JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

52.187.15.59

Neutral Activity

Abuse Confidence Score

0% Low Risk

59 reports

34 reporters · latest 1 year ago

ISP: Microsoft Corporation
Usage Type: Data Center/Web Hosting/Transit
ASN: AS8075
Domain Name: microsoft.com
Country: 🇸🇬 Singapore
City: Singapore

ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report Whois

No reports in the last 60 days

52.187.15.59 has been reported 59 times. The most recent report is from 1 year ago.

The full history is preserved below and remains searchable. A 0% score reflects the absence of recent activity, but this is not a guarantee that earlier reports were invalid. Abuse confidence score decays, naturally, over time, when the abusive activity stops.

Abuse Reports

Export reports CSV

Total reports

59 from 34 distinct reporters

First reported

September 7th 2025

Most recent report

1 year ago

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇺🇸 raymarron.com	2025-09-26 15:06:13 UTC · (1 year ago)	58x probes for various vulnerabilities.	Web App Attack
🇺🇸 TPI-Abuse	2025-09-08 16:33:57 UTC · (1 year ago)	(mod_security) mod_security (id:240000) triggered by 52.187.15.59 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Sep 08 12:33:53.772568 2025] [security2:error] [pid 28481:tid 28481] [client 52.187.15.59:6497] ModS ... show more (mod_security) mod_security (id:240000) triggered by 52.187.15.59 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Sep 08 12:33:53.772568 2025] [security2:error] [pid 28481:tid 28481] [client 52.187.15.59:6497] ModSecurity: Access denied with code 403 (phase 2). String match ".php" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/24_Apps_Joomla.conf"] [line "74"] [id "240000"] [rev "1"] [msg "COMODO WAF: Protecting Joomla folder\|\|hiddenhistory.info\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "Joomla"] [hostname "hiddenhistory.info"] [uri "/images/stories/admin-post.php"] [unique_id "aL8FcSK4FDw_ljCw0F0ZKgAAAAM"] show less	Brute-Force Bad Web Bot Web App Attack
Anonymous	2025-09-08 16:00:31 UTC · (1 year ago)	Aggressive web scan	Bad Web Bot Web App Attack
🇺🇸 myagent.site	2025-09-08 15:00:56 UTC · (1 year ago)	Blocking for trying to access an exploit file: /install.php	Hacking
Anonymous	2025-09-08 14:53:02 UTC · (1 year ago)	wordpress-trap	Web App Attack
Anonymous	2025-09-08 13:52:18 UTC · (1 year ago)	52.187.15.59 - - [08/Sep/2025:15:51:30 +0200] "GET /wp-content/plugins/hellopress/wp_filemanager.php HTTP/1.1" 404 6207 "-" "-" 52.187.15.59 - - [08/Sep/2025:15:51:31 +0200] "GET /wp-content/uploads/json.php HTTP/1.1" 404 515 "-" "-" 52.187.15.59 - - ... show more 52.187.15.59 - - [08/Sep/2025:15:51:30 +0200] "GET /wp-content/plugins/hellopress/wp_filemanager.php HTTP/1.1" 404 6207 "-" "-" 52.187.15.59 - - [08/Sep/2025:15:51:31 +0200] "GET /wp-content/uploads/json.php HTTP/1.1" 404 515 "-" "-" 52.187.15.59 - - [08/Sep/2025:15:51:32 +0200] "GET /wp-includes/sodium_compat/index.php HTTP/1.1" 404 515 "-" "-" 52.187.15.59 - - [08/Sep/2025:15:51:32 +0200] "GET /.well-known/pki-validation/xmrlpc.php HTTP/1.1" 404 621 "-" "-" 52.187.15.59 - - [08/Sep/2025:15:51:32 +0200] "GET /install.php HTTP/1.1" 404 366 "-" "-" 52.187.15.59 - - [08/Sep/2025:15:51:33 +0200] "GET /wp-admin/user/admin.php HTTP/1.1" 404 515 "-" "-" 52.187.15.59 - - [08/Sep/2025:15:51:34 +0200] "GET /wp-admin/includes/wp-conflg.php HTTP/1.1" 404 515 "-" "-" 52.187.15.59 - - [08/Sep/2025:15:51:34 +0200] "GET /wp-admin/css/wp-conflg.php HTTP/1.1" 404 515 "-" "-" 52.187.15.59 - - [08/Sep/2025:15:51:34 +0200] "GET /bypass.php HTTP/1.1" 404 366 "-" "-" 52.187.15.59 - - [08/Sep/2025:15:51:35 + ... show less	DDoS Attack
🇺🇸 TPI-Abuse	2025-09-08 13:48:15 UTC · (1 year ago)	(mod_security) mod_security (id:240000) triggered by 52.187.15.59 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Sep 08 09:48:12.630249 2025] [security2:error] [pid 30106:tid 30106] [client 52.187.15.59:4939] ModS ... show more (mod_security) mod_security (id:240000) triggered by 52.187.15.59 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Sep 08 09:48:12.630249 2025] [security2:error] [pid 30106:tid 30106] [client 52.187.15.59:4939] ModSecurity: Access denied with code 403 (phase 2). String match ".php" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/24_Apps_Joomla.conf"] [line "74"] [id "240000"] [rev "1"] [msg "COMODO WAF: Protecting Joomla folder\|\|frootloops.net\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "Joomla"] [hostname "frootloops.net"] [uri "/prizelottery/images/stories/admin-post.php"] [unique_id "aL7enCFOGAgFRLi2W-4kfwAAAAw"] show less	Brute-Force Bad Web Bot Web App Attack
🇫🇷 COMAITE	2025-09-08 13:39:02 UTC · (1 year ago)	Multiple web server 400 error codes from same source ip 52.187.15.59.	Web App Attack
