JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 52.184.38.158

52.184.38.158 was found in our database!

This IP was reported 88 times. Confidence of Abuse is 100%: ?

100%

ISP	Microsoft Corporation
Usage Type	Data Center/Web Hosting/Transit
ASN	AS8075
Domain Name	microsoft.com
Country	🇭🇰 Hong Kong
City	Hong Kong

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 52.184.38.158

Whois 52.184.38.158

IP Abuse Reports for 52.184.38.158:

This IP address has been reported a total of 88 times from 72 distinct sources. 52.184.38.158 was first reported on July 11th 2026, and the most recent report was 2 days ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇩🇪 Holger	2026-07-17 18:11:40 (2 days ago)	WordPress WebAttack	Brute-Force Web App Attack
🇩🇪 ghostwarriors	2026-07-17 03:54:46 (3 days ago)	Webpage scraping	Brute-Force Bad Web Bot Web App Attack
🇩🇪 Holger	2026-07-14 06:13:30 (6 days ago)	WordPress WebAttack	Brute-Force Web App Attack
Anonymous	2026-07-12 14:02:57 (1 week ago)	Blocked by FortiWeb WAF ML threat detection. ML probability: 99%, Country: HK, Attack patterns: Word ... show more Blocked by FortiWeb WAF ML threat detection. ML probability: 99%, Country: HK, Attack patterns: WordPress scanning, Webshell probing, Malicious User-Agent show less	Bad Web Bot Web App Attack
🇧🇪 taivas.nl	2026-07-12 04:32:21 (1 week ago)	Many_bad_calls	Web App Attack
🇭🇺 DumaNet	2026-07-12 02:59:00 (1 week ago)	Web app attack attempts, scanning for vulnerability. Date: 2026 Jul 11. 21:50:35 Source IP: 52.184 ... show more Web app attack attempts, scanning for vulnerability. Date: 2026 Jul 11. 21:50:35 Source IP: 52.184.38.158 Portion of the log(s): 52.184.38.158 - [11/Jul/2026:21:50:32 +0200] "GET /wp-admin/css/ HTTP/1.1" 404 153 "-" "-" 52.184.38.158 - [11/Jul/2026:21:50:32 +0200] "GET /bob.php HTTP/1.1" 404 153 "-" "-" 52.184.38.158 - [11/Jul/2026:21:50:31 +0200] "GET /wp-includes/ID3/about.php HTTP/1.1" 404 153 "-" "-" 52.184.38.158 - [11/Jul/2026:21:50:31 +0200] "GET /.well-known/about.php HTTP/1.1" 404 153 "-" "-" 52.184.38.158 - [11/Jul/2026:21:50:31 +0200] "GET /2P.php HTTP/1.1" 404 153 "-" "-" 52.184.38.158 - [11/Jul/2026:21:50:31 +0200] "GET /wp-admin/css/colour.php HTTP/1.1" 404 153 "-" "-" 52.184.38.158 - [11/Jul/2026:21:50:31 +0200] "GET /wp-admin/js/ HTTP/1.1" 404 153 "-" "-" 52.184.38.158 - [11/Jul/2026:21:50:30 +0200] "GET /wp-includes/blocks/post-comments-form/ HTTP/1.1" 404 153 "-" "-" 52.184.38.158 - [11/Jul/2026:21:50:30 +0200] "GET /wefile.php HTTP/1.1" 404 153 "-" "-" show less	Web App Attack
🇭🇺 DumaNet	2026-07-12 02:26:00 (1 week ago)	Web app attack attempts, scanning for vulnerability. Date: 2026 Jul 11. 21:39:50 Source IP: 52.184 ... show more Web app attack attempts, scanning for vulnerability. Date: 2026 Jul 11. 21:39:50 Source IP: 52.184.38.158 Portion of the log(s): 52.184.38.158 - [11/Jul/2026:21:39:48 +0200] "GET /w2025.php HTTP/1.1" 404 153 "-" "-" 52.184.38.158 - [11/Jul/2026:21:39:48 +0200] "GET /fpwch.php HTTP/1.1" 404 153 "-" "-" 52.184.38.158 - [11/Jul/2026:21:39:47 +0200] "GET /w.php HTTP/1.1" 404 153 "-" "-" 52.184.38.158 - [11/Jul/2026:21:39:47 +0200] "GET /k5.php HTTP/1.1" 404 153 "-" "-" 52.184.38.158 - [11/Jul/2026:21:39:46 +0200] "GET /k4.php HTTP/1.1" 404 153 "-" "-" 52.184.38.158 - [11/Jul/2026:21:39:46 +0200] "GET /k3.php HTTP/1.1" 404 153 "-" "-" 52.184.38.158 - [11/Jul/2026:21:39:46 +0200] "GET /k2.php HTTP/1.1" 404 153 "-" "-" 52.184.38.158 - [11/Jul/2026:21:39:45 +0200] "GET /k.php HTTP/1.1" 404 153 "-" "-" 52.184.38.158 - [11/Jul/2026:21:39:45 +0200] "GET /ups.php HTTP/1.1" 404 153 "-" "-" 52.184.38.158 - [11/Jul/2026:21:39:45 +0200] "GET /d62.php HTTP/1.1" 404 153 "-" "-" show less	Web App Attack
