JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 52.200.170.127

52.200.170.127 was found in our database!

This IP was reported 34 times. Confidence of Abuse is 0%: ?

ISP	Amazon Technologies Inc.
Usage Type	Data Center/Web Hosting/Transit
ASN	AS14618
Hostname(s)	ec2-52-200-170-127.compute-1.amazonaws.com
Domain Name	amazon.com
Country	🇺🇸 United States of America
City	Ashburn, Virginia

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 52.200.170.127

Whois 52.200.170.127

IP Abuse Reports for 52.200.170.127:

This IP address has been reported a total of 34 times from 27 distinct sources. 52.200.170.127 was first reported on January 30th 2026, and the most recent report was 6 months ago.

Old Reports: The most recent abuse report for this IP address is from 6 months ago . It is possible that this IP is no longer involved in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇷🇸 Smel	2026-02-02 06:18:03 (6 months ago)	Unauthorized Probe/Connection, Hack -	Port Scan Hacking
🇳🇱 grinthorstnl	2026-01-31 23:59:02 (7 months ago)	Auto-ban: >500 bad req(40x/50x)/5min on 2026-01-30	Hacking Web App Attack SSH
Anonymous	2026-01-31 20:41:26 (7 months ago)	2026-01-31T21:41:25.455550+01:00 rendez-vous dovecot[224397]: imap-login: Disconnected: Too many inv ... show more 2026-01-31T21:41:25.455550+01:00 rendez-vous dovecot[224397]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=52.200.170.127, lip=*, TLS, session=<NFoLHbVJXNQ0yKp/> show less	Brute-Force
🇺🇸 mnsf	2026-01-31 03:05:24 (7 months ago)	Too many Status 50X (843) Scanning/Probing (16) Request Overload (843)	Brute-Force Web App Attack
🇧🇪 cmbplf	2026-01-30 21:20:02 (7 months ago)	1094 limiting connections by zone (1d12h36m)	DDoS Attack
🇫🇮 stinpriza	2026-01-30 21:11:55 (7 months ago)	Web App Attack	Web App Attack
🇺🇸 netllama	2026-01-30 21:00:56 (7 months ago)	52.200.170.127 - - [30/Jan/2026:13:00:55 -0800] "GET /wp.zip HTTP/1.1" 404 236 52.200.170.127 - - [3 ... show more 52.200.170.127 - - [30/Jan/2026:13:00:55 -0800] "GET /wp.zip HTTP/1.1" 404 236 52.200.170.127 - - [30/Jan/2026:13:00:55 -0800] "GET /web.zip HTTP/1.1" 404 236 52.200.170.127 - - [30/Jan/2026:13:00:55 -0800] "GET /client.zip HTTP/1.1" 404 236 52.200.170.127 - - [30/Jan/2026:13:00:55 -0800] "GET /sites.zip HTTP/1.1" 404 236 52.200.170.127 - - [30/Jan/2026:13:00:55 -0800] "GET /website.zip HTTP/1.1" 404 236 52.200.170.127 - - [30/Jan/2026:13:00:55 -0800] "GET /wordpress-backup.zip HTTP/1.1" 404 236 52.200.170.127 - - [30/Jan/2026:13:00:55 -0800] "GET /home.zip HTTP/1.1" 404 236 52.200.170.127 - - [30/Jan/2026:13:00:55 -0800] "GET /wwwroot.zip HTTP/1.1" 404 236 52.200.170.127 - - [30/Jan/2026:13:00:55 -0800] "GET /webapps.zip HTTP/1.1" 404 236 52.200.170.127 - - [30/Jan/2026:13:00:55 -0800] "GET /domains.zip HTTP/1.1" 404 236 52.200.170.127 - - [30/Jan/2026:13:00:55 -0800] "GET /root.zip HTTP/1.1" 404 236 52.200.170.127 - - [30/Jan/2026:13:00:55 -0800] "GET /html.zip HTTP/1.1" 404 236 52.2 ... show less	Hacking Web App Attack
Anonymous	2026-01-30 20:54:12 (7 months ago)	Bot / seems abusive / Apache connections: 61	DDoS Attack Web Spam Bad Web Bot Web App Attack
🇪🇸 robotstxt	2026-01-30 20:17:22 (7 months ago)	52.200.170.127 - - [30/Jan/2026:20:16:26 +0000] "GET /webmail.zip HTTP/1.1" 404 0 "-" rt="4.657" "Mo ... show more 52.200.170.127 - - [30/Jan/2026:20:16:26 +0000] "GET /webmail.zip HTTP/1.1" 404 0 "-" rt="4.657" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36" "-" h="agrogreensudoe.org" sn="agrogreensudoe.org" ru="/webmail.zip" u="/index.php" ucs="-" ua="unix:/var/run/php/agrogreensudoe82.sock" us="-" uct="0.000" urt="4.657" 52.200.170.127 - - [30/Jan/2026:20:16:26 +0000] "GET /webmail.zip HTTP/1.1" 404 0 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36" "-" 52.200.170.127 - - [30/Jan/2026:20:16:25 +0000] "GET /phpmyadmin.zip HTTP/1.1" 404 0 "-" rt="4.686" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36" "-" h="agrogreensudoe.org" sn="agrogreensudoe.org" ru="/phpmyadmin.zip" u="/index.php" ucs="-" ua="unix:/var/run/php/agrogreensudoe82.sock" us="-" uct="0.000" urt="4.686" 52.200.170.127 - - [30/Jan/2026: ... show less	Bad Web Bot
