JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 52.173.161.248

52.173.161.248 was found in our database!

This IP was reported 1,076 times. Confidence of Abuse is 100%: ?

100%

ISP	Microsoft Corporation
Usage Type	Data Center/Web Hosting/Transit
ASN	AS8075
Domain Name	microsoft.com
Country	🇺🇸 United States of America
City	Des Moines, Iowa

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 52.173.161.248

Whois 52.173.161.248

IP Abuse Reports for 52.173.161.248:

This IP address has been reported a total of 1,076 times from 618 distinct sources. 52.173.161.248 was first reported on July 24th 2026, and the most recent report was 5 seconds ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇺🇸 Charlesiv	2026-07-26 02:03:42 (5 seconds ago)	Triggered Cloudflare WAF (botFight) from US. Action taken: MANAGED_CHALLENGE ASN: 8075 (Microsoft Co ... show more Triggered Cloudflare WAF (botFight) from US. Action taken: MANAGED_CHALLENGE ASN: 8075 (Microsoft Corporation) Protocol: HTTP/1.1 (GET method) Endpoint: /wp-admin/includes/class-custom-background.php Timestamp: 2026-07-26T01:41:59Z Ray ID: a20fb4888b8d9d42 UA: Empty string show less	Bad Web Bot
🇧🇪 webbie	2026-07-26 02:01:16 (2 minutes ago)	52.173.161.248 - - [26/Jul/2026:04:01:14 +0200] "GET /wp-content/plugins/hellopress/wp_filemanager.p ... show more 52.173.161.248 - - [26/Jul/2026:04:01:14 +0200] "GET /wp-content/plugins/hellopress/wp_filemanager.php HTTP/1.1" 404 5202 "-" "-" 52.173.161.248 - - [26/Jul/2026:04:01:15 +0200] "GET /this_is_a_new_hello_world.php HTTP/1.1" 404 403 "-" "-" 52.173.161.248 - - [26/Jul/2026:04:01:15 +0200] "GET /vjzvvrhr.pdf.phtml HTTP/1.1" 404 403 "-" "-" 52.173.161.248 - - [26/Jul/2026:04:01:15 +0200] "GET /fetwgsoq.phtml HTTP/1.1" 404 403 "-" "-" 52.173.161.248 - - [26/Jul/2026:04:01:15 +0200] "GET /WgX80ACk6uYlNFRMCBkzMEnxVna4PIv.php HTTP/1.1" 404 403 "-" "-" ... show less	Brute-Force Web App Attack
🇩🇪 macrob	2026-07-26 02:00:54 (2 minutes ago)	2026/07/26 02:00:35 [error] 2642820#2642820: 411826234 access forbidden by rule, client: 52.173.161 ... show more 2026/07/26 02:00:35 [error] 2642820#2642820: 411826234 access forbidden by rule, client: 52.173.161.248, server: bin.partners, request: "GET /wp-content/plugins/hellopress/wp_filemanager.php HTTP/2.0", host: "bin.partners" 2026/07/26 02:00:52 [error] 2642816#2642816: 411826315 access forbidden by rule, client: 52.173.161.248, server: bin.partners, request: "GET /wp-admin/export-personal-data.php HTTP/2.0", host: "bin.partners" 2026/07/26 02:00:52 [error] 2642815#2642815: 411827181 access forbidden by rule, client: 52.173.161.248, server: bin.partners, request: "GET /wp-admin/export-personal-data.php HTTP/2.0", host: "bin.partners" ... show less	Web App Attack
🇺🇸 Lezetho	2026-07-26 02:00:26 (3 minutes ago)	DDoS, WebSpam, Web Attack, and Brute-force blocked by Cloudflare	DDoS Attack Email Spam Hacking Brute-Force
🇳🇴 tmiland	2026-07-26 02:00:25 (3 minutes ago)	(wordpress_404) WordPress Plugins Honeypot Trap 52.173.161.248 (US/United States/-): 2 in the last 3 ... show more (wordpress_404) WordPress Plugins Honeypot Trap 52.173.161.248 (US/United States/-): 2 in the last 3600 secs; IP: 52.173.161.248; Ports: ; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: 2026/07/26 04:00:21 [error] 732831#732831: 731706 open() "/home/abuseipdb/public_html/fetwgsoq.phtml" failed (2: No such file or directory), client: 52.173.161.248, server: abuseipdb.., request: "GET /fetwgsoq.phtml HTTP/1.1", host: "abuseipdb.." 52.173.161.248 - - [26/Jul/2026:04:00:20 +0200] "GET /wp-content/plugins/hellopress/wp_filemanager.php HTTP/1.1" 404 2992 "-" "-" show less	Brute-Force
