JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 52.182.188.239

52.182.188.239 was found in our database!

This IP was reported 369 times. Confidence of Abuse is 100%: ?

100%

ISP	Microsoft Corporation
Usage Type	Data Center/Web Hosting/Transit
ASN	AS8075
Domain Name	microsoft.com
Country	🇺🇸 United States of America
City	Des Moines, Iowa

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 52.182.188.239

Whois 52.182.188.239

IP Abuse Reports for 52.182.188.239:

This IP address has been reported a total of 369 times from 297 distinct sources. 52.182.188.239 was first reported on June 1st 2026, and the most recent report was 54 minutes ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇫🇮 as211431.net	2026-06-02 00:21:42 (2 days ago)	Triggered Cloudflare WAF (firewallCustom) from US. Action taken: BLOCK Protocol: HTTP/1.1 (GET metho ... show more Triggered Cloudflare WAF (firewallCustom) from US. Action taken: BLOCK Protocol: HTTP/1.1 (GET method) Endpoint: /goods.php UA: Empty string This report was generated by: https://github.com/sefinek/Cloudflare-WAF-To-AbuseIPDB show less	Bad Web Bot
🇧🇷 Halux	2026-06-02 00:21:22 (2 days ago)	52.182.188.239 Probing protected path or service	Web App Attack
🇺🇸 jcbriar	2026-06-02 00:19:59 (2 days ago)	Searching for vulnerable scripts	Hacking Web App Attack
🇬🇧 martenmark	2026-06-02 00:15:22 (2 days ago)	52.182.188.239 - - [02/Jun/2026:00:15:21 +0000] "GET /c99.php HTTP/1.1" 301 609 "-" "-" ...	Web App Attack
🇺🇸 helios.live	2026-06-02 00:11:14 (2 days ago)	2026/06/02 00:11:14 [error] 2792982#2792982: 1559817 FastCGI sent in stderr: "Primary script unknow ... show more 2026/06/02 00:11:14 [error] 2792982#2792982: 1559817 FastCGI sent in stderr: "Primary script unknown" while reading response header from upstream, client: 52.182.188.239, server: kocerroxy.com, request: "GET /wp-content/plugins/hellopress/wp_filemanager.php HTTP/1.1", upstream: "fastcgi://unix:/var/run/php/php8.3-fpm-betakocerroxycom.sock:", host: "kocerroxy.com" 2026/06/02 00:11:14 [error] 2792982#2792982: 1559817 FastCGI sent in stderr: "Primary script unknown" while reading response header from upstream, client: 52.182.188.239, server: kocerroxy.com, request: "GET /this_is_a_new_hello_world.php HTTP/1.1", upstream: "fastcgi://unix:/var/run/php/php8.3-fpm-betakocerroxycom.sock:", host: "kocerroxy.com" 52.182.188.239 - - [02/Jun/2026:00:11:14 +0000] "GET /wp-content/plugins/hellopress/wp_filemanager.php HTTP/1.1" 404 47 "-" "-" 52.182.188.239 - - [02/Jun/2026:00:11:14 +0000] "GET /this_is_a_new_hello_world.php HTTP/1.1" 404 47 "-" "-" 2026/06/02 00:11:14 [error] 2792982#2792982: 15 ... show less	Web App Attack
🇳🇿 lancernz	2026-06-02 00:03:16 (2 days ago)	Auto-detected: 42 hits on mspc.org.nz within 100 log lines. Blocked by Cowork server monitoring.	Web App Attack
🇧🇷 Francisco Carlos	2026-06-02 00:02:52 (2 days ago)	Honeypot captured 1 automated attack/scan requests (JR Save Tech). Types: shell-upload. Sample: GET ... show more Honeypot captured 1 automated attack/scan requests (JR Save Tech). Types: shell-upload. Sample: GET /c99.php show less	Hacking Web App Attack
🇺🇸 Lezetho	2026-06-02 00:01:38 (2 days ago)	DDoS, WebSpam, Web Attack, and Brute-force blocked by Cloudflare	DDoS Attack Email Spam Hacking Brute-Force
🇸🇪 KIDOS	2026-06-02 00:00:12 (2 days ago)	CrowdSec detected malicious activity	DDoS Attack