🇳🇱 WeCloudit-Anti-Abuse	2026-07-12 02:02:41 (1 week ago)	This IP was detected by CrowdSec triggering crowdsecurity/http-probing	Web App Attack Hacking
🇧🇪 Saec	2026-07-12 01:40:02 (1 week ago)	Jarvis auto-ban: CF top attacker on saec.me (56 hits, HK)	Port Scan Web App Attack
🇫🇷 cydit.eu	2026-07-12 01:36:38 (1 week ago)	phpMyAdmin attack detected by fail2ban on thor.cydit.eu	Web App Attack
🇫🇷 ✨	2026-07-12 01:28:05 (1 week ago)	Domain : projects-mailing.co.uk Rule : hack 2026-07-12 01:26:42 *hidden-privacy* GET /admin.php ... show more Domain : projects-mailing.co.uk Rule : hack 2026-07-12 01:26:42 *hidden-privacy* GET /admin.php - 80 - 52.184.38.158 HTTP/1.1 - - projects-mailing.co.uk 301 0 0 428 58 236 - - show less	Hacking SQL Injection Brute-Force
Anonymous	2026-07-12 00:56:55 (1 week ago)	52.184.38.158 - - [12/Jul/2026:08:56:53 +0800] "GET /wp-content/plugins/hellopress/wp_filemanager.ph ... show more 52.184.38.158 - - [12/Jul/2026:08:56:53 +0800] "GET /wp-content/plugins/hellopress/wp_filemanager.php HTTP/1.1" 404 196 "-" "-" 52.184.38.158 - - [12/Jul/2026:08:56:53 +0800] "GET /this_is_a_new_hello_world.php HTTP/1.1" 404 16 "-" "-" 52.184.38.158 - - [12/Jul/2026:08:56:53 +0800] "GET /100.php HTTP/1.1" 404 16 "-" "-" 52.184.38.158 - - [12/Jul/2026:08:56:53 +0800] "GET /elp.php HTTP/1.1" 404 16 "-" "-" 52.184.38.158 - - [12/Jul/2026:08:56:54 +0800] "GET /ftde.php HTTP/1.1" 404 16 "-" "-" 52.184.38.158 - - [12/Jul/2026:08:56:54 +0800] "GET /test1.php HTTP/1.1" 404 16 "-" "-" 52.184.38.158 - - [12/Jul/2026:08:56:54 +0800] "GET /wp-temp.php HTTP/1.1" 404 16 "-" "-" 52.184.38.158 - - [12/Jul/2026:08:56:54 +0800] "GET /admin/function.php HTTP/1.1" 404 196 "-" "-" 52.184.38.158 - - [12/Jul/2026:08:56:54 +0800] "GET /atomlib.php HTTP/1.1" 404 16 "-" "-" 52.184.38.158 - - [12/Jul/2026:08:56:54 +0800] "GET /fm.php HTTP/1.1" 404 16 "-" "-" ... show less	Bad Web Bot Web App Attack
🇷🇴 SpamStopper	2026-07-12 00:34:17 (1 week ago)	Fail2Ban - WordPress\(Anomis\) Looking for CMS/PHP/SQL vulnerabilities and hacked web hosts servers	Hacking Brute-Force Bad Web Bot Web App Attack
🇩🇪 YF	2026-07-12 00:00:19 (1 week ago)	Attaque distribuée subnet	DDoS Attack Web App Attack
🇦🇺 2000cn.com.au	2026-07-11 22:37:57 (1 week ago)	This IP was detected by CrowdSec triggering crowdsecurity/http-admin-interface-probing	Web App Attack Hacking

Showing 1 to 15 of 88 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇭🇰 223.197.186.7

🇺🇸 195.184.76.229

🇺🇸 136.117.82.83

🇲🇾 115.164.37.9

🇺🇸 100.29.192.75

🇧🇷 45.235.150.225

🇫🇷 45.157.112.81

🇺🇸 34.69.177.231

🇨🇳 27.12.97.43

🇺🇸 209.38.70.184

🇳🇱 193.110.157.47

🇲🇽 186.96.145.241

🇮🇩 163.7.5.228

🇹🇷 149.86.142.226

🇫🇷 84.247.133.161

🇮🇹 78.134.49.171

🇧🇬 78.128.114.102

🇵🇱 37.120.156.26

🇷🇺 31.171.197.105

🇺🇸 170.106.180.55