JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 52.173.238.41

52.173.238.41 was found in our database!

This IP was reported 167 times. Confidence of Abuse is 100%: ?

100%

ISP	Microsoft Corporation
Usage Type	Data Center/Web Hosting/Transit
ASN	AS8075
Domain Name	microsoft.com
Country	🇺🇸 United States of America
City	Des Moines, Iowa

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 52.173.238.41

Whois 52.173.238.41

IP Abuse Reports for 52.173.238.41:

This IP address has been reported a total of 167 times from 134 distinct sources. 52.173.238.41 was first reported on June 2nd 2026, and the most recent report was 18 hours ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇩🇪 yvoictra	2026-06-02 12:59:27 (2 days ago)	52.173.238.41 - - [02/Jun/2026:14:59:05 +0200] "GET /wp-content/themes/twenty/twenty.php HTTP/1.1" 4 ... show more 52.173.238.41 - - [02/Jun/2026:14:59:05 +0200] "GET /wp-content/themes/twenty/twenty.php HTTP/1.1" 404 19 "-" "-" 52.173.238.41 - - [02/Jun/2026:14:59:05 +0200] "GET /wp-admin/images/cloud.php HTTP/1.1" 404 19 "-" "-" 52.173.238.41 - - [02/Jun/2026:14:59:05 +0200] "GET /wp-admin/css/about.php HTTP/1.1" 404 19 "-" "-" 52.173.238.41 - - [02/Jun/2026:14:59:06 +0200] "GET /wp-includes/customize/about.php HTTP/1.1" 404 19 "-" "-" 52.173.238.41 - - [02/Jun/2026:14:59:07 +0200] "GET /wp-includes/images/smilies/about.php HTTP/1.1" 404 19 "-" "-" 52.173.238.41 - - [02/Jun/2026:14:59:07 +0200] "GET /wp-includes/SimplePie/about.php HTTP/1.1" 404 19 "-" "-" 52.173.238.41 - - [02/Jun/2026:14:59:08 +0200] "GET /files.php HTTP/1.1" 404 19 "-" "-" 52.173.238.41 - - [02/Jun/2026:14:59:08 +0200] "GET /wp-includes/Text/index.php HTTP/1.1" 404 19 "-" "-" 52.173.238.41 - - [02/Jun/2026:14:59:08 +0200] "GET /wp-content/upgrade-temp-backup/about.php HTTP/1.1" 404 19 "-" "-" 52.173.238.41 - - [02/Jun/2026:14: ... show less	Brute-Force Web App Attack
🇫🇮 stinpriza	2026-06-02 12:59:07 (2 days ago)	Web App Attack	Web App Attack
🇪🇸 elcruzado.es	2026-06-02 12:58:22 (2 days ago)	(apache-scanners) Failed apache-scanners trigger with match [redacted] from 52.173.238.41 (US/United ... show more (apache-scanners) Failed apache-scanners trigger with match [redacted] from 52.173.238.41 (US/United States/-) show less	Port Scan
🇪🇸 robotstxt	2026-06-02 12:57:27 (2 days ago)	52.173.238.41 - - [02/Jun/2026:12:57:03 +0000] "GET /wp-signup.php HTTP/1.1" 404 146 "-" "-" "-" 52. ... show more 52.173.238.41 - - [02/Jun/2026:12:57:03 +0000] "GET /wp-signup.php HTTP/1.1" 404 146 "-" "-" "-" 52.173.238.41 - - [02/Jun/2026:12:57:15 +0000] "GET /wp-admin.php HTTP/1.1" 404 146 "-" "-" "-" 52.173.238.41 - - [02/Jun/2026:12:57:21 +0000] "GET /cgi-bin/xmrlpc.php HTTP/1.1" 404 146 "-" "-" "-" 52.173.238.41 - - [02/Jun/2026:12:57:26 +0000] "GET /cgi-bin/index.php HTTP/1.1" 404 146 "-" "-" "-" 52.173.238.41 - - [02/Jun/2026:12:57:27 +0000] "GET /wp-login.php HTTP/1.1" 404 146 "-" "-" "-" ... show less	Bad Web Bot
🇩🇪 Petros Stefanakis	2026-06-02 12:49:28 (2 days ago)	(mod_security) mod_security triggered on hostname [redacted] 52.173.238.41 (US/United States/-)	SQL Injection
🇩🇪 sdos.es	2026-06-02 12:47:49 (2 days ago)	"Restricted File Access Attempt - Matched Data: wp-config.php found within REQUEST_FILENAME: /wp-con ... show more "Restricted File Access Attempt - Matched Data: wp-config.php found within REQUEST_FILENAME: /wp-config.php" show less	Web App Attack
🇺🇸 masterguru	2026-06-02 12:45:42 (2 days ago)	Too much 404 requests in 1 hour. Operator GE matched 50 at IP:block_script. (4002-169)	Hacking Web App Attack
