JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 52.190.140.130

52.190.140.130 was found in our database!

This IP was reported 40 times. Confidence of Abuse is 76%: ?

76%

ISP	Microsoft Corporation
Usage Type	Data Center/Web Hosting/Transit
ASN	AS8075
Domain Name	microsoft.com
Country	🇺🇸 United States of America
City	San Jose, California

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 52.190.140.130

Whois 52.190.140.130

IP Abuse Reports for 52.190.140.130:

This IP address has been reported a total of 40 times from 32 distinct sources. 52.190.140.130 was first reported on September 14th 2025, and the most recent report was 10 hours ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇺🇸 xmission.com	2026-07-08 22:01:37 (10 hours ago)	Blocked by UFW (TCP on 9101) Source port: 58304 TTL: 115 Packet length: 40 TOS: 0x00 This report (f ... show more Blocked by UFW (TCP on 9101) Source port: 58304 TTL: 115 Packet length: 40 TOS: 0x00 This report (for 52.190.140.130) was generated by: https://github.com/sefinek/UFW-AbuseIPDB-Reporter show less	Port Scan
🇯🇵 SentinalX by uzumaru	2026-07-06 02:25:39 (3 days ago)	Detected by SentinelX honeypot: sent HTTP CONNECT request probing for an open proxy. Connection was ... show more Detected by SentinelX honeypot: sent HTTP CONNECT request probing for an open proxy. Connection was hijacked and held in a tarpit to slow down the scan. Probed target: proof.ovh.net:443 show less	Open Proxy Port Scan
🇫🇷 rhydo	2026-07-04 13:57:09 (4 days ago)	2026-07-04T15:56:20.727108+02:00 server sshd[334143]: User root from 52.190.140.130 not allowed beca ... show more 2026-07-04T15:56:20.727108+02:00 server sshd[334143]: User root from 52.190.140.130 not allowed because listed in DenyUsers 2026-07-04T15:56:27.554585+02:00 server sshd[334186]: User root from 52.190.140.130 not allowed because listed in DenyUsers 2026-07-04T15:56:34.149536+02:00 server sshd[334190]: User root from 52.190.140.130 not allowed because listed in DenyUsers 2026-07-04T15:56:41.362636+02:00 server sshd[334232]: Invalid user r00t from 52.190.140.130 port 44049 2026-07-04T15:56:48.269230+02:00 server sshd[334235]: User root from 52.190.140.130 not allowed because listed in DenyUsers ... show less	Brute-Force SSH
🇩🇪 JavaStart	2026-07-04 13:29:59 (4 days ago)	Jul 4 15:29:40 vmi174663 sshd[2487342]: Failed password for root from 52.190.140.130 port 44048 ssh ... show more Jul 4 15:29:40 vmi174663 sshd[2487342]: Failed password for root from 52.190.140.130 port 44048 ssh2 Jul 4 15:29:47 vmi174663 sshd[2487350]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=52.190.140.130 user=root Jul 4 15:29:49 vmi174663 sshd[2487350]: Failed password for root from 52.190.140.130 port 44049 ssh2 Jul 4 15:29:57 vmi174663 sshd[2487352]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=52.190.140.130 user=root Jul 4 15:29:59 vmi174663 sshd[2487352]: Failed password for root from 52.190.140.130 port 44050 ssh2 ... show less	Brute-Force SSH
🇫🇷 aki	2026-07-04 13:22:06 (4 days ago)	Drop: ...	Port Scan
🇫🇷 andruida.hu	2026-07-04 12:54:08 (4 days ago)		Brute-Force SSH
🇩🇪 JavaStart	2026-07-04 12:50:29 (4 days ago)	Jul 4 14:50:16 vmi174663 sshd[2478004]: Failed password for root from 52.190.140.130 port 44048 ssh ... show more Jul 4 14:50:16 vmi174663 sshd[2478004]: Failed password for root from 52.190.140.130 port 44048 ssh2 Jul 4 14:50:20 vmi174663 sshd[2478041]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=52.190.140.130 user=root Jul 4 14:50:23 vmi174663 sshd[2478041]: Failed password for root from 52.190.140.130 port 44049 ssh2 Jul 4 14:50:27 vmi174663 sshd[2478056]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=52.190.140.130 user=root Jul 4 14:50:29 vmi174663 sshd[2478056]: Failed password for root from 52.190.140.130 port 44048 ssh2 ... show less	Brute-Force SSH
🇩🇪 NetWatch	2026-07-04 12:38:48 (4 days ago)	The IP 52.190.140.130 tried multiple SSH_BRUTE_FORCE logins	Brute-Force
