JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 52.233.89.176

52.233.89.176 was found in our database!

This IP was reported 47 times. Confidence of Abuse is 100%: ?

100%

ISP	Microsoft Corporation
Usage Type	Data Center/Web Hosting/Transit
ASN	AS8075
Domain Name	microsoft.com
Country	🇺🇸 United States of America
City	Moses Lake, Washington

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 52.233.89.176

Whois 52.233.89.176

IP Abuse Reports for 52.233.89.176:

This IP address has been reported a total of 47 times from 36 distinct sources. 52.233.89.176 was first reported on September 14th 2026, and the most recent report was 40 seconds ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇺🇸 TPI-Abuse	2026-09-18 01:40:08 (40 seconds ago)	(mod_security) mod_security (id:210492) triggered by 52.233.89.176 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:210492) triggered by 52.233.89.176 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Sep 17 21:40:04.295280 2026] [security2:error] [pid 31425:tid 31425] [client 52.233.89.176:49350] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "tradersworldmarket.com"] [uri "/.env.dev"] [unique_id "aqyWdKgXW16Q4S4NzJ80XAAAAAQ"] show less	Brute-Force Bad Web Bot Web App Attack
🇮🇩 Burayot	2026-09-18 01:38:23 (2 minutes ago)	LF_MODSEC: (mod_security) mod_security (id:949110) triggered by 52.233.89.176 (US/United States/-): ... show more LF_MODSEC: (mod_security) mod_security (id:949110) triggered by 52.233.89.176 (US/United States/-): 2 in the last 3600 secs show less	Web App Attack
🇩🇪 Dominik Lysiak	2026-09-18 01:34:10 (6 minutes ago)	52.233.89.176 - - [18/Sep/2026:03:34:09 +0200] "GET /.env HTTP/1.1" 200 30473 "-" "Mozilla/5.0 (X11; ... show more 52.233.89.176 - - [18/Sep/2026:03:34:09 +0200] "GET /.env HTTP/1.1" 200 30473 "-" "Mozilla/5.0 (X11; Linux x86_64)" 52.233.89.176 - - [18/Sep/2026:03:34:10 +0200] "GET /.env HTTP/1.1" 200 30473 "-" "Mozilla/5.0 (X11; Linux x86_64)" 52.233.89.176 - - [18/Sep/2026:03:34:10 +0200] "GET /.env.local HTTP/1.1" 200 30485 "-" "Mozilla/5.0 (X11; Linux x86_64)" ... show less	Web App Attack
🇨🇭 Origon	2026-09-18 01:32:02 (8 minutes ago)	http-sensitive-files - IP: 52.233.89.176 - time="2026-09-18T03:32:02+02:00" level=info msg="(555f66 ... show more http-sensitive-files - IP: 52.233.89.176 - time="2026-09-18T03:32:02+02:00" level=info msg="(555f66b4f6a74558bc11e3f93469658es8App0Mcc0TKEeje/crowdsec) crowdsecurity/http-sensitive-files by ip 52.233.89.176 (US/8075) : 4h ban on Ip 52.233.89.176" module=db show less	Web App Attack
🇪🇸 elcruzado.es	2026-09-18 01:27:16 (13 minutes ago)	(mod_security) mod_security triggered on hostname [redacted] 52.233.89.176 (US/United States/-)	SQL Injection
🇸🇬 khairilgunawan	2026-09-18 01:27:15 (13 minutes ago)	ZonaKuota Sentinel: Malicious automated scanner/exploit probe trapped. Blocked.	Web App Attack Bad Web Bot
🇺🇸 TPI-Abuse	2026-09-18 01:24:51 (15 minutes ago)	(mod_security) mod_security (id:210492) triggered by 52.233.89.176 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:210492) triggered by 52.233.89.176 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Sep 17 21:24:46.222091 2026] [security2:error] [pid 24237:tid 24237] [client 52.233.89.176:51924] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "apushistoryexamprep.com"] [uri "/.env.save"] [unique_id "aqyS3kZA85Pl4_lNxxFhXAAAABI"] show less	Brute-Force Bad Web Bot Web App Attack
🇳🇱 MyGlobalFlowers	2026-09-18 01:20:36 (20 minutes ago)	Multiple WAF Violations	Web App Attack
Anonymous	2026-09-18 01:18:02 (22 minutes ago)	Bot / scanning and/or hacking attempts: GET /api/.env HTTP/1.1, GET /.env.prod HTTP/1.1, GET /.env.d ... show more Bot / scanning and/or hacking attempts: GET /api/.env HTTP/1.1, GET /.env.prod HTTP/1.1, GET /.env.dev HTTP/1.1, GET /.env.save HTTP/1.1, GET /.env.local HTTP/1.1, GET /.env.backup HTTP/1.1, GET /core/.env HTTP/1.1, GET /.env HTTP/1.1, GET /.env.bak HTTP/1.1, GET /config/.env HTTP/1.1 show less	Hacking Web App Attack
🇵🇱 MatStef132	2026-09-18 01:16:24 (24 minutes ago)	MatShield L7: blocked on fivevault.net (secret-path-probe)	DDoS Attack
🇺🇸 mw	2026-09-18 01:05:01 (35 minutes ago)	GET /.env.dev HTTP/1.1	Web App Attack
🇬🇧 andypiper	2026-09-18 01:01:57 (38 minutes ago)	CrowdSec ban for AbuseIPDB Top List	Brute-Force Web App Attack
🇺🇸 TPI-Abuse	2026-09-18 01:00:56 (39 minutes ago)	(mod_security) mod_security (id:210492) triggered by 52.233.89.176 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:210492) triggered by 52.233.89.176 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Sep 17 21:00:53.142641 2026] [security2:error] [pid 7107:tid 7107] [client 52.233.89.176:43286] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cygnetsilks.com"] [uri "/.env.dev"] [unique_id "aqyNRcJfBVgDbg1g2ftOcQAAAAE"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 factor1	2026-09-18 00:54:44 (46 minutes ago)	CrowdSec at sherman Reports Abuse	Web App Attack
🇨🇭 zynex	2026-09-18 00:48:34 (52 minutes ago)	URL Probing: /.env	Web App Attack

Showing 1 to 15 of 47 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇧🇷 205.210.31.219

🇩🇪 194.88.98.112

🇧🇬 79.124.40.142

🇸🇬 34.87.186.138

🇺🇸 20.14.93.125

🇺🇸 195.184.76.169

🇬🇧 193.163.125.37

🇳🇱 185.93.89.135

🇳🇴 185.12.59.118

🇺🇸 134.33.96.248

🇮🇩 41.216.186.222

🇿🇦 34.35.124.9

🇸🇳 213.154.80.51

🇲🇽 209.178.136.62

🇨🇳 120.48.38.253

🇮🇩 103.191.14.243

🇧🇬 79.124.49.134

🇩🇪 23.88.47.15

🇺🇸 20.14.94.24

🇬🇧 213.166.84.49