JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

52.199.141.166

Activity Trending Down

Abuse Confidence Score

100% Critical

37 reports

30 reporters · latest 1 week ago

ISP: Amazon Data Services Japan
Usage Type: Data Center/Web Hosting/Transit
ASN: AS16509
Hostname(s): ec2-52-199-141-166.ap-northeast-1.compute.amazonaws.com
Domain Name: amazon.com
Country: 🇯🇵 Japan
City: Tokyo, Tokyo

ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report Whois

Example preview

Account required for the enhanced features Log in Sign up

Abuse Reports

Export reports CSV

Total reports

37 from 30 distinct reporters

First reported

October 31st 2026

Most recent report

1 week ago

Last 60 days

Top reporter locations 🇺🇸 United States of America 14 🇩🇪 Germany 6 🇳🇱 Netherlands 3

Most common categories Web App Attack 34 Brute-Force 13 Bad Web Bot 11 Hacking 2 DDoS Attack 1

Old reports The most recent abuse report for this IP address is from 1 week ago. It is possible that this IP is no longer involved in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇧🇪 taivas.nl	2026-11-02 05:33:17 UTC · (1 week ago)	Many_bad_calls	Web App Attack
🇺🇸 mnsf	2026-11-02 00:07:58 UTC · (1 week ago)	Too many Status 40X (81) Scanning/Probing (71)	Brute-Force Web App Attack
Anonymous	2026-11-01 09:56:20 UTC · (1 week ago)	IP matched detection query 20 more in short time bad rqs.	Brute-Force Web App Attack Hacking
🇮🇹 mgarofano80	2026-11-01 09:06:02 UTC · (1 week ago)		Brute-Force Web App Attack
🇺🇸 TPI-Abuse	2026-11-01 08:44:34 UTC · (1 week ago)	(mod_security) mod_security (id:210492) triggered by 52.199.141.166 (ec2-52-199-141-166.ap-northeast-1.compute.amazonaws.com): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 01 03:44:28.105592 2026] [security2:erro ... show more (mod_security) mod_security (id:210492) triggered by 52.199.141.166 (ec2-52-199-141-166.ap-northeast-1.compute.amazonaws.com): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 01 03:44:28.105592 2026] [security2:error] [pid 21412:tid 21412] [client 52.199.141.166:44438] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "ferrarapanfitness.com"] [uri "/.aws/.env"] [unique_id "aub77Kg9DJA9T7qZfG65FwAAAAM"] show less	Brute-Force Bad Web Bot Web App Attack
🇩🇪 wpadm4	2026-11-01 08:40:41 UTC · (1 week ago)	(wordpress) Failed login wp-login.php or xmlrpc.php	Web App Attack
🇺🇸 Matthew Ping	2026-11-01 08:30:01 UTC · (1 week ago)	Excessive connections (DDoS/flood) blocked by CSF CT_LIMIT on dedicated4785.	DDoS Attack Brute-Force
🇺🇸 CollideTech	2026-11-01 08:15:04 UTC · (1 week ago)	probing for vulnerabilities	Web App Attack
🇺🇸 jormaster3k	2026-11-01 08:03:12 UTC · (1 week ago)	Attack against Apache (too many 404s)	Web App Attack
🇺🇸 CollideTech	2026-11-01 07:54:30 UTC · (1 week ago)	Probing wordpress site	Web App Attack