🇺🇸 TPI-Abuse	2026-01-30 20:10:39 (7 months ago)	(mod_security) mod_security (id:210492) triggered by 52.200.170.127 (ec2-52-200-170-127.compute-1.am ... show more (mod_security) mod_security (id:210492) triggered by 52.200.170.127 (ec2-52-200-170-127.compute-1.amazonaws.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jan 30 15:10:34.269885 2026] [security2:error] [pid 17650:tid 17650] [client 52.200.170.127:37698] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "neconebooks.com"] [uri "/.env.zip"] [unique_id "aX0QOsFqyWZwJrQTs5t1kwAAACE"] show less	Brute-Force Bad Web Bot Web App Attack
🇳🇱 CryptoYakari	2026-01-30 20:08:37 (7 months ago)	52.200.170.127 - - [30/Jan/2026:23:08:35 +0300] "GET /gallery.zip HTTP/1.0" 404 7003 "-" "Mozilla/5. ... show more 52.200.170.127 - - [30/Jan/2026:23:08:35 +0300] "GET /gallery.zip HTTP/1.0" 404 7003 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36" 52.200.170.127 - - [30/Jan/2026:23:08:35 +0300] "GET /applications.zip HTTP/1.0" 404 7003 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36" 52.200.170.127 - - [30/Jan/2026:23:08:35 +0300] "GET /wordpress-20240527.zip HTTP/1.0" 404 7003 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36" 52.200.170.127 - - [30/Jan/2026:23:08:35 +0300] "GET /wp-config.zip HTTP/1.0" 404 7003 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36" 52.200.170.127 - - [30/Jan/2026:23:08:35 +0300] "GET /videos.zip HTTP/1.0" 404 7003 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) ... show less	Web Spam Blog Spam Bad Web Bot Web App Attack
🇧🇪 cmbplf	2026-01-30 20:00:19 (7 months ago)	1195 limiting connections by zone (3h44m59s)	DDoS Attack
Anonymous	2026-01-30 19:58:05 (7 months ago)		Bad Web Bot
🇧🇪 cmbplf	2026-01-30 19:40:11 (7 months ago)	688 limiting connections by zone (9m59s)	DDoS Attack
🇪🇸 robotstxt	2026-01-30 19:30:38 (7 months ago)	52.200.170.127 - - [30/Jan/2026:19:29:44 +0000] "GET /mail.zip HTTP/1.1" 404 0 "-" rt="4.561" "Mozil ... show more 52.200.170.127 - - [30/Jan/2026:19:29:44 +0000] "GET /mail.zip HTTP/1.1" 404 0 "-" rt="4.561" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36" "-" h="www.wp-cli.es" sn="www.wp-cli.es" ru="/mail.zip" u="/index.php" ucs="-" ua="unix:/var/run/php/wpcli82.sock" us="-" uct="0.000" urt="4.561" 52.200.170.127 - - [30/Jan/2026:19:29:44 +0000] "GET /mail.zip HTTP/1.1" 404 0 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36" "-" 52.200.170.127 - - [30/Jan/2026:19:29:42 +0000] "GET /phpmyadmin.zip HTTP/1.1" 404 54469 "-" rt="3.453" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36" "-" h="www.wp-cli.es" sn="www.wp-cli.es" ru="/phpmyadmin.zip" u="/index.php" ucs="-" ua="unix:/var/run/php/wpcli82.sock" us="404" uct="0.000" urt="3.452" 52.200.170.127 - - [30/Jan/2026:19:29:44 +0000] "GET /mailer.zip HTTP/1.1 ... show less	Bad Web Bot

Showing 1 to 15 of 34 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇧🇷 205.210.31.161

🇻🇳 115.84.183.221

🇨🇳 39.79.121.160

🇺🇸 34.48.214.154

🇨🇦 20.104.49.130

🇰🇭 202.57.209.100

🇳🇱 172.94.9.107

🇩🇪 138.246.253.24

🇨🇳 119.166.180.214

🇨🇳 117.89.53.81

🇮🇳 106.222.248.237

🇺🇸 52.248.42.209

🇸🇾 185.225.41.192

🇨🇳 182.151.45.136

🇧🇷 131.255.68.201

🇨🇳 111.113.89.82

🇷🇴 92.118.39.50

🇫🇷 85.217.140.10

🇰🇷 59.11.42.221

🇺🇸 34.75.104.2