🇺🇸 Epimetheus	2026-07-26 01:56:44 (7 minutes ago)	Unauthorized access attempts: [GET] /wyzer1.php [GET] /wp-content/plugins/hellopress/wp_filemanager ... show more Unauthorized access attempts: [GET] /wyzer1.php [GET] /wp-content/plugins/hellopress/wp_filemanager.php UA: Unknown show less	Web App Attack
🇫🇮 Christopher Hughes	2026-07-26 01:55:45 (8 minutes ago)	[Sun Jul 26 02:55:44.477775 2026] [proxy_fcgi:error] [pid 2216392:tid 139826544240192] [client 52.17 ... show more [Sun Jul 26 02:55:44.477775 2026] [proxy_fcgi:error] [pid 2216392:tid 139826544240192] [client 52.173.161.248:54233] AH01071: Got error 'Primary script unknown' [Sun Jul 26 02:55:44.620933 2026] [proxy_fcgi:error] [pid 2216392:tid 139824925234752] [client 52.173.161.248:54233] AH01071: Got error 'Primary script unknown' [Sun Jul 26 02:55:44.785525 2026] [proxy_fcgi:error] [pid 2216392:tid 139825847973440] [client 52.173.161.248:54233] AH01071: Got error 'Primary script unknown' [Sun Jul 26 02:55:44.928681 2026] [proxy_fcgi:error] [pid 2216392:tid 139825881544256] [client 52.173.161.248:54233] AH01071: Got error 'Primary script unknown' [Sun Jul 26 02:55:45.071047 2026] [proxy_fcgi:error] [pid 2216392:tid 139826527454784] [client 52.173.161.248:54233] AH01071: Got error 'Primary script unknown' ... show less	Web App Attack
🇮🇪 AutosOnShow	2026-07-26 01:55:05 (8 minutes ago)	blocked for webapp attack \| path requested: /wp-admin/includes/class-custom-background.php \| seen at ... show more blocked for webapp attack \| path requested: /wp-admin/includes/class-custom-background.php \| seen at 2026-07-26 01:54:23.619 \| show less	Web App Attack
Anonymous	2026-07-26 01:52:57 (10 minutes ago)	Aggressive web scan	Web App Attack
🇫🇷 omartin	2026-07-26 01:51:59 (11 minutes ago)	Critical Vulnerability Scan detected	Hacking Brute-Force Exploited Host Web App Attack
🇺🇸 ruusvuu	2026-07-26 01:50:19 (13 minutes ago)	Automated abuse report: 117 attack/probe requests from Microsoft Corporation / US. Targeted paths: / ... show more Automated abuse report: 117 attack/probe requests from Microsoft Corporation / US. Targeted paths: /wp-content/plugins/hellopress/wp_filemanager.php, /this_is_a_new_hello_world.php, /cu.php, /aevly.php, /15ds5ock.php. Sample log lines: [mirprotocol] 2026-07-25 07:04:11: 52.173.161.248 - [07/25/2026, 07:04:11] "GET /ovajelmxf.php" 429 "-" [mirprotocol] 2026-07-25 07:04:11: 52.173.161.248 - [07/25/2026, 07:04:11] "GET /camara.php" 429 "-" [helpdesk] 7/25/2026 18:50:19 52.173.161.248 GET /xwpg.php 404 147 4.7 ms Detected by an automated web-server log monitor. show less	Web App Attack
🇭🇳 unph	2026-07-26 01:47:17 (16 minutes ago)	Intento de acceso sospechoso bloqueado por AbuseIPDB Blocker Plugin	Brute-Force
🇩🇪 NewGastroline	2026-07-26 01:41:36 (22 minutes ago)	Malicious request blocked by CrowdSec on gastro-prod1.boreus.de	Bad Web Bot Web App Attack
🇳🇱 i-turnradio.nl	2026-07-26 01:35:24 (28 minutes ago)	2026-07-26 @ 03:35:24 (CET) ~ Blocked for trying to access: /wp-content/plugins/hellopress/wp_filema ... show more 2026-07-26 @ 03:35:24 (CET) ~ Blocked for trying to access: /wp-content/plugins/hellopress/wp_filemanager.php show less	Web App Attack
🇩🇪 jocurionline	2026-07-26 01:30:04 (33 minutes ago)	Auto-blocked by WAF: AUTO-BAN: WordPress scan + AbuseIPDB 7 zile	Web App Attack Port Scan

Showing 1 to 15 of 1076 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇺🇸 2607:f8b0:400c:c15::12a

🇺🇸 216.73.217.151

🇺🇸 205.210.31.44

🇲🇾 183.171.41.89

🇳🇱 91.92.42.36

🇷🇺 213.141.130.251

🇺🇸 205.210.31.43

🇺🇸 205.210.31.39

🇰🇪 197.248.8.33

🇫🇷 194.113.235.89

🇦🇴 193.163.125.40

🇧🇷 191.7.26.153

🇲🇾 183.171.41.134

🇺🇸 147.185.132.134

🇨🇳 120.133.60.156

🇲🇾 117.53.155.126

🇫🇷 91.231.89.190

🇷🇺 91.185.75.244

🇺🇸 54.214.129.203

🇧🇷 205.210.31.254