JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 52.175.54.180

52.175.54.180 was found in our database!

This IP was reported 66 times. Confidence of Abuse is 100%: ?

100%

ISP	Microsoft Corporation
Usage Type	Data Center/Web Hosting/Transit
ASN	AS8075
Domain Name	microsoft.com
Country	🇭🇰 Hong Kong
City	Hong Kong

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 52.175.54.180

Whois 52.175.54.180

IP Abuse Reports for 52.175.54.180:

This IP address has been reported a total of 66 times from 47 distinct sources. 52.175.54.180 was first reported on July 7th 2026, and the most recent report was 6 hours ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇺🇸 Epimetheus	2026-07-07 22:08:23 (6 hours ago)	Unauthorized access attempts: [GET] /files.php [GET] /postnews.php [GET] /phpinfo.php [GET] /wp-adm ... show more Unauthorized access attempts: [GET] /files.php [GET] /postnews.php [GET] /phpinfo.php [GET] /wp-admin/postnews.php [GET] /phptest.php [GET] /xmu.php [GET] /uwa.php [GET] /unvouc.php [GET] /wp-xme.php [GET] /main.php [GET] /settings.php [GET] /tmp.php [GET] /wp-content/plugins/hellopress/wp_filemanager.php [GET] /xmlss.php [GET] /dex.php [GET] /g.php [GET] /wp-admin/style.php [GET] /init.php UA: Unknown show less	Web App Attack
🇺🇸 mnsf	2026-07-07 22:05:13 (6 hours ago)	Too many Status 40X (20)	Brute-Force Web App Attack
🇺🇸 TPI-Abuse	2026-07-07 22:01:56 (6 hours ago)	(mod_security) mod_security (id:210492) triggered by 52.175.54.180 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:210492) triggered by 52.175.54.180 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jul 07 18:01:50.031083 2026] [security2:error] [pid 8648:tid 8648] [client 52.175.54.180:9706] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "autodiscover.vmbinc.com"] [uri "/wp-config.php"] [unique_id "ak13TumrABX7GGb_itE-swAAABI"] show less	Brute-Force Bad Web Bot Web App Attack
🇳🇱 homeshowdomain.nl	2026-07-07 22:00:19 (6 hours ago)	Auto-ban: >3000 req/min op 2026-07-07	Web App Attack SSH Hacking
🇫🇮 inlink.ltd	2026-07-07 21:49:32 (6 hours ago)	Known malicious PHP file or CMS probe	Web App Attack
🇨🇦 Mediashaker	2026-07-07 21:27:34 (6 hours ago)	(apache-scanners) Failed apache-scanners trigger with match [redacted] from 52.175.54.180 (HK/Hong K ... show more (apache-scanners) Failed apache-scanners trigger with match [redacted] from 52.175.54.180 (HK/Hong Kong/-) show less	Port Scan
🇺🇸 TPI-Abuse	2026-07-07 21:23:11 (6 hours ago)	(mod_security) mod_security (id:210492) triggered by 52.175.54.180 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:210492) triggered by 52.175.54.180 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jul 07 17:23:06.504680 2026] [security2:error] [pid 19192:tid 19192] [client 52.175.54.180:10675] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "deploy6tharmy.com.mininoarg.com"] [uri "/wp-config.php"] [unique_id "ak1uOpWGoAkz9Wp6hitDUwAAAAY"] show less	Brute-Force Bad Web Bot Web App Attack
🇩🇪 FeG Deutschland	2026-07-07 21:04:35 (7 hours ago)	Looking for CMS/PHP/SQL vulnerablilities/excessive crawling - 24	Exploited Host Web App Attack
🇺🇸 TPI-Abuse	2026-07-07 20:57:09 (7 hours ago)	(mod_security) mod_security (id:210492) triggered by 52.175.54.180 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:210492) triggered by 52.175.54.180 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jul 07 16:57:03.389638 2026] [security2:error] [pid 28832:tid 28832] [client 52.175.54.180:11587] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "autodiscover.lockmytitle.com"] [uri "/wp-config.php"] [unique_id "ak1oH8TGVwHIHZ8F4566jgAAACI"] show less	Brute-Force Bad Web Bot Web App Attack
🇫🇷 Catalin Negru	2026-07-07 20:52:17 (7 hours ago)	Recidive ban by fail2ban on server.blackbit.ro	Brute-Force
🇨🇭 zynex	2026-07-07 20:35:10 (7 hours ago)	URL Probing: /wp-content/plugins/hellopress/wp_filemanager.php	Web App Attack
🇪🇸 alferez	2026-07-07 20:21:21 (7 hours ago)	Searching hacked php files	Hacking Exploited Host Web App Attack
🇺🇸 TPI-Abuse	2026-07-07 20:17:08 (8 hours ago)	(mod_security) mod_security (id:210492) triggered by 52.175.54.180 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:210492) triggered by 52.175.54.180 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jul 07 16:17:02.716731 2026] [security2:error] [pid 13685:tid 13685] [client 52.175.54.180:13427] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpcontacts.network22.net"] [uri "/wp-config.php"] [unique_id "ak1evoqaXVXDiUb4IxpN2QAAAA0"] show less	Brute-Force Bad Web Bot Web App Attack
🇫🇷 masterguru	2026-07-07 20:10:10 (8 hours ago)	Too much 404 requests in 1 minute. Operator GE matched 10 at IP:block_script. (46020-197)	Hacking
🇩🇪 R.G.	2026-07-07 20:02:12 (8 hours ago)	(ScanningForFiles) Scanning for files triggerd 52.175.54.180 (HK/Hong Kong/-): 10 in the last 900 se ... show more (ScanningForFiles) Scanning for files triggerd 52.175.54.180 (HK/Hong Kong/-): 10 in the last 900 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: show less	Web App Attack

Showing 1 to 15 of 66 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇩🇪 194.187.176.108

🇩🇪 185.242.3.129

🇩🇪 172.70.240.93

🇮🇳 122.160.137.230

🇷🇴 92.118.39.171

🇺🇸 81.30.98.204

🇱🇹 81.30.98.27

🇱🇹 62.60.130.234

🇳🇱 45.148.10.141

🇰🇷 211.253.31.30

🇳🇱 204.76.203.81

🇺🇸 172.71.158.253

🇰🇷 121.131.220.156

🇰🇷 112.217.188.122

🇮🇳 103.88.77.140

🇸🇬 97.74.87.152

🇳🇱 91.92.40.13

🇷🇴 80.94.92.152

🇩🇪 69.5.169.140

🇫🇷 51.77.158.34