AbuseIPDB » 52.169.24.106

52.169.24.106 was found in our database!

This IP was reported 153 times. Confidence of Abuse is 59%: ?

59%

ISP	Microsoft Corporation
Usage Type	Data Center/Web Hosting/Transit
Domain Name	microsoft.com
Country	Ireland
City	Dublin, Leinster

Report 52.169.24.106

Whois 52.169.24.106

IP Abuse Reports for 52.169.24.106:

This IP address has been reported a total of 153 times from 73 distinct sources. 52.169.24.106 was first reported on October 14th 2024, and the most recent report was 1 month ago.

Old Reports: The most recent abuse report for this IP address is from 1 month ago. It is possible that this IP is no longer involved in abusive activities.

Reporter	IoA Timestamp in UTC	Comment	Categories
Gwyneth Llewelyn	2024-10-16 03:25:05 (1 month ago)	52.169.24.106 - - [16/Oct/2024:04:25:02 +0100] "GET /cgi-bin/wp-login.php HTTP/2.0" 404 994 "-" "-"	Bad Web Bot
Anonymous	2024-10-16 01:52:43 (1 month ago)	Ports: 80,443; Direction: 0; Trigger: LF_CUSTOMTRIGGER	Brute-Force SSH
noxtec GmbH	2024-10-15 23:55:34 (1 month ago)	(apache-scanners) Failed apache-scanners trigger with match [redacted] from 52.169.24.106 (IE/Irelan ... show more(apache-scanners) Failed apache-scanners trigger with match [redacted] from 52.169.24.106 (IE/Ireland/-) show less	Port Scan
TPI-Abuse	2024-10-15 23:23:10 (1 month ago)	(mod_security) mod_security (id:210492) triggered by 52.169.24.106 (-): 1 in the last 300 secs; Port ... show more(mod_security) mod_security (id:210492) triggered by 52.169.24.106 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 15 19:23:05.843489 2024] [security2:error] [pid 17786:tid 17786] [client 52.169.24.106:6953] [client 52.169.24.106] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "pawlewicz.org"] [uri "/wp-config.php"] [unique_id "Zw75WQy_xduaMaC6iCRc-gAAAAA"] show less	Brute-Force Bad Web Bot Web App Attack
Anonymous	2024-10-15 22:32:02 (1 month ago)	Bot / scanning and/or hacking attempts: GET /wp-includes/css/admin.php HTTP/1.1, GET /wp-signup.php ... show moreBot / scanning and/or hacking attempts: GET /wp-includes/css/admin.php HTTP/1.1, GET /wp-signup.php HTTP/1.1, GET /cgi-bin/index.php HTTP/1.1, GET /not_found HTTP/1.1, GET /.well-known/acme-challenge/admin.php HTTP/1.1, GET /wp-admin/css/colors/blue/blkqvmih.php HTTP/1.1, GET /.well-known/acme-challenge/index.php HTTP/1.1, GET /chosen.php HTTP/1.1, GET /wp-content/upgrade-temp-backup/about.php HTTP/1.1, GET /wp-admin/includes/xleet-shell.php HTTP/1.1, GET /.well-known/makeasmtp.php HTTP/1.1, GET /templates/hcapmaster_comps.php HTTP/1.1, GET /wp-admin/css/colors/blue/index.php HTTP/1.1, GET /wp-admin/js/autoload_classmap.php HTTP/1.1, GET /alfa-ioxi.php HTTP/1.1, GET /wp-content/upgrade/index.php HTTP/1.1, GET /config.php HTTP/1.1, GET /wp-config.php HTTP/1.1, GET /.well-known/acme-challenge/autoload_classmap.php HTTP/1.1, GET /file-manager.php HTTP/1.1, GET /moon.php HTTP/1.1, GET /.well-known/acme-challenge/ HTTP/1.1, GET /.well-known/doc.php HTTP/1.1 show less	Hacking Web App Attack
archiv-pm	2024-10-15 22:16:02 (1 month ago)	Probing for resource vulnerabilities HTTP(S)	Web App Attack
TPI-Abuse	2024-10-15 20:41:21 (1 month ago)	(mod_security) mod_security (id:210492) triggered by 52.169.24.106 (-): 1 in the last 300 secs; Port ... show more(mod_security) mod_security (id:210492) triggered by 52.169.24.106 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 15 16:41:15.744495 2024] [security2:error] [pid 17994:tid 17994] [client 52.169.24.106:2507] [client 52.169.24.106] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.toxicwater.com"] [uri "/wp-config.php"] [unique_id "Zw7Taz_2_QH_PuBtrskVGAAAAAk"] show less	Brute-Force Bad Web Bot Web App Attack
el-brujo	2024-10-15 20:15:31 (1 month ago)	15/Oct/2024:22:15:31.230177 +0200Apache-Error: [file "apache2_util.c"] [line 271] [level 3] [client ... show more15/Oct/2024:22:15:31.230177 +0200Apache-Error: [file "apache2_util.c"] [line 271] [level 3] [client 52.169.24.106] ModSecurity: Warning. Matched phrase "gzdecode" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/activated_rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "295"] [id "933150"] [msg "PHP Injection Attack: High-Risk PHP Function Name Found"] [data "Matched Data: gzdecode found within REQUEST_FILENAME: /wp-includes/simplepie/gzdecodes.php.suspected"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.4"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "elhacker.info"] [uri "/wp-includes/SimplePie/gzdecodes.php.suspected"] [unique_id "Zw7NY12IAbUO74rZ5ckthwAA7Tg"] ... show less	Hacking Web App Attack
ph	2024-10-15 18:49:07 (1 month ago)	Bad web bot attempting to run wp-includes on non-WP site	Hacking Bad Web Bot Web App Attack
Anonymous	2024-10-15 17:58:02 (1 month ago)	Malicious activity detected	Hacking Web App Attack
strefapi_com	2024-10-15 17:54:20 (1 month ago)	Brute-force web ...	Hacking Brute-Force Web App Attack
Roderic	2024-10-15 17:52:57 (1 month ago)	(apache-scanners) Failed apache-scanners trigger with match [redacted] from 52.169.24.106 (IE/Irelan ... show more(apache-scanners) Failed apache-scanners trigger with match [redacted] from 52.169.24.106 (IE/Ireland/-) show less	Port Scan
Anonymous	2024-10-15 17:42:23 (1 month ago)	Inappropriate script execution attempts	Hacking Brute-Force
Anonymous	2024-10-15 17:41:17 (1 month ago)	(apache-scanners) Failed apache-scanners trigger with match [redacted] from 52.169.24.106 (IE/Irelan ... show more(apache-scanners) Failed apache-scanners trigger with match [redacted] from 52.169.24.106 (IE/Ireland/-) show less	Port Scan
Anonymous	2024-10-15 09:11:26 (1 month ago)	wordpress-trap	Web App Attack