🇺🇸 TPI-Abuse	2025-09-08 13:06:49 UTC · (1 year ago)	(mod_security) mod_security (id:240000) triggered by 52.187.15.59 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Sep 08 09:06:44.865424 2025] [security2:error] [pid 19420:tid 19420] [client 52.187.15.59:8969] ModS ... show more (mod_security) mod_security (id:240000) triggered by 52.187.15.59 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Sep 08 09:06:44.865424 2025] [security2:error] [pid 19420:tid 19420] [client 52.187.15.59:8969] ModSecurity: Access denied with code 403 (phase 2). String match ".php" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/24_Apps_Joomla.conf"] [line "74"] [id "240000"] [rev "1"] [msg "COMODO WAF: Protecting Joomla folder\|\|www.motioncontrolpartners.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "Joomla"] [hostname "www.motioncontrolpartners.com"] [uri "/images/stories/admin-post.php"] [unique_id "aL7U5Hhw-UohECC5IhiLTwAAAAc"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2025-09-08 11:56:28 UTC · (1 year ago)	(mod_security) mod_security (id:240000) triggered by 52.187.15.59 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Sep 08 07:56:21.157854 2025] [security2:error] [pid 14213:tid 14213] [client 52.187.15.59:7323] ModS ... show more (mod_security) mod_security (id:240000) triggered by 52.187.15.59 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Sep 08 07:56:21.157854 2025] [security2:error] [pid 14213:tid 14213] [client 52.187.15.59:7323] ModSecurity: Access denied with code 403 (phase 2). String match ".php" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/24_Apps_Joomla.conf"] [line "74"] [id "240000"] [rev "1"] [msg "COMODO WAF: Protecting Joomla folder\|\|rkstewart.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "Joomla"] [hostname "rkstewart.com"] [uri "/images/stories/admin-post.php"] [unique_id "aL7EZZalDArmm5n2UEE1AgAAABg"] show less	Brute-Force Bad Web Bot Web App Attack
🇩🇪 rh24	2025-09-08 11:48:18 UTC · (1 year ago)	(mod_security) mod_security triggered on hostname [redacted] 52.187.15.59 (SG/Singapore/-)	SQL Injection
🇩🇪 LRob	2025-09-08 11:15:37 UTC · (1 year ago)	Repeated 403 errors, blocked by Fail2ban in custom-403 jail	Bad Web Bot
🇺🇸 TPI-Abuse	2025-09-08 10:31:28 UTC · (1 year ago)	(mod_security) mod_security (id:240000) triggered by 52.187.15.59 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Sep 08 06:31:23.585938 2025] [security2:error] [pid 11571:tid 11571] [client 52.187.15.59:8051] ModS ... show more (mod_security) mod_security (id:240000) triggered by 52.187.15.59 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Sep 08 06:31:23.585938 2025] [security2:error] [pid 11571:tid 11571] [client 52.187.15.59:8051] ModSecurity: Access denied with code 403 (phase 2). String match ".php" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/24_Apps_Joomla.conf"] [line "74"] [id "240000"] [rev "1"] [msg "COMODO WAF: Protecting Joomla folder\|\|rockwranglers.org\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "Joomla"] [hostname "rockwranglers.org"] [uri "/images/stories/admin-post.php"] [unique_id "aL6we2j04VAxx67i6QaqrgAAAAA"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2025-09-08 09:40:31 UTC · (1 year ago)	(mod_security) mod_security (id:240000) triggered by 52.187.15.59 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Sep 08 05:40:27.451524 2025] [security2:error] [pid 26572:tid 26572] [client 52.187.15.59:2684] ModS ... show more (mod_security) mod_security (id:240000) triggered by 52.187.15.59 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Sep 08 05:40:27.451524 2025] [security2:error] [pid 26572:tid 26572] [client 52.187.15.59:2684] ModSecurity: Access denied with code 403 (phase 2). String match ".php" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/24_Apps_Joomla.conf"] [line "74"] [id "240000"] [rev "1"] [msg "COMODO WAF: Protecting Joomla folder\|\|gabosoftware.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "Joomla"] [hostname "gabosoftware.com"] [uri "/images/stories/admin-post.php"] [unique_id "aL6ki1utrlGsftNe7Ea1cQAAAA8"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇦 URAN Publishing Service	2025-09-08 09:30:48 UTC · (1 year ago)	52.187.15.59 - - [08/Sep/2025:12:30:48 +0300] "GET /wp-content/plugins/hellopress/wp_filemanager.php HTTP/1.1" 404 278 "-" "-" ...	Web App Attack

Showing 1 to 15 of 59 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown

Recently Reported IPs:

🇰🇷 211.223.41.90

🇵🇱 176.53.159.197

🇫🇷 162.159.124.20

🇰🇷 122.252.126.2

🇦🇹 109.70.100.13

🇫🇷 85.217.140.53

🇦🇷 190.113.188.250

🇨🇭 179.43.153.18

🇺🇸 162.216.150.7

🇻🇪 143.105.147.249

🇮🇳 117.236.124.166

🇳🇱 103.47.145.62

🇷🇴 2.57.121.112

🇺🇦 188.114.206.90

🇻🇳 113.173.136.23

🇧🇬 78.128.114.46

🇺🇸 45.33.105.76

🇬🇧 35.203.211.43

🇨🇳 27.188.184.13

🇨🇳 14.103.115.181