JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 52.231.68.47

52.231.68.47 was found in our database!

This IP was reported 541 times. Confidence of Abuse is 100%: ?

100%

ISP	Microsoft Corporation
Usage Type	Data Center/Web Hosting/Transit
ASN	AS8075
Domain Name	microsoft.com
Country	🇰🇷 Korea (the Republic of)
City	Seoul, Seoul

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 52.231.68.47

Whois 52.231.68.47

IP Abuse Reports for 52.231.68.47:

This IP address has been reported a total of 541 times from 326 distinct sources. 52.231.68.47 was first reported on January 21st 2026, and the most recent report was 2 minutes ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇮🇹 mediarama.com	2026-06-29 17:19:07 (2 minutes ago)	Banned by Fail2Ban	Web App Attack
🇩🇪 Skyrider	2026-06-29 17:16:43 (5 minutes ago)	Nginx: HTTP 4xx probe/scan attempts. Automated fail2ban report.	Bad Web Bot Web App Attack
Anonymous	2026-06-29 17:16:15 (5 minutes ago)	52.231.68.47 - - [29/Jun/2026:12:15:54 -0500] "GET /wp-content/plugins/hellopress/wp_filemanager.php ... show more 52.231.68.47 - - [29/Jun/2026:12:15:54 -0500] "GET /wp-content/plugins/hellopress/wp_filemanager.php HTTP/1.0" 403 199 "-" "-" 52.231.68.47 - - [29/Jun/2026:12:15:55 -0500] "GET /this_is_a_new_hello_world.php HTTP/1.0" 403 199 "-" "-" 52.231.68.47 - - [29/Jun/2026:12:15:55 -0500] "GET /txets.php HTTP/1.0" 403 199 "-" "-" 52.231.68.47 - - [29/Jun/2026:12:15:56 -0500] "GET /7logs.php HTTP/1.0" 403 199 "-" "-" 52.231.68.47 - - [29/Jun/2026:12:15:56 -0500] "GET /css/xp.php HTTP/1.0" 403 199 "-" "-" 52.231.68.47 - - [29/Jun/2026:12:15:57 -0500] "GET /wp-admin/network/admin.php HTTP/1.0" 403 199 "-" "-" 52.231.68.47 - - [29/Jun/2026:12:15:57 -0500] "GET /chosen.php HTTP/1.0" 403 199 "-" "-" 52.231.68.47 - - [29/Jun/2026:12:15:57 -0500] "GET /pp.php HTTP/1.0" 403 199 "-" "-" 52.231.68.47 - - [29/Jun/2026:12:15:58 -0500] "GET /wp-includes/ID3/rk2.php HTTP/1.0" 403 199 "-" "-" 52.231.68.47 - - [29/Jun/2026:12:15:58 -0500] "GET /gfile.php HTTP/1.0" 403 199 "-" "-" 52.231.68.47 - - [29/Jun/2026:1 ... show less	Brute-Force Bad Web Bot Web App Attack
🇬🇷 setupgr	2026-06-29 17:08:24 (13 minutes ago)	(mod_security) mod_security (id:1000001) triggered by 52.231.68.47 (-): 1 in the last 86400 secs (CF ... show more (mod_security) mod_security (id:1000001) triggered by 52.231.68.47 (-): 1 in the last 86400 secs (CF_ENABLE); Ports: *; Direction: inout; Trigger: LF_MODSEC; Logs: [Mon Jun 29 20:08:19.150572 2026] [security2:error] [pid 2347453:tid 2347621] [client 52.231.68.47:10114] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/wp-content/plugins/hellopress/wp_filemanager.php" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec/modsec2.user.conf"] [line "103"] [id "1000001"] [msg "Bad file blocked: /wp-content/plugins/hellopress/wp_filemanager.php"] [severity "CRITICAL"] [tag "security"] [hostname "villa-izabela.com"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "akKmg_ia30dTRYCKzsks5AAAAgo"] show less	Port Scan
🇮🇩 Burayot	2026-06-29 17:06:03 (15 minutes ago)	LF_MODSEC: (mod_security) mod_security (id:1000001) triggered by 52.231.68.47 (KR/South Korea/-): 1 ... show more LF_MODSEC: (mod_security) mod_security (id:1000001) triggered by 52.231.68.47 (KR/South Korea/-): 1 in the last 3600 secs show less	Web App Attack
🇦🇹 penguin-solutions.at	2026-06-29 17:04:53 (16 minutes ago)	Excessive 403/404 errors ...	Brute-Force Web App Attack
🇩🇪 maxpower	2026-06-29 17:04:28 (17 minutes ago)	(aggressive_scanner) REGOLA 9 - Aggressive Web Scanner 52.231.68.47 (KR/South Korea/-): 1 in the las ... show more (aggressive_scanner) REGOLA 9 - Aggressive Web Scanner 52.231.68.47 (KR/South Korea/-): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: 52.231.68.47 - - [29/Jun/2026:19:04:20 +0200] "GET /wp-content/plugins/hellopress/wp_filemanager.php HTTP/1.1" 301 331 "-" "-" "-" host=mail.canarybusinesshhs.com show less	Port Scan
