45 from 25 distinct reporters

First reported

August 30th 2025

Most recent report

1 year ago

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇫🇷 Pythagus	2025-09-01 00:12:51 UTC · (1 year ago)	Aggressive web scan	SQL Injection Bad Web Bot Web App Attack
🇺🇸 mnsf	2025-08-31 23:05:01 UTC · (1 year ago)	Request Overload (220)	Brute-Force Web App Attack
🇺🇸 TPI-Abuse	2025-08-31 17:35:58 UTC · (1 year ago)	(mod_security) mod_security (id:240000) triggered by 52.169.237.21 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Aug 31 13:35:54.809547 2025] [security2:error] [pid 4174:tid 4174] [client 52.169.237.21:15953] Mod ... show more (mod_security) mod_security (id:240000) triggered by 52.169.237.21 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Aug 31 13:35:54.809547 2025] [security2:error] [pid 4174:tid 4174] [client 52.169.237.21:15953] ModSecurity: Access denied with code 403 (phase 2). String match ".php" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/24_Apps_Joomla.conf"] [line "74"] [id "240000"] [rev "1"] [msg "COMODO WAF: Protecting Joomla folder\|\|www.buynorthwest.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "Joomla"] [hostname "www.buynorthwest.com"] [uri "/images/stories/goods.php"] [unique_id "aLSH-q8pSOttiP6z2mrjtQAAABI"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2025-08-31 17:18:32 UTC · (1 year ago)	(mod_security) mod_security (id:240000) triggered by 52.169.237.21 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Aug 31 13:18:28.704253 2025] [security2:error] [pid 32234:tid 32234] [client 52.169.237.21:7433] Mo ... show more (mod_security) mod_security (id:240000) triggered by 52.169.237.21 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Aug 31 13:18:28.704253 2025] [security2:error] [pid 32234:tid 32234] [client 52.169.237.21:7433] ModSecurity: Access denied with code 403 (phase 2). String match ".php" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/24_Apps_Joomla.conf"] [line "74"] [id "240000"] [rev "1"] [msg "COMODO WAF: Protecting Joomla folder\|\|karendraughon.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "Joomla"] [hostname "karendraughon.com"] [uri "/images/stories/goods.php"] [unique_id "aLSD5GzSndbNqKkU9oBsSgAAAAY"] show less	Brute-Force Bad Web Bot Web App Attack
Anonymous	2025-08-31 14:42:15 UTC · (1 year ago)	Probing for Open Source CMS Components	Hacking Brute-Force
🇺🇸 TPI-Abuse	2025-08-31 13:51:12 UTC · (1 year ago)	(mod_security) mod_security (id:240000) triggered by 52.169.237.21 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Aug 31 09:51:06.543592 2025] [security2:error] [pid 19050:tid 19050] [client 52.169.237.21:8484] Mo ... show more (mod_security) mod_security (id:240000) triggered by 52.169.237.21 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Aug 31 09:51:06.543592 2025] [security2:error] [pid 19050:tid 19050] [client 52.169.237.21:8484] ModSecurity: Access denied with code 403 (phase 2). String match ".php" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/24_Apps_Joomla.conf"] [line "74"] [id "240000"] [rev "1"] [msg "COMODO WAF: Protecting Joomla folder\|\|thepenandquill.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "Joomla"] [hostname "thepenandquill.com"] [uri "/images/stories/goods.php"] [unique_id "aLRTSrioW4U9sy66zUiRgAAAAAI"] show less	Brute-Force Bad Web Bot Web App Attack
Anonymous	2025-08-31 13:51:01 UTC · (1 year ago)	wordpress-trap	Web App Attack
🇺🇸 TPI-Abuse	2025-08-31 13:02:28 UTC · (1 year ago)	(mod_security) mod_security (id:240000) triggered by 52.169.237.21 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Aug 31 09:02:25.359887 2025] [security2:error] [pid 28966:tid 28966] [client 52.169.237.21:8517] Mo ... show more (mod_security) mod_security (id:240000) triggered by 52.169.237.21 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Aug 31 09:02:25.359887 2025] [security2:error] [pid 28966:tid 28966] [client 52.169.237.21:8517] ModSecurity: Access denied with code 403 (phase 2). String match ".php" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/24_Apps_Joomla.conf"] [line "74"] [id "240000"] [rev "1"] [msg "COMODO WAF: Protecting Joomla folder\|\|sarcd.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "Joomla"] [hostname "sarcd.com"] [uri "/images/stories/goods.php"] [unique_id "aLRH4d9b_b2tB0v05sT65wAAAA8"] show less	Brute-Force Bad Web Bot Web App Attack
