JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 52.201.236.52

52.201.236.52 was found in our database!

This IP was reported 52 times. Confidence of Abuse is 100%: ?

100%

ISP	Amazon Technologies Inc.
Usage Type	Data Center/Web Hosting/Transit
ASN	AS14618
Hostname(s)	ec2-52-201-236-52.compute-1.amazonaws.com
Domain Name	amazon.com
Country	🇺🇸 United States of America
City	Ashburn, Virginia

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 52.201.236.52

Whois 52.201.236.52

IP Abuse Reports for 52.201.236.52:

This IP address has been reported a total of 52 times from 45 distinct sources. 52.201.236.52 was first reported on September 16th 2026, and the most recent report was 6 hours ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇮🇱 spd.co.il	2026-09-19 01:02:24 (6 hours ago)	Web application attack detected	Hacking Web App Attack
🇮🇳 evicky2002	2026-09-17 06:00:05 (2 days ago)	Confirmed malicious by STILWaters CTI platform (score=100, sources=1)	Hacking Brute-Force SSH
🇺🇸 TPI-Abuse	2026-09-17 02:43:55 (2 days ago)	(mod_security) mod_security (id:210730) triggered by 52.201.236.52 (ec2-52-201-236-52.compute-1.amaz ... show more (mod_security) mod_security (id:210730) triggered by 52.201.236.52 (ec2-52-201-236-52.compute-1.amazonaws.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Sep 16 22:43:49.900379 2026] [security2:error] [pid 6165:tid 6165] [client 52.201.236.52:49496] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "4"] [msg "COMODO WAF: URL file extension is restricted by policy\|\|marxistphilosophy.org\|F\|2"] [data ".conf"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "marxistphilosophy.org"] [uri "/rclone.conf"] [unique_id "aqtT5WmBY39dAlQWijPWAAAAAAg"] show less	Brute-Force Bad Web Bot Web App Attack
🇩🇪 netclix.gr	2026-09-17 02:09:47 (2 days ago)	(bot_kill_mega) Aggressive Bot Blocked: tencent 52.201.236.52 (US/United States/ec2-52-201-236-52.co ... show more (bot_kill_mega) Aggressive Bot Blocked: tencent 52.201.236.52 (US/United States/ec2-52-201-236-52.compute-1.amazonaws.com): 1 in the last 4600 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: 52.201.236.52 - - [17/Sep/2026:05:09:02 +0300] "POST /icecoder/lib/terminal-xhr.php HTTP/2.0" 404 808 "-" "Mozilla/5.0 (compatible; Hunyuan/1.0; +https://hunyuan.tencent.com/)" show less	Port Scan
🇮🇪 RoboSOC	2026-09-17 01:12:57 (2 days ago)	Langflow Unauthenticated Remote Code Execution Vulnerability, PTR: ec2-52-201-236-52.compute-1.amazo ... show more Langflow Unauthenticated Remote Code Execution Vulnerability, PTR: ec2-52-201-236-52.compute-1.amazonaws.com. show less	Hacking
🇬🇧 andypiper	2026-09-17 01:02:32 (2 days ago)	CrowdSec ban for AbuseIPDB Top List	Brute-Force Web App Attack
🇳🇱 Savvii	2026-09-17 00:31:34 (2 days ago)	20 attempts against mh-misbehave-ban on ozone	Brute-Force Bad Web Bot Web App Attack
🇳🇱 Alt255	2026-09-17 00:12:00 (2 days ago)	[cb-15al] Web exploit scanning: 1 suspicious requests detected by fail2ban jail apache-scanner. Exam ... show more [cb-15al] Web exploit scanning: 1 suspicious requests detected by fail2ban jail apache-scanner. Example: 52.201.236.52 - - [17/Sep/2026:02:11:52 +0200] "GET /@fs/app/.env?raw?? HTTP/2.0" 301 365 "-" "Mozilla/5.0 (compatible; Kimi-SearchBot/1.0; +https://kimi.ai/)" ... show less	Bad Web Bot Web App Attack