Anonymous	2026-06-29 17:04:07 (17 minutes ago)	Aggressive Robot or Attack DDOS	DDoS Attack
Anonymous	2026-06-29 17:03:39 (18 minutes ago)	IP banned by Fail2Ban	Brute-Force SSH
Anonymous	2026-06-29 16:57:07 (24 minutes ago)	[Mon Jun 29 16:57:05.793721 2026] [proxy_fcgi:error] [pid 301170:tid 140608412829376] [client 52.231 ... show more [Mon Jun 29 16:57:05.793721 2026] [proxy_fcgi:error] [pid 301170:tid 140608412829376] [client 52.231.68.47:30708] AH01071: Got error 'Primary script unknown' [Mon Jun 29 16:57:06.279017 2026] [proxy_fcgi:error] [pid 301170:tid 140608991168192] [client 52.231.68.47:30708] AH01071: Got error 'Primary script unknown' [Mon Jun 29 16:57:06.761231 2026] [proxy_fcgi:error] [pid 301170:tid 140608396043968] [client 52.231.68.47:30708] AH01071: Got error 'Primary script unknown' ... show less	Bad Web Bot Web App Attack
🇩🇪 hbrks	2026-06-29 16:54:03 (27 minutes ago)	68 attack(s) detected, such as these: {"event":"web_block","ip":"52.231.68.47","host":"cdn.adalta.so ... show more 68 attack(s) detected, such as these: {"event":"web_block","ip":"52.231.68.47","host":"cdn.adalta.social","request":"GET /Rk41.php HTTP/1.1","user_agent":"","reason":"Status-403","timestamp":"2026-06-29T16:54:03 00:00","logentry":"cdn.adalta.social 52.231.68.47 - - [29/Jun/2026:16:54:03 0000] \"GET /Rk41.php HTTP/1.1\" 403 247 \"-\" \"-\" \"185.219.143.85:443\""} * Report Details : https://p4u.xyz/E5W328WU9LY/1 IP Details *: https://p4u.xyz/E5W328WU9LY/2 show less	Web Spam Hacking Bad Web Bot
🇳🇱 DrLex0	2026-06-29 16:45:38 (36 minutes ago)	The eternal WordPress and/or random PHP poking from Azure ranges; MS is either incapable of stopping ... show more The eternal WordPress and/or random PHP poking from Azure ranges; MS is either incapable of stopping this, or willingly allows it. 52.231.68.47 80 - [29/Jun/2026:16:45:37 +0000] "GET /wp-content/plugins/hellopress/wp_filemanager.php HTTP/1.1" 404 2383 "-" "-" 52.231.68.47 80 - [29/Jun/2026:16:45:38 +0000] "GET /this_is_a_new_hello_world.php HTTP/1.1" 404 2383 "-" "-" show less	Brute-Force Bad Web Bot Web App Attack
🇬🇧 djboddington	2026-06-29 16:45:24 (36 minutes ago)	This IP was detected by CrowdSec triggering crowdsecurity/http-probing	Web App Attack Hacking
🇯🇵 ki3	2026-06-29 16:45:24 (36 minutes ago)	Fail2Ban: Web App Attacks and Forum Spam 52.231.68.47 1782751523.0(JST)	Web Spam Bad Web Bot Web App Attack
Anonymous	2026-06-29 16:42:32 (39 minutes ago)	52.231.68.47 - - [29/Jun/2026:16:42:15 +0000] "GET /wp-admin/network/admin.php HTTP/1.1" 404 571 "-" ... show more 52.231.68.47 - - [29/Jun/2026:16:42:15 +0000] "GET /wp-admin/network/admin.php HTTP/1.1" 404 571 "-" "-" 52.231.68.47 - - [29/Jun/2026:16:42:16 +0000] "GET /wp-includes/ID3/rk2.php HTTP/1.1" 404 571 "-" "-" 52.231.68.47 - - [29/Jun/2026:16:42:22 +0000] "GET /wp-content/admin.php HTTP/1.1" 404 571 "-" "-" 52.231.68.47 - - [29/Jun/2026:16:42:23 +0000] "GET /wp-includes/assets/index.php HTTP/1.1" 404 571 "-" "-" 52.231.68.47 - - [29/Jun/2026:16:42:25 +0000] "GET /wp-admin/css/colors/blue/index.php ... show less	Web App Attack

Showing 1 to 15 of 541 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇰🇷 220.88.220.59

🇧🇷 201.218.168.25

🇯🇵 165.154.231.236

🇦🇪 95.182.93.67

🇺🇸 66.132.186.132

🇰🇷 43.155.214.159

🇧🇪 34.156.53.25

🇺🇸 2607:f8b0:4001:c72::125

🇬🇧 195.206.182.218

🇹🇹 186.96.209.10

🇮🇩 103.118.82.254

🇺🇸 65.49.1.132

🇨🇳 36.151.146.246

🇭🇰 220.246.40.63

🇬🇧 193.163.125.80

🇺🇸 173.239.218.215

🇺🇸 137.184.129.210

🇹🇷 91.151.88.131

🇺🇸 66.132.195.105

🇬🇧 45.82.76.100