JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

52.254.82.105

Neutral Activity

Abuse Confidence Score

0% Low Risk

50 reports

29 reporters · latest 10 months ago

ISP: Microsoft Corporation
Usage Type: Data Center/Web Hosting/Transit
ASN: AS8075
Domain Name: microsoft.com
Country: 🇺🇸 United States of America
City: Boydton, Virginia

ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report Whois

No reports in the last 60 days

52.254.82.105 has been reported 50 times. The most recent report is from 10 months ago.

The full history is preserved below and remains searchable. A 0% score reflects the absence of recent activity, but this is not a guarantee that earlier reports were invalid. Abuse confidence score decays, naturally, over time, when the abusive activity stops.

Abuse Reports

Export reports CSV

Total reports

50 from 29 distinct reporters

First reported

November 25th 2025

Most recent report

10 months ago

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇩🇪 betternews.app	2025-12-22 15:54:55 UTC · (10 months ago)	"a web request contained keyword ".php"; Suspicious URL: /wp.php"	Web Spam Blog Spam Brute-Force Bad Web Bot Web App Attack
Anonymous	2025-12-15 08:28:11 UTC · (10 months ago)	Blocked: Reason='Auto-block via DW'; Requests=0	Hacking
🇫🇷 Little Iguana	2025-12-07 09:43:23 UTC · (11 months ago)	Attempt to hack Wordpress Login, XMLRPC or other login	Hacking
Anonymous	2025-11-27 04:30:47 UTC · (11 months ago)	Failed login attempt detected by Fail2Ban in plesk-modsecurity jail	Exploited Host
🇬🇧 thetomtaylor.co.uk	2025-11-27 03:29:00 UTC · (11 months ago)	Fail2Ban - [NGINX]WordPress Logins Sniffings on nginx-wordpress-sniffer ... [wa01]	Bad Web Bot Web App Attack
🇩🇪 todix	2025-11-27 03:20:54 UTC · (11 months ago)	WebAttack or semilar from 52.254.82.105	Web App Attack
🇺🇸 TPI-Abuse	2025-11-27 01:34:24 UTC · (11 months ago)	(mod_security) mod_security (id:210492) triggered by 52.254.82.105 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 26 20:34:17.576584 2025] [security2:error] [pid 12056:tid 12056] [client 52.254.82.105:3024] Mo ... show more (mod_security) mod_security (id:210492) triggered by 52.254.82.105 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 26 20:34:17.576584 2025] [security2:error] [pid 12056:tid 12056] [client 52.254.82.105:3024] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "digitalracemedia.com"] [uri "/user/.env"] [unique_id "aSeqmSppqwFcYJkx51i3BgAAAAE"], referer: https://www.google.de/ show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2025-11-27 00:25:46 UTC · (11 months ago)	(mod_security) mod_security (id:210492) triggered by 52.254.82.105 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 26 19:25:42.845462 2025] [security2:error] [pid 4416:tid 4416] [client 52.254.82.105:7928] ModS ... show more (mod_security) mod_security (id:210492) triggered by 52.254.82.105 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 26 19:25:42.845462 2025] [security2:error] [pid 4416:tid 4416] [client 52.254.82.105:7928] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpcontacts.veneye.com"] [uri "/user/.env"] [unique_id "aSeahmaoYu0kz-IXVMUKHwAAAAs"], referer: https://duckduckgo.com/ show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2025-11-26 23:18:09 UTC · (11 months ago)	(mod_security) mod_security (id:210492) triggered by 52.254.82.105 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 26 18:18:05.611773 2025] [security2:error] [pid 4854:tid 4854] [client 52.254.82.105:6121] ModS ... show more (mod_security) mod_security (id:210492) triggered by 52.254.82.105 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 26 18:18:05.611773 2025] [security2:error] [pid 4854:tid 4854] [client 52.254.82.105:6121] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpcontacts.futureproductionsonline.com"] [uri "/user/.env"] [unique_id "aSeKrcVjTaI7rk1l0sLJxQAAAAo"], referer: https://www.google.co.uk/ show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 Penny Packer	2025-11-26 18:27:24 UTC · (11 months ago)	Fail2Ban apache-tripwires	Web App Attack
