AbuseIPDB » 52.252.56.42

52.252.56.42 was found in our database!

This IP was reported 27 times. Confidence of Abuse is 72%: ?

72%

ISP	Microsoft Corporation
Usage Type	Data Center/Web Hosting/Transit
ASN	AS8075
Domain Name	microsoft.com
Country	United States of America
City	Boydton, Virginia

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated biweekly.

Report 52.252.56.42

Whois 52.252.56.42

IP Abuse Reports for 52.252.56.42:

This IP address has been reported a total of 27 times from 23 distinct sources. 52.252.56.42 was first reported on March 26th 2025, and the most recent report was 3 weeks ago.

Old Reports: The most recent abuse report for this IP address is from 3 weeks ago. It is possible that this IP is no longer involved in abusive activities.

Reporter	IoA Timestamp in UTC	Comment	Categories
www.Examensfragen.de	2025-03-28 06:41:35 (3 weeks ago)		Web Spam Bad Web Bot
openstrike.co.uk	2025-03-27 06:12:58 (3 weeks ago)	355 attacks on PHP URLs: GET /footer.php HTTP/1.1	Web App Attack
octageeks.com	2025-03-27 04:07:13 (3 weeks ago)	Wordpress malicious attack:[octablocked]	Web App Attack
weils.net	2025-03-26 22:36:44 (3 weeks ago)	2025-03-27 06:36:44(GMT+8) - /WordPress/wp-admin/includes/zmFM.php	Bad Web Bot
paulshipley.com.au	2025-03-26 22:24:14 (3 weeks ago)	valueaddedpromotions.com.au:443 52.252.56.42 - - [27/Mar/2025:09:23:11 +1100] "GET /wp-includes/Text ... show morevalueaddedpromotions.com.au:443 52.252.56.42 - - [27/Mar/2025:09:23:11 +1100] "GET /wp-includes/Text/network.php HTTP/1.1" 404 145933 "-" "-" valueaddedpromotions.com.au:443 52.252.56.42 - - [27/Mar/2025:09:23:15 +1100] "GET /js/fm.php HTTP/1.1" 404 145280 "-" "-" valueaddedpromotions.com.au:443 52.252.56.42 - - [27/Mar/2025:09:23:17 +1100] "GET /WordPress/wp-admin/includes/zmFM.php HTTP/1.1" 404 145937 "-" "-" valueaddedpromotions.com.au:443 52.252.56.42 - - [27/Mar/2025:09:23:19 +1100] "GET /default.php HTTP/1.1" 404 145286 "-" "-" valueaddedpromotions.com.au:443 52.252.56.42 - - [27/Mar/2025:09:23:21 +1100] "GET /ty.php HTTP/1.1" 404 145281 "-" "-" valueaddedpromotions.com.au:443 52.252.56.42 - - [27/Mar/2025:09:23:23 +1100] "GET /fm.php HTTP/1.1" 404 145281 "-" "-" valueaddedpromotions.com.au:443 52.252.56.42 - - [27/Mar/2025:09:23:26 +1100] "GET /ini.php HTTP/1.1" 404 145282 "-" "-" valueaddedpromotions.com.au:443 52.252.56.42 - - [27/Mar/2025:09:23:27 +1100] "GET /libraries/legac ... show less	Web App Attack
Penny Packer	2025-03-26 21:44:43 (3 weeks ago)	Fail2Ban apache-tripwires	Web App Attack
Anonymous	2025-03-26 21:03:21 (3 weeks ago)	(mod_security) mod_security triggered on hostname [redacted] 52.252.56.42 (US/United States/-)	SQL Injection
Anonymous	2025-03-26 20:20:53 (3 weeks ago)	52.252.56.42 - - [26/Mar/2025:21:20:27 +0100] "GET /wp-content/plugins/hellopress/wp_filemanager.php ... show more52.252.56.42 - - [26/Mar/2025:21:20:27 +0100] "GET /wp-content/plugins/hellopress/wp_filemanager.php HTTP/1.1" 404 33110 52.252.56.42 - - [26/Mar/2025:21:20:29 +0100] "GET /wp-includes/Text/network.php HTTP/1.1" 404 33109 52.252.56.42 - - [26/Mar/2025:21:20:31 +0100] "GET /js/fm.php HTTP/1.1" 404 33109 52.252.56.42 - - [26/Mar/2025:21:20:34 +0100] "GET /wp-content/themes/astra/inc/ki1k.php HTTP/1.1" 404 33109 52.252.56.42 - - [26/Mar/2025:21:20:36 +0100] "GET /WordPress/wp-admin/includes/zmFM.php HTTP/1.1" 404 33109 52.252.56.42 - - [26/Mar/2025:21:20:39 +0100] "GET /default.php HTTP/1.1" 404 33111 52.252.56.42 - - [26/Mar/2025:21:20:42 +0100] "GET /ty.php HTTP/1.1" 404 33109 52.252.56.42 - - [26/Mar/2025:21:20:45 +0100] "GET /wp-content/themes/cay-van-phong/filemanager.php HTTP/1.1" 404 33110 52.252.56.42 - - [26/Mar/2025:21:20:47 +0100] "GET /fm.php HTTP/1.1" 404 33109 52.252.56.42 - - [26/Mar/2025:21:20:50 +0100] "GET /wp-content/plugins/seoplugins/ HTTP/1.1" 404 34550 ... show less	Web Spam Web App Attack
Anonymous	2025-03-26 20:15:24 (3 weeks ago)	(apache-scanners) Failed apache-scanners trigger with match [redacted] from 52.252.56.42 (US/United ... show more(apache-scanners) Failed apache-scanners trigger with match [redacted] from 52.252.56.42 (US/United States/-) show less	Port Scan
TPI-Abuse	2025-03-26 20:09:13 (3 weeks ago)	(mod_security) mod_security (id:240000) triggered by 52.252.56.42 (-): 1 in the last 300 secs; Ports ... show more(mod_security) mod_security (id:240000) triggered by 52.252.56.42 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Mar 26 16:09:04.890967 2025] [security2:error] [pid 14775:tid 14775] [client 52.252.56.42:7467] [client 52.252.56.42] ModSecurity: Access denied with code 403 (phase 2). String match ".php" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/24_Apps_Joomla.conf"] [line "74"] [id "240000"] [rev "1"] [msg "COMODO WAF: Protecting Joomla folder||readyremotely.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "Joomla"] [hostname "readyremotely.com"] [uri "/images/stories/admin-post.php"] [unique_id "Z-Re4NtwRcx8WTU_yP_gXwAAABM"] show less	Brute-Force Bad Web Bot Web App Attack
LRob.fr	2025-03-26 20:00:14 (3 weeks ago)	Repeated 403 errors, blocked by Fail2ban in custom-403 jail	Bad Web Bot
findlab	2025-03-26 20:00:01 (3 weeks ago)	Backdrop CMS module - malicious activity detected	Bad Web Bot Web App Attack
FeG Deutschland	2025-03-26 19:33:22 (3 weeks ago)	Looking for CMS/PHP/SQL vulnerablilities/excessive crawling - 14	Exploited Host Web App Attack
Ba-Yu	2025-03-26 19:07:10 (3 weeks ago)	WordPress hacking/exploits/scanning	Web Spam Hacking Brute-Force Exploited Host Web App Attack
mnsf	2025-03-26 19:05:17 (3 weeks ago)	Too many Status 40X (12)	Brute-Force Web App Attack

Is this your IP? You may request to takedown any associated reports. We will attempt to verify your ownership. Request Takedown 🚩