JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 52.238.24.38

52.238.24.38 was found in our database!

This IP was reported 111 times. Confidence of Abuse is 88%: ?

88%

ISP	Microsoft Corporation
Usage Type	Data Center/Web Hosting/Transit
ASN	AS8075
Domain Name	microsoft.com
Country	🇺🇸 United States of America
City	San Jose, California

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 52.238.24.38

Whois 52.238.24.38

IP Abuse Reports for 52.238.24.38:

This IP address has been reported a total of 111 times from 66 distinct sources. 52.238.24.38 was first reported on January 9th 2026, and the most recent report was 10 hours ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇩🇪 acadeova	2026-07-28 01:11:11 (10 hours ago)	🚨 Recon detected (nft drop) SRC=52.238.24.38 Observed=TCP dpt=2087 in=enp0s6 ttl=41 Time=recent(jour ... show more 🚨 Recon detected (nft drop) SRC=52.238.24.38 Observed=TCP dpt=2087 in=enp0s6 ttl=41 Time=recent(journalctl: 10 minutes ago) Assessment=Generic scanning / reconnaissance (PORT_SCAN) show less	Port Scan
🇩🇪 KPS	2026-07-28 00:54:15 (11 hours ago)	PortscanN	Port Scan
🇩🇪 Holger	2026-07-28 00:21:32 (11 hours ago)	Bruteforce WebAttack	Brute-Force Web App Attack
🇷🇸 Scan	2026-07-27 23:59:55 (12 hours ago)	MultiHost/MultiPort Probe, Scan, Hack -	Port Scan Hacking
🇺🇸 TPI-Abuse	2026-07-27 23:30:37 (12 hours ago)	(mod_security) mod_security (id:210492) triggered by 52.238.24.38 (-): 1 in the last 300 secs; Ports ... show more (mod_security) mod_security (id:210492) triggered by 52.238.24.38 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jul 27 19:30:30.216308 2026] [security2:error] [pid 304751:tid 304751] [client 52.238.24.38:58420] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "192.64.150.181"] [uri "/.git/refs/heads/main"] [unique_id "amfqFpmwUiiMtypW_DRWegAAABI"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-07-27 23:12:23 (12 hours ago)	(mod_security) mod_security (id:210492) triggered by 52.238.24.38 (-): 1 in the last 300 secs; Ports ... show more (mod_security) mod_security (id:210492) triggered by 52.238.24.38 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jul 27 19:12:19.064234 2026] [security2:error] [pid 826246:tid 826246] [client 52.238.24.38:58409] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "192.64.150.209"] [uri "/.git/HEAD"] [unique_id "amfl02SkHPbo6m903k29UQAAAAU"] show less	Brute-Force Bad Web Bot Web App Attack
Anonymous	2026-07-27 21:38:59 (14 hours ago)	denied traffic to a honeypot network. destination port 80.	Port Scan Hacking
🇩🇪 gadix	2026-07-27 21:36:49 (14 hours ago)	[27/Jul/2026:23:36:45.351980 +0200] amfPbRnE7_MTFOsmJZscpQAAAME 52.238.24.38 34920 127.0.0.1 7080 [2 ... show more [27/Jul/2026:23:36:45.351980 +0200] amfPbRnE7_MTFOsmJZscpQAAAME 52.238.24.38 34920 127.0.0.1 7080 [27/Jul/2026:23:36:46.082597 +0200] amfPbrb2mKB2azlKZhC2HwAAAIQ 52.238.24.38 34934 127.0.0.1 7080 [27/Jul/2026:23:36:47.249389 +0200] amfPbxnE7_MTFOsmJZscpgAAAMo 52.238.24.38 34940 127.0.0.1 7080 ... show less	Web App Attack
🇧🇷 Vieira Filho	2026-07-27 21:24:51 (14 hours ago)	52.238.24.38 - - [27/Jul/2026:18:24:51 -0300] [35.198.31.82] "35.198.31.82" "GET /.env.local HTTP/1 ... show more 52.238.24.38 - - [27/Jul/2026:18:24:51 -0300] [35.198.31.82] "35.198.31.82" "GET /.env.local HTTP/1.1" 404 169 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:125.0) Gecko/20100101 Firefox/125.0" 0.000 ... show less	Brute-Force Web App Attack Exploited Host
🇫🇷 dynamix	2026-07-27 21:11:52 (14 hours ago)	Multiple WAF Violations	Web App Attack
🇺🇸 TPI-Abuse	2026-07-27 20:55:51 (15 hours ago)	(mod_security) mod_security (id:210492) triggered by 52.238.24.38 (-): 1 in the last 300 secs; Ports ... show more (mod_security) mod_security (id:210492) triggered by 52.238.24.38 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jul 27 16:55:47.715038 2026] [security2:error] [pid 754348:tid 754348] [client 52.238.24.38:58498] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "192.64.150.148"] [uri "/.git/refs/heads/master"] [unique_id "amfF0zQK4OcF8pWNRZb44gAAAAs"] show less	Brute-Force Bad Web Bot Web App Attack
🇩🇪 tg_de	2026-07-27 20:47:04 (15 hours ago)	44 attempts since 27.07.2026 22:46:10 CEST - last search for: /___proxy_subdomain_whm/login/	Web App Attack
Anonymous	2026-07-27 20:22:03 (15 hours ago)	Port Scan	Port Scan
🇨🇿 rawnullbyte	2026-07-27 20:22:01 (15 hours ago)	🚨 Honeypot triggered! 🖥️ System: NPot 🎯 Target: Unknown 🛣️ Path: /___proxy_subdomain_whm/login/ 👤 At ... show more 🚨 Honeypot triggered! 🖥️ System: NPot 🎯 Target: Unknown 🛣️ Path: /___proxy_subdomain_whm/login/ 👤 Attacker IP: 52.238.24.38 ⏰ Time: 2026-07-27 20:22:00 📡 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:125.0) Gecko/20100101 Firefox/125.0 show less	Web App Attack
🇺🇸 Carltonfsck	2026-07-27 20:05:09 (15 hours ago)	52.238.24.38 - - [27/Jul/2026:20:05:08 +0000] "GET /.git/HEAD HTTP/1.1" 404 49 52.238.24.38 - - [27/ ... show more 52.238.24.38 - - [27/Jul/2026:20:05:08 +0000] "GET /.git/HEAD HTTP/1.1" 404 49 52.238.24.38 - - [27/Jul/2026:20:05:08 +0000] "GET /.git/config HTTP/1.1" 404 49 52.238.24.38 - - [27/Jul/2026:20:05:08 +0000] "GET /.git/refs/heads/master HTTP/1.1" 404 49 ... show less	Hacking Web App Attack

Showing 1 to 15 of 111 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇬🇧 2a06:4882:3000::27

🇭🇰 223.17.1.118

🇨🇼 190.104.106.84

🇸🇬 167.172.91.43

🇮🇹 83.224.176.135

🇫🇷 51.68.107.157

🇧🇪 35.240.79.37

🇮🇳 223.228.131.226

🇫🇷 185.188.249.121

🇮🇹 151.33.108.223

🇮🇳 122.170.100.253

🇫🇷 92.205.177.212

🇳🇱 91.92.47.140

🇨🇦 85.217.149.68

🇮🇱 77.137.65.177

🇲🇾 49.124.152.157

🇫🇮 37.27.239.121

🇸🇬 20.153.140.50

🇺🇸 20.150.192.63

🇳🇱 5.61.209.44