Anonymous	2025-11-26 17:27:00 UTC · (11 months ago)	52.254.82.105 (US/United States/-), more than 10 Apache 403 hits	Hacking
🇩🇪 becker-software.de	2025-11-26 16:36:20 UTC · (11 months ago)	{"ip": "52.254.82.105","host": "www.becker-software.de","path": "/cgi-bin/bypass.php","status": "404","referrer": "https://www.google.de/","user_agent": "Mozilla/5.0 (Linux; Android 11; 21081111RG) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0. ... show more {"ip": "52.254.82.105","host": "www.becker-software.de","path": "/cgi-bin/bypass.php","status": "404","referrer": "https://www.google.de/","user_agent": "Mozilla/5.0 (Linux; Android 11; 21081111RG) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Mobile Safari/537.36","length": 197,"generation_time_milli": 0.003,"date": "2025-11-26T16:36:03+00:00"} {"ip": "52.254.82.105","host": "www.becker-software.de","path": "/filemanager/dialog.php","status": "404","referrer": "https://www.google.fr/","user_agent": "Mozilla/5.0 (iPhone; CPU iPhone OS 17_0_3 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.0.1 Mobile/15E148 Safari/604.1","length": 197,"generation_time_milli": 0.002,"date": "2025-11-26T16:36:04+00:00"} {"ip": "52.254.82.105","host": "www.becker-software.de","path": "/xmlrpc.php","status": "404","referrer": "https://duckduckgo.com/","user_agent": "Mozilla/5.0 (iPhone; CPU iPhone OS 15_7_9 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/15.6.5 M ... show less	Web App Attack
🇺🇸 TPI-Abuse	2025-11-26 16:16:01 UTC · (11 months ago)	(mod_security) mod_security (id:210492) triggered by 52.254.82.105 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 26 11:15:55.016252 2025] [security2:error] [pid 17063:tid 17063] [client 52.254.82.105:6883] Mo ... show more (mod_security) mod_security (id:210492) triggered by 52.254.82.105 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 26 11:15:55.016252 2025] [security2:error] [pid 17063:tid 17063] [client 52.254.82.105:6883] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpcalendars.bitdancer.net"] [uri "/user/.env"] [unique_id "aScnu9KG1pWtOKbu8e7GfwAAAAk"], referer: https://www.google.fr/ show less	Brute-Force Bad Web Bot Web App Attack
🇧🇪 Ivo Vynckier	2025-11-26 15:51:00 UTC · (11 months ago)	52.254.82.105 - - [26/Nov/2025:09:46:44 +0100] "GET /cgi-bin/ HTTP/1.1" 403 796 "https://www.google.fr/" "Mozilla/5.0 (Linux; Android 13; SM-G991U) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Mobile Safari/537.36" 52.254.82.105 - - [26/N ... show more 52.254.82.105 - - [26/Nov/2025:09:46:44 +0100] "GET /cgi-bin/ HTTP/1.1" 403 796 "https://www.google.fr/" "Mozilla/5.0 (Linux; Android 13; SM-G991U) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Mobile Safari/537.36" 52.254.82.105 - - [26/Nov/2025:09:46:44 +0100] "GET /cgi-bin/bypass.php HTTP/1.1" 301 263 "https://www.google.co.uk/" "Mozilla/5.0 (Linux; Android 12; V2134) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Mobile Safari/537.36" show less	Web App Attack
🇦🇺 2000cn.com.au	2025-11-26 14:23:17 UTC · (11 months ago)	This IP was detected by CrowdSec triggering crowdsecurity/http-probing	Hacking Web App Attack

Showing 1 to 15 of 50 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown

Recently Reported IPs:

🇹🇭 165.154.251.237

🇩🇿 154.241.15.84

🇫🇷 104.23.225.130

🇺🇸 100.50.17.159

🇺🇸 66.132.159.69

🇺🇸 47.18.200.242

🇺🇸 40.119.43.103

🇬🇧 185.216.145.180

🇨🇭 172.71.141.129

🇪🇨 157.100.123.193

🇭🇰 152.32.225.199

🇳🇱 77.67.26.189

🇧🇷 201.182.97.217

🇮🇳 152.32.159.97

🇫🇷 141.94.121.165

🇧🇩 103.178.191.168

🇺🇦 91.222.18.52

🇮🇹 79.35.55.153

🇩🇪 69.5.169.200

🇧🇪 34.78.49.147