JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 52.176.22.166

52.176.22.166 was found in our database!

This IP was reported 204 times. Confidence of Abuse is 100%: ?

100%

ISP	Microsoft Corporation
Usage Type	Data Center/Web Hosting/Transit
ASN	AS8075
Domain Name	microsoft.com
Country	🇺🇸 United States of America
City	Des Moines, Iowa

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 52.176.22.166

Whois 52.176.22.166

IP Abuse Reports for 52.176.22.166:

This IP address has been reported a total of 204 times from 172 distinct sources. 52.176.22.166 was first reported on June 1st 2026, and the most recent report was 17 hours ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇲🇾 Rizzy	2026-06-01 11:37:26 (2 days ago)	Multiple WAF Violations	Brute-Force Web App Attack
🇱🇻 garmtech.com	2026-06-01 11:32:06 (2 days ago)	Attempted access to sensitive endpoint (/wp-content/plugins/hellopress/wp_filemanager.php) detected. ... show more Attempted access to sensitive endpoint (/wp-content/plugins/hellopress/wp_filemanager.php) detected. Automated scan or unauthorized probing. show less	Web App Attack
🇩🇪 Viveronese	2026-06-01 11:27:06 (2 days ago)	HTTP vulnerability scanning	Web App Attack
🇨🇭 zynex	2026-06-01 11:26:43 (2 days ago)	URL Probing: /md5.php	Web App Attack
🇺🇸 Vianpyro	2026-06-01 11:25:42 (2 days ago)	Honeypot: 9 request(s) in 0 min. Paths: /wp-content/plugins/hellopress/wp_filemanager.php, /md5.php, ... show more Honeypot: 9 request(s) in 0 min. Paths: /wp-content/plugins/hellopress/wp_filemanager.php, /md5.php, /lock360.php, /waq.php, /garcoy.php. Method(s): GET. ASN: 8075 (Microsoft Corporation). show less	Web App Attack Bad Web Bot Brute-Force Hacking
🇳🇱 wlt-blocker	2026-06-01 11:23:54 (2 days ago)	Unauthorized access to webpage admin	Web App Attack
🇺🇸 Mehmet_The_Script_Kiddie	2026-06-01 11:22:12 (2 days ago)	CloudFlare WAF REPORT: /w.php	Bad Web Bot Web App Attack
🇫🇷 PacketFilter	2026-06-01 11:22:03 (2 days ago)	Fail2Ban	Hacking Web App Attack
🇺🇸 Gabriel Camargo	2026-06-01 11:19:24 (2 days ago)	52.176.22.166 - - [01/Jun/2026:06:19:23 -0500] "GET /wp-content/plugins/hellopress/wp_filemanager.ph ... show more 52.176.22.166 - - [01/Jun/2026:06:19:23 -0500] "GET /wp-content/plugins/hellopress/wp_filemanager.php HTTP/1.1" 301 178 "-" "-" 52.176.22.166 - - [01/Jun/2026:06:19:24 -0500] "GET /md5.php HTTP/1.1" 301 178 "-" "-" 52.176.22.166 - - [01/Jun/2026:06:19:24 -0500] "GET /lock360.php HTTP/1.1" 301 178 "-" "-" ... show less	Brute-Force SSH
🇸🇪 SkyDancer	2026-06-01 11:11:48 (2 days ago)	Multiple intrusion attempts via http/https on known vulnerable url offsets. Attack automatically blo ... show more Multiple intrusion attempts via http/https on known vulnerable url offsets. Attack automatically blocked by SkyDancer Ai(web-X). show less	Hacking Brute-Force
🇭🇺 bcsaba	2026-06-01 11:06:19 (2 days ago)	Looking for WP FILEMANAGER 52.176.22.166 - - [01/Jun/2026:13:06:17 +0200] "GET /wp-content/plugins/h ... show more Looking for WP FILEMANAGER 52.176.22.166 - - [01/Jun/2026:13:06:17 +0200] "GET /wp-content/plugins/hellopress/wp_filemanager.php HTTP/1.1" 400 230 "-" "-" show less	Web App Attack
🇫🇷 masterguru	2026-06-01 11:05:59 (2 days ago)	(modsec_5080) ModSec 5080: Infrastructure subdomain probe from 52.176.22.166 (US/United States/-): 1 ... show more (modsec_5080) ModSec 5080: Infrastructure subdomain probe from 52.176.22.166 (US/United States/-): 1 in the last 3600 secs (0-197) show less	Hacking
🇩🇪 maxpower	2026-06-01 11:01:04 (2 days ago)	(aggressive_scanner) REGOLA 9 - Aggressive Web Scanner 52.176.22.166 (US/United States/-): 1 in the ... show more (aggressive_scanner) REGOLA 9 - Aggressive Web Scanner 52.176.22.166 (US/United States/-): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: 52.176.22.166 - - [01/Jun/2026:13:00:57 +0200] "GET /wp-content/plugins/hellopress/wp_filemanager.php HTTP/1.1" 301 315 "-" "-" "-" host=contora.it show less	Port Scan
🇸🇬 serverutama	2026-06-01 11:00:13 (2 days ago)	Nginx scanner: 52.176.22.166 - - [01/Jun/2026:17:49:35 +0700] "GET /wp-content/plugins/hellopress/wp ... show more Nginx scanner: 52.176.22.166 - - [01/Jun/2026:17:49:35 +0700] "GET /wp-content/plugins/hellopress/wp_filemanager.php HTTP/1.1" 301 162 "-" "-" "-" 52.176.22.166 - - [01/Jun/2026:17:49:36 +0700] "GET /wp-content/plugins/hellopress/wp_filemanager.php HTTP/1.1" 444 0 "-" "-" "-" show less	Web App Attack Bad Web Bot
🇮🇩 sockominfo	2026-06-01 11:00:12 (2 days ago)	Webshell discovery success (Response: 200). Threat Score: 7.9/10 (HIGH). Reported by TangerangKota-C ... show more Webshell discovery success (Response: 200). Threat Score: 7.9/10 (HIGH). Reported by TangerangKota-CSIRT. Status: MALICIOUS show less	Hacking Email Spam

Showing 181 to 195 of 204 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇮🇳 103.187.166.217

🇨🇦 85.217.149.44

🇺🇸 45.156.129.75

🇧🇪 35.189.196.224

🇺🇸 207.241.173.236

🇸🇦 129.208.126.112

🇨🇳 120.85.117.135

🇳🇱 89.105.195.118

🇳🇴 88.90.192.241

🇭🇰 74.125.179.149

🇺🇸 66.132.195.80

🇭🇰 58.152.42.174

🇨🇳 42.228.234.249

🇺🇸 2001:470:1:c84::18b

🇩🇪 167.94.146.35

🇺🇸 162.216.149.241

🇺🇸 147.185.132.164

🇮🇳 122.177.246.105

🇳🇱 77.83.39.95

🇸🇬 47.84.101.132