🇫🇮 as211431.net	2025-08-31 12:54:50 UTC · (1 year ago)	Triggered Cloudflare WAF (firewallCustom) from IE. Action taken: BLOCK Protocol: HTTP/1.1 (GET method) Endpoint: /.tmb/product.php UA: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_6) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.1.2 Safari/605. ... show more Triggered Cloudflare WAF (firewallCustom) from IE. Action taken: BLOCK Protocol: HTTP/1.1 (GET method) Endpoint: /.tmb/product.php UA: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_6) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.1.2 Safari/605.1.15 This report was generated by: https://github.com/sefinek/Cloudflare-WAF-To-AbuseIPDB show less	Bad Web Bot
🇨🇭 zynex	2025-08-31 12:42:32 UTC · (1 year ago)	URL Probing: /index.php	Web App Attack
Anonymous	2025-08-31 11:58:12 UTC · (1 year ago)	Bot / seems abusive / Apache connections: 41	DDoS Attack Web Spam Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2025-08-31 11:44:35 UTC · (1 year ago)	(mod_security) mod_security (id:240000) triggered by 52.169.237.21 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Aug 31 07:44:27.654164 2025] [security2:error] [pid 3759965:tid 3760001] [client 52.169.237.21:5314 ... show more (mod_security) mod_security (id:240000) triggered by 52.169.237.21 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Aug 31 07:44:27.654164 2025] [security2:error] [pid 3759965:tid 3760001] [client 52.169.237.21:5314] ModSecurity: Access denied with code 403 (phase 2). String match ".php" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/24_Apps_Joomla.conf"] [line "74"] [id "240000"] [rev "1"] [msg "COMODO WAF: Protecting Joomla folder\|\|thatspecial.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "Joomla"] [hostname "thatspecial.com"] [uri "/images/stories/goods.php"] [unique_id "aLQ1m5anGMIoXCb51bcP_gAAAIs"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2025-08-31 10:33:23 UTC · (1 year ago)	(mod_security) mod_security (id:240000) triggered by 52.169.237.21 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Aug 31 06:33:17.172548 2025] [security2:error] [pid 3838:tid 3838] [client 52.169.237.21:6204] ModS ... show more (mod_security) mod_security (id:240000) triggered by 52.169.237.21 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Aug 31 06:33:17.172548 2025] [security2:error] [pid 3838:tid 3838] [client 52.169.237.21:6204] ModSecurity: Access denied with code 403 (phase 2). String match ".php" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/24_Apps_Joomla.conf"] [line "74"] [id "240000"] [rev "1"] [msg "COMODO WAF: Protecting Joomla folder\|\|emiliofatuzzo.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "Joomla"] [hostname "emiliofatuzzo.com"] [uri "/images/stories/goods.php"] [unique_id "aLQk7WJjLSstOxJVygNjYwAAAAk"] show less	Brute-Force Bad Web Bot Web App Attack
🇨🇦 Mediashaker	2025-08-31 10:11:39 UTC · (1 year ago)	(apache-scanners) Failed apache-scanners trigger with match [redacted] from 52.169.237.21 (IE/Ireland/-)	Port Scan
🇩🇪 Ba-Yu	2025-08-31 09:54:30 UTC · (1 year ago)	General hacking/exploits/scanning	Web Spam Hacking Brute-Force Exploited Host Web App Attack

Showing 1 to 15 of 45 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown

Recently Reported IPs:

🇺🇸 2604:a880:400:d1:0:5:6d93:c001

🇳🇱 204.76.203.221

🇭🇰 154.92.2.59

🇲🇾 47.250.88.63

🇳🇱 204.76.203.213

🇳🇱 193.176.31.152

🇲🇾 192.228.236.137

🇨🇳 180.153.236.219

🇪🇨 138.185.137.87

🇺🇸 134.209.115.237

🇨🇭 94.230.208.147

🇧🇬 37.63.46.160

🇯🇵 8.216.45.94

🇲🇽 200.77.172.159

🇩🇪 151.243.11.32

🇲🇩 94.176.78.21

🇳🇱 35.214.218.177

🇷🇴 193.46.255.86

🇸🇬 178.128.57.106

🇸🇬 157.245.55.117