🇫🇷 masterguru	2026-06-02 00:00:07 (2 days ago)	Too much 404 requests in 1 minute. Operator GE matched 10 at IP:block_script. (46020-196)	Hacking
🇫🇮 Christopher Hughes	2026-06-01 23:58:35 (2 days ago)	[Tue Jun 02 00:58:33.268372 2026] [proxy_fcgi:error] [pid 312170:tid 139774182540864] [client 52.182 ... show more [Tue Jun 02 00:58:33.268372 2026] [proxy_fcgi:error] [pid 312170:tid 139774182540864] [client 52.182.188.239:29652] AH01071: Got error 'Primary script unknown' [Tue Jun 02 00:58:33.555882 2026] [proxy_fcgi:error] [pid 312170:tid 139773645669952] [client 52.182.188.239:29652] AH01071: Got error 'Primary script unknown' [Tue Jun 02 00:58:34.147605 2026] [proxy_fcgi:error] [pid 312170:tid 139774786520640] [client 52.182.188.239:29652] AH01071: Got error 'Primary script unknown' [Tue Jun 02 00:58:34.774246 2026] [proxy_fcgi:error] [pid 312170:tid 139774174148160] [client 52.182.188.239:29652] AH01071: Got error 'Primary script unknown' [Tue Jun 02 00:58:35.091097 2026] [proxy_fcgi:error] [pid 312170:tid 139774182540864] [client 52.182.188.239:29652] AH01071: Got error 'Primary script unknown' ... show less	Web App Attack
🇦🇺 Anytech	2026-06-01 23:56:20 (2 days ago)	Blocked by Conn-Monitor: Web scanning activity	Web App Attack
🇧🇷 Peregrine	2026-06-01 23:52:34 (2 days ago)	Fail2Ban ct101 Jail: tomcat-404 \| Evidence: 52.182.188.239 162.159.104.162 - - [01/Jun/2026:20:52:30 ... show more Fail2Ban ct101 Jail: tomcat-404 \| Evidence: 52.182.188.239 162.159.104.162 - - [01/Jun/2026:20:52:30 -0300] "GET /.trash7309/index.php HTTP/1.1" 404 18149 52.182.188.239 162.159.104.162 - - [01/Jun/2026:20:52:30 -0300] "GET /CLA.php HTTP/1.1" 404 18149 52.182.188.239 162.159.104.162 - - [01/Jun/2026:20:52:31 -0300] "GET /aa.php HTTP/1.1" 404 18149 52.182.188.239 162.159.104.162 - - [01/Jun/2026:20:52:31 -0300] "GET /wp.php HTTP/1.1" 404 18149 52.182.188.239 162.159.104.162 - - [01/Jun/2026:20:52:32 -0300] "GET /info.php HTTP/1.1" 404 18149 show less	Bad Web Bot Web App Attack
🇮🇩 Burayot	2026-06-01 23:50:04 (2 days ago)	LF_MODSEC: (mod_security) mod_security (id:1000001) triggered by 52.182.188.239 (US/United States/-) ... show more LF_MODSEC: (mod_security) mod_security (id:1000001) triggered by 52.182.188.239 (US/United States/-): 2 in the last 3600 secs show less	Web App Attack
🇺🇸 nasset	2026-06-01 23:46:38 (2 days ago)	52.182.188.239 - - [01/Jun/2026:16:46:36 -0700] "GET /a.php HTTP/1.1" 403 584 "-" "-" 52.182.188.239 ... show more 52.182.188.239 - - [01/Jun/2026:16:46:36 -0700] "GET /a.php HTTP/1.1" 403 584 "-" "-" 52.182.188.239 - - [01/Jun/2026:16:46:36 -0700] "GET /999.php HTTP/1.1" 403 584 "-" "-" 52.182.188.239 - - [01/Jun/2026:16:46:37 -0700] "GET /new.php HTTP/1.1" 403 584 "-" "-" 52.182.188.239 - - [01/Jun/2026:16:46:37 -0700] "GET /222.php HTTP/1.1" 403 584 "-" "-" 52.182.188.239 - - [01/Jun/2026:16:46:37 -0700] "GET /file9.php HTTP/1.1" 403 584 "-" "-" ... show less	Bad Web Bot Web App Attack

Showing 256 to 270 of 369 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇨🇳 223.242.38.86

🇨🇳 143.20.246.100

🇯🇵 139.162.78.6

🇸🇬 124.156.202.242

🇺🇸 103.153.182.184

🇨🇳 101.126.154.252

🇨🇭 81.17.31.82

🇺🇸 72.178.195.51

🇺🇸 64.62.156.178

🇮🇪 54.247.199.15

🇳🇱 45.156.128.73

🇺🇸 20.168.113.228

🇨🇦 15.223.226.103

🇺🇸 195.184.76.79

🇺🇸 193.36.224.232

🇰🇷 175.45.194.6

🇧🇷 129.121.33.174

🇵🇭 112.198.132.105

🇺🇸 107.173.85.169

🇺🇸 68.84.253.152