🇨🇦 Mediashaker	2026-09-16 23:55:14 (2 days ago)	(apache-useragents) Failed apache-useragents trigger with match [redacted] from 52.201.236.52 (US/Un ... show more (apache-useragents) Failed apache-useragents trigger with match [redacted] from 52.201.236.52 (US/United States/ec2-52-201-236-52.compute-1.amazonaws.com) show less	Bad Web Bot
🇺🇸 H24	2026-09-16 23:41:51 (2 days ago)	/app/.env /packages/.env /web/.env /api/.env /services/.env /backend/.env	Web App Attack
🇩🇪 BlueWire Hosting	2026-09-16 23:28:55 (2 days ago)	High-confidence malicious configuration/VCS probe	Web App Attack
🇳🇱 Savvii	2026-09-16 23:16:50 (2 days ago)	20 attempts against mh-misbehave-ban on frost	Brute-Force Bad Web Bot Web App Attack
🇫🇷 Baking333	2026-09-16 23:02:31 (2 days ago)	[redacted] 52.201.236.52 - - [16/Sep/2026:22:04:36 +0100] "GET /dist/.vite/[redacted] HTTP/1.1" 302 ... show more [redacted] 52.201.236.52 - - [16/Sep/2026:22:04:36 +0100] "GET /dist/.vite/[redacted] HTTP/1.1" 302 1534 0/42859 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 Edg/152.0.0.0" 443 [redacted] 52.201.236.52 - - [16/Sep/2026:22:04:36 +0100] "GET /.vite/[redacted] HTTP/1.1" 302 1534 0/57891 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 Edg/152.0.0.0" 443 show less	Bad Web Bot Web App Attack
🇳🇱 Alt255	2026-09-16 22:39:44 (2 days ago)	[cb-02al] Excessive 404 errors (web scanning): 25 suspicious requests detected by fail2ban jail ngin ... show more [cb-02al] Excessive 404 errors (web scanning): 25 suspicious requests detected by fail2ban jail nginx-404. Example: 52.201.236.52 - - [17/Sep/2026:00:39:34 +0200] "POST /graphql HTTP/1.1" 404 14356 "https://gekvanfietsen.nl" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36" 52.201.236.52 - - [17/Sep/2026:00:39:35 +0200] "GET /secrets.env HTTP/1.1" 404 14405 "https://gekvanfietsen.nl/secrets.env" "Mozilla/5.0 (compatible; Kimi-SearchBot/1.0; +https://kimi.ai/)" 52.201.236.52 - - [17/Sep/2026:00:39:35 +0200] "GET /static/manifest.json HTTP/1.1" 404 14406 "https://gekvanfietsen.nl/static/manifest.json" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36" 52.201.236.52 - - [17/Sep/2026:00:39:35 +0200] "GET /docker-compose.yaml HTTP/1.1" 404 14406 "https://gekvanfietsen.nl/docker-compo ... show less	Bad Web Bot Web App Attack
Anonymous	2026-09-16 22:38:25 (2 days ago)	Automatically blocked after 8 security events. Observed repeated login or credential attacks. Source ... show more Automatically blocked after 8 security events. Observed repeated login or credential attacks. Source: Cloudflare security controls. show less	Hacking Brute-Force Bad Web Bot Web App Attack

Showing 1 to 15 of 52 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇺🇸 208.126.194.62

🇧🇩 202.191.122.201

🇧🇩 165.101.222.20

🇰🇷 118.36.136.12

🇸🇬 43.173.180.84

🇨🇦 208.96.233.67

🇺🇸 208.59.49.108

🇹🇬 196.168.212.63

🇧🇪 188.95.55.119

🇮🇳 152.32.159.79

🇷🇺 95.153.227.82

🇫🇷 91.196.152.53

🇸🇬 43.172.195.246

🇮🇳 20.235.136.168

🇳🇱 20.54.134.42

🇺🇸 2604:a940:301:225:0:10::

🇺🇸 216.126.225.6

🇩🇪 213.209.159.16

🇰🇷 210.97.90.185

🇮🇳 182.95.178.154