🇺🇸 EmilGH	2026-11-01 07:46:55 UTC · (1 week ago)	52.199.141.166 - - [01/Nov/2026:07:46:54 +0000] "GET /.amplifyrc HTTP/1.1" 404 842 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36" 52.199.141.166 - - [01/Nov/2026:07:46:54 +0000] "GET /.aws/.env HTTP/1.1" 403 506 "-" "Mozilla/5.0 ( ... show more 52.199.141.166 - - [01/Nov/2026:07:46:54 +0000] "GET /.amplifyrc HTTP/1.1" 404 842 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36" 52.199.141.166 - - [01/Nov/2026:07:46:54 +0000] "GET /.aws/.env HTTP/1.1" 403 506 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36" 52.199.141.166 - - [01/Nov/2026:07:46:54 +0000] "GET /.aws/credentials.bak HTTP/1.1" 403 506 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36" 52.199.141.166 - - [01/Nov/2026:07:46:54 +0000] "GET /.cursor/mcp.json HTTP/1.1" 404 827 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36" 52.199.141.166 - - [01/Nov/2026:07:46:54 +0000] "GET /.env HTTP/1.1" 403 830 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36" 52.199.141.166 - - [01/Nov/2026:07:46:54 +0000] "GET /.boto HTTP/1.1" 404 827 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36" 52.199.141.166 - - [01/Nov/2026:07:46:54 +0000] "GET /.aws/config HTTP/1.1" 404 827 "-" "Mozilla ... show less	Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-11-01 07:45:22 UTC · (1 week ago)	(mod_security) mod_security (id:210492) triggered by 52.199.141.166 (ec2-52-199-141-166.ap-northeast-1.compute.amazonaws.com): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 01 02:45:16.827857 2026] [security2:erro ... show more (mod_security) mod_security (id:210492) triggered by 52.199.141.166 (ec2-52-199-141-166.ap-northeast-1.compute.amazonaws.com): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 01 02:45:16.827857 2026] [security2:error] [pid 30622:tid 30622] [client 52.199.141.166:33960] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "wcvfr.org"] [uri "/.env.anthropic"] [unique_id "aubuDNQHDv9yKI614DufhwAAAF8"] show less	Brute-Force Bad Web Bot Web App Attack
🇸🇪 vaia.cloud	2026-11-01 07:45:01 UTC · (1 week ago)	crowdsecurity/http-admin-interface-probing	Brute-Force Web App Attack
🇦🇺 aranguren.org	2026-11-01 07:26:11 UTC · (1 week ago)	52.199.141.166 - - [01/Nov/2026:18:26:11 +1100] "GET /.env.anthropic HTTP/2.0" 404 995 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36" TLSv1.3 TLS_AES_256_GCM_SHA384 52.199.141.166 - - [01/Nov/2026:18:26:11 +1100] "GET /.docker/con ... show more 52.199.141.166 - - [01/Nov/2026:18:26:11 +1100] "GET /.env.anthropic HTTP/2.0" 404 995 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36" TLSv1.3 TLS_AES_256_GCM_SHA384 52.199.141.166 - - [01/Nov/2026:18:26:11 +1100] "GET /.docker/config.json HTTP/2.0" 404 995 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36" TLSv1.3 TLS_AES_256_GCM_SHA384 52.199.141.166 - - [01/Nov/2026:18:26:11 +1100] "GET /.env-sample HTTP/2.0" 404 995 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36" TLSv1.3 TLS_AES_256_GCM_SHA384 ... show less	Bad Web Bot
🇺🇸 daveoctober	2026-11-01 07:23:23 UTC · (1 week ago)	October Sentinel: honeypot triggered	Bad Web Bot Web App Attack

Showing 1 to 15 of 37 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown

Recently Reported IPs:

🇸🇬 85.203.21.101

🇸🇬 35.187.231.181

🇳🇱 213.209.159.226

🇳🇱 200.138.46.102

🇧🇷 186.209.77.236

🇬🇧 172.69.194.16

🇦🇷 149.104.92.138

🇫🇮 144.31.185.241

🇨🇳 124.174.39.136

🇧🇩 103.93.140.151

🇳🇬 102.88.137.80

🇳🇱 94.183.177.21

🇸🇬 85.203.21.70

🇺🇸 66.132.186.186

🇺🇸 66.132.172.133

🇺🇸 38.42.55.134

🇺🇸 16.216.88.247

🇰🇷 220.71.237.220

🇳🇱 200.138.46.103

🇳🇱 192.253.248.223