🇫🇷 kleine babykatze	2026-07-04 12:31:31 (4 days ago)	2026-07-04T14:31:19.519959+02:00 vmd177327 sshd[2965409]: Failed password for root from 52.190.140.1 ... show more 2026-07-04T14:31:19.519959+02:00 vmd177327 sshd[2965409]: Failed password for root from 52.190.140.130 port 44050 ssh2 2026-07-04T14:31:28.309258+02:00 vmd177327 sshd[2965452]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=52.190.140.130 user=root 2026-07-04T14:31:29.726822+02:00 vmd177327 sshd[2965452]: Failed password for root from 52.190.140.130 port 44049 ssh2 ... show less	Brute-Force SSH FTP Brute-Force
🇵🇱 sefinek.net	2026-06-16 18:12:06 (3 weeks ago)	Blocked by UFW on PL02 [443/tcp] \| SPT: 52247 \| TTL: 37 \| LEN: 60 \| TOS: 0x00 • Reported by: github. ... show more Blocked by UFW on PL02 [443/tcp] \| SPT: 52247 \| TTL: 37 \| LEN: 60 \| TOS: 0x00 • Reported by: github.com/sefinek/UFW-AbuseIPDB-Reporter show less	Port Scan Web App Attack
🇺🇸 ISPLtd	2026-06-16 17:29:44 (3 weeks ago)	Jun 16 11:29:42 52.190.140.130 TCP SPT=52242 DPT=2078 SYN Jun 16 11:29:42 52.190.140.130 TCP SPT=522 ... show more Jun 16 11:29:42 52.190.140.130 TCP SPT=52242 DPT=2078 SYN Jun 16 11:29:42 52.190.140.130 TCP SPT=52243 DPT=2096 SYN Jun 16 11:29:42 52.190.140.130 TCP SPT=52240 DPT=2077 WIND ... show less	Port Scan
🇩🇪 derLoosi	2026-06-16 17:23:50 (3 weeks ago)	HV1.2 Blocked by UFW	Port Scan
🇬🇧 Andrew	2026-06-16 17:20:54 (3 weeks ago)	Blocked by UFW (TCP on port 443). Source port: 52244 TTL: 38 Packet length: 60 TOS: 0x00 This repor ... show more Blocked by UFW (TCP on port 443). Source port: 52244 TTL: 38 Packet length: 60 TOS: 0x00 This report (for 52.190.140.130) was generated by: https://github.com/sefinek/UFW-AbuseIPDB-Reporter show less	Port Scan Web App Attack
🇺🇸 TPI-Abuse	2026-06-11 07:11:45 (4 weeks ago)	(mod_security) mod_security (id:210492) triggered by 52.190.140.130 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210492) triggered by 52.190.140.130 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jun 11 03:11:41.156440 2026] [security2:error] [pid 5833:tid 5833] [client 52.190.140.130:11723] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "192.64.151.18"] [uri "/.git/HEAD"] [unique_id "aipfrZ2SkWzWpbBO1jsHbQAAABY"] show less	Brute-Force Bad Web Bot Web App Attack
🇫🇷 sthoyer.de	2026-06-11 06:50:43 (4 weeks ago)	Jun 11 08:50:41 sthoyer kernel: [IPTables-Dropped-I] IN=eth0 OUT= MAC=00:50:56:43:00:af:c0:69:11:cd: ... show more Jun 11 08:50:41 sthoyer kernel: [IPTables-Dropped-I] IN=eth0 OUT= MAC=00:50:56:43:00:af:c0:69:11:cd:10:f7:08:00 SRC=52.190.140.130 DST=173.212.223.67 LEN=60 TOS=0x00 PREC=0x00 TTL=50 ID=7112 DF PROTO=TCP SPT=11998 DPT=2087 WINDOW=64240 RES=0x00 SYN URGP=0 Jun 11 08:50:41 sthoyer kernel: [IPTables-Dropped-I] IN=eth0 OUT= MAC=00:50:56:43:00:af:c0:69:11:cd:10:f7:08:00 SRC=52.190.140.130 DST=173.212.223.67 LEN=60 TOS=0x00 PREC=0x00 TTL=52 ID=177 DF PROTO=TCP SPT=11999 DPT=2082 WINDOW=64240 RES=0x00 SYN URGP=0 Jun 11 08:50:41 sthoyer kernel: [IPTables-Dropped-I] IN=eth0 OUT= MAC=00:50:56:43:00:af:c0:69:11:cd:10:f7:08:00 SRC=52.190.140.130 DST=173.212.223.67 LEN=60 TOS=0x00 PREC=0x00 TTL=52 ID=59694 DF PROTO=TCP SPT=11984 DPT=8443 WINDOW=64240 RES=0x00 SYN URGP=0 Jun 11 08:50:42 sthoyer kernel: [IPTables-Dropped-I] IN=eth0 OUT= MAC=00:50:56:43:00:af:c0:69:11:cd:10:f7:08:00 SRC=52.190.140.130 DST=173.212.223.67 LEN=60 TOS=0x00 PREC=0x00 TTL=52 ID=65434 DF PROTO=TCP SPT=11990 DPT=8080 WINDO ... show less	Port Scan

Showing 1 to 15 of 40 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇺🇸 173.255.230.152

🇺🇸 172.172.196.177

🇸🇬 162.158.88.81

🇺🇸 150.107.36.85

🇨🇦 144.217.74.127

🇸🇬 107.150.112.48

🇺🇸 91.230.168.14

🇺🇸 91.230.168.10

🇫🇷 91.196.152.204

🇭🇰 45.142.154.99

🇩🇪 44.150.72.158

🇺🇸 35.236.247.97

🇨🇳 218.21.241.50

🇭🇰 199.45.155.105

🇺🇸 193.33.237.67

🇮🇹 188.219.104.210

🇨🇳 180.76.239.185

🇵🇱 176.53.159.198

🇸🇬 134.209.98.3

🇵🇰 111.68.107.91