🇩🇪 netclix.gr	2026-06-02 12:42:51 (2 days ago)	(aggressive_scan) Aggressive Web Exploit Scan 52.173.238.41 (US/United States/-): 5 in the last 4600 ... show more (aggressive_scan) Aggressive Web Exploit Scan 52.173.238.41 (US/United States/-): 5 in the last 4600 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: 52.173.238.41 - - [02/Jun/2026:15:41:44 +0300] "GET /.well-known/pki-validation/index.php HTTP/1.1" 404 146 "-" "-" 52.173.238.41 - - [02/Jun/2026:15:41:44 +0300] "GET /.well-known/acme-challenge/about.php HTTP/1.1" 404 146 "-" "-" 52.173.238.41 - - [02/Jun/2026:15:42:03 +0300] "GET /.well-known/acme-challenge/index.php HTTP/1.1" 404 146 "-" "-" 52.173.238.41 - - [02/Jun/2026:15:42:40 +0300] "GET /.well-known/pki-validation/xmrlpc.php HTTP/1.1" 404 146 "-" "-" 52.173.238.41 - - [02/Jun/2026:15:42:46 +0300] "GET /.well-known/pki-validation/about.php HTTP/1.1" 404 146 "-" "-" show less	Port Scan
🇩🇪 dbmwebdesign	2026-06-02 12:40:28 (2 days ago)	WordPress login brute-force detected by Fail2Ban in plesk-wordpress jail	Brute-Force Web App Attack
🇩🇪 ecs.ge	2026-06-02 12:39:00 (2 days ago)	Automatic Fail2Ban report from jail plesk-modsecurity: multiple matching events detected.	Web App Attack Hacking
🇺🇸 abenage	2026-06-02 12:35:33 (2 days ago)	52.173.238.41 - - [02/Jun/2026:06:35:32 -0600] "GET /wp-content/plugins/hellopress/wp_filemanager.ph ... show more 52.173.238.41 - - [02/Jun/2026:06:35:32 -0600] "GET /wp-content/plugins/hellopress/wp_filemanager.php HTTP/1.1" 404 162 "-" "-" show less	Bad Web Bot Web App Attack
🇺🇸 Operator873	2026-06-02 12:31:48 (2 days ago)	2026/06/02 06:06:06 [error] 2715722#0: 3588527 access forbidden by rule, client: 52.173.238.41, ser ... show more 2026/06/02 06:06:06 [error] 2715722#0: 3588527 access forbidden by rule, client: 52.173.238.41, server: [OBFUSCATED], request: "GET /wp-content/plugins/hellopress/wp_filemanager.php HTTP/1.1", host: "cockpit.n5txl.com" 2026/06/02 06:06:06 [error] 2715722#0: 3588527 access forbidden by rule, client: 52.173.238.41, server: [OBFUSCATED], request: "GET /wp-content/plugins/hellopress/wp_filemanager.php HTTP/1.1", host: "cockpit.n5txl.com" 2026/06/02 07:31:36 [error] 2715722#0: 3591804 access forbidden by rule, client: 52.173.238.41, server: [OBFUSCATED], request: "GET /wp-content/plugins/hellopress/wp_filemanager.php HTTP/1.1", host: "pistar.n5txl.com" 2026/06/02 07:31:36 [error] 2715722#0: 3591804 access forbidden by rule, client: 52.173.238.41, server: [OBFUSCATED], request: "GET /wp-content/plugins/hellopress/wp_filemanager.php HTTP/1.1", host: "pistar.n5txl.com" 2026/06/02 07:31:46 [error] 2715722#0: 3591804 access forbidden by rule, client: 52.173.238.41, server: dns.8 ... show less	Brute-Force Web App Attack
🇺🇸 TPI-Abuse	2026-06-02 12:29:47 (2 days ago)	(mod_security) mod_security (id:210492) triggered by 52.173.238.41 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:210492) triggered by 52.173.238.41 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jun 02 08:29:42.557239 2026] [security2:error] [pid 4231:tid 4231] [client 52.173.238.41:8679] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpanel.puckerbottombikinis.com"] [uri "/wp-config.php"] [unique_id "ah7Mtu36BzLSrmLzJWc5twAAAA4"] show less	Brute-Force Bad Web Bot Web App Attack
🇬🇧 djboddington	2026-06-02 12:21:05 (2 days ago)	This IP was detected by CrowdSec triggering crowdsecurity/http-backdoors-attempts	Exploited Host Hacking
Anonymous	2026-06-02 12:16:59 (2 days ago)	[ns65.kdns.gr] httpd-suspicious-path: sites=global; logs=/var/log/httpd/access_log; samples=/wp-cont ... show more [ns65.kdns.gr] httpd-suspicious-path: sites=global; logs=/var/log/httpd/access_log; samples=/wp-content/plugins/hellopress/wp_filemanager.php \| /admin/controller/extension/extension/ultra.php \| /wp-includes/about.php show less	Hacking Web App Attack

Showing 61 to 75 of 167 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇭🇰 2406:da1e:4b7:e600:f048:cba2:3152:e2c6

🇨🇴 190.85.126.78

🇲🇽 186.96.145.241

🇫🇷 185.177.72.11

🇮🇷 185.155.8.29

🇨🇦 142.44.225.190

🇮🇳 103.173.147.197

🇦🇪 95.182.89.109

🇺🇸 69.169.101.243

🇧🇷 170.246.0.111

🇭🇰 152.32.189.59

🇨🇦 142.44.233.39

🇧🇷 129.121.52.189

🇮🇳 122.187.227.167

🇨🇳 121.229.156.15

🇨🇳 101.96.202.48

🇳🇱 89.248.163.200

🇨🇦 54.39.203.33

🇧🇷 45.162.8.14

🇳🇱 45.148.10.121