JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

52.254.82.172

Neutral Activity

Abuse Confidence Score

0% Low Risk

43 reports

28 reporters · latest 10 months ago

ISP: Microsoft Corporation
Usage Type: Data Center/Web Hosting/Transit
ASN: AS8075
Domain Name: microsoft.com
Country: 🇺🇸 United States of America
City: Boydton, Virginia

ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report Whois

No reports in the last 60 days

52.254.82.172 has been reported 43 times. The most recent report is from 10 months ago.

The full history is preserved below and remains searchable. A 0% score reflects the absence of recent activity, but this is not a guarantee that earlier reports were invalid. Abuse confidence score decays, naturally, over time, when the abusive activity stops.

Abuse Reports

Export reports CSV

Total reports

43 from 28 distinct reporters

First reported

November 25th 2025

Most recent report

10 months ago

Reporter	IoA Timestamp (UTC)	Comment	Categories
Anonymous	2025-12-15 08:28:11 UTC · (10 months ago)	Blocked: Reason='Auto-block via DW'; Requests=0	Hacking
🇨🇭 backslash	2025-11-29 06:07:21 UTC · (11 months ago)		Bad Web Bot
🇬🇧 openstrike.co.uk	2025-11-27 06:14:05 UTC · (11 months ago)	1 attack on Alfa URLs: GET /wp-includes/ALFA_DATA/alfacgiapi/perl.alfa HTTP/1.1	Hacking
🇬🇧 [email protected]	2025-11-27 00:53:12 UTC · (11 months ago)	...	Brute-Force SSH
🇺🇸 TPI-Abuse	2025-11-27 00:25:25 UTC · (11 months ago)	(mod_security) mod_security (id:210492) triggered by 52.254.82.172 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 26 19:25:19.643327 2025] [security2:error] [pid 13423:tid 13423] [client 52.254.82.172:5584] Mo ... show more (mod_security) mod_security (id:210492) triggered by 52.254.82.172 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 26 19:25:19.643327 2025] [security2:error] [pid 13423:tid 13423] [client 52.254.82.172:5584] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpanel.i-med.com"] [uri "/user/.env"] [unique_id "aSeab-x6CHS0PHRdezf0UAAAADI"], referer: https://www.google.de/ show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2025-11-26 23:21:53 UTC · (11 months ago)	(mod_security) mod_security (id:210492) triggered by 52.254.82.172 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 26 18:21:50.225383 2025] [security2:error] [pid 16824:tid 16858] [client 52.254.82.172:5035] Mo ... show more (mod_security) mod_security (id:210492) triggered by 52.254.82.172 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 26 18:21:50.225383 2025] [security2:error] [pid 16824:tid 16858] [client 52.254.82.172:5035] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "webdisk.southsideeconomic.org"] [uri "/user/.env"] [unique_id "aSeLjs97VZ-sS76jFmz7cgAAAEI"], referer: https://duckduckgo.com/ show less	Brute-Force Bad Web Bot Web App Attack
🇳🇱 homeshowdomain.nl	2025-11-26 23:05:53 UTC · (11 months ago)	Auto-ban: 36 malicious requests on 2025-11-25 (e.g., env/backup probes, brute-force, or error bursts).	Hacking Web App Attack SSH
🇺🇸 TPI-Abuse	2025-11-26 20:43:40 UTC · (11 months ago)	(mod_security) mod_security (id:210492) triggered by 52.254.82.172 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 26 15:43:36.979471 2025] [security2:error] [pid 17351:tid 17351] [client 52.254.82.172:4098] Mo ... show more (mod_security) mod_security (id:210492) triggered by 52.254.82.172 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 26 15:43:36.979471 2025] [security2:error] [pid 17351:tid 17351] [client 52.254.82.172:4098] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "autodiscover.ourodyssey.us"] [uri "/user/.env"] [unique_id "aSdmeIaTglbURGochOmrAQAAABw"], referer: https://www.bing.com/ show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2025-11-26 20:27:22 UTC · (11 months ago)	(mod_security) mod_security (id:210492) triggered by 52.254.82.172 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 26 15:27:18.477687 2025] [security2:error] [pid 5364:tid 5364] [client 52.254.82.172:9033] ModS ... show more (mod_security) mod_security (id:210492) triggered by 52.254.82.172 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 26 15:27:18.477687 2025] [security2:error] [pid 5364:tid 5364] [client 52.254.82.172:9033] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpcalendars.infolinkqr.com"] [uri "/user/.env"] [unique_id "aSdiptlilVgXWrkOD2E99QAAAAI"], referer: https://www.yahoo.com/ show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2025-11-26 20:08:51 UTC · (11 months ago)	(mod_security) mod_security (id:210492) triggered by 52.254.82.172 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 26 15:08:45.525163 2025] [security2:error] [pid 10421:tid 10421] [client 52.254.82.172:6787] Mo ... show more (mod_security) mod_security (id:210492) triggered by 52.254.82.172 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 26 15:08:45.525163 2025] [security2:error] [pid 10421:tid 10421] [client 52.254.82.172:6787] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "autodiscover.sekizinci.com"] [uri "/user/.env"] [unique_id "aSdeTYppsV55B3eZmku18AAAAAE"], referer: https://www.google.com/ show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2025-11-26 19:31:08 UTC · (11 months ago)	(mod_security) mod_security (id:210492) triggered by 52.254.82.172 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 26 14:30:58.531647 2025] [security2:error] [pid 7996:tid 7996] [client 52.254.82.172:7882] ModS ... show more (mod_security) mod_security (id:210492) triggered by 52.254.82.172 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 26 14:30:58.531647 2025] [security2:error] [pid 7996:tid 7996] [client 52.254.82.172:7882] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpcalendars.cbcconsult.com"] [uri "/user/.env"] [unique_id "aSdVcnhZH2Z8VVmLZRKPFwAAAAg"], referer: https://www.google.com/ show less	Brute-Force Bad Web Bot Web App Attack
🇬🇧 Globe2	2025-11-26 18:13:37 UTC · (11 months ago)	ModSec - Multiple 403s within a short period of time [server: H3]	Web App Attack
🇫🇷 Hippoline	2025-11-26 18:00:12 UTC · (11 months ago)	[Wed Nov 26 18:59:59.658531 2025] [authz_core:error] [pid 3556] [client 52.254.82.172:2737] AH01630: client denied by server configuration: /var/www/ecuries-des-pres.lu/web/xmlrpc.php, referer: https://www.google.de/ [Wed Nov 26 18:59:59.861839 2025] ... show more [Wed Nov 26 18:59:59.658531 2025] [authz_core:error] [pid 3556] [client 52.254.82.172:2737] AH01630: client denied by server configuration: /var/www/ecuries-des-pres.lu/web/xmlrpc.php, referer: https://www.google.de/ [Wed Nov 26 18:59:59.861839 2025] [authz_core:error] [pid 3556] [client 52.254.82.172:2737] AH01630: client denied by server configuration: /var/www/ecuries-des-pres.lu/web/index1.php, referer: https://www.bing.com/ [Wed Nov 26 19:00:00.346201 2025] [authz_core:error] [pid 3556] [client 52.254.82.172:2737] AH01630: client denied by server configuration: /var/www/ecuries-des-pres.lu/web/radio.php, referer: https://www.google.de/ [Wed Nov 26 19:00:00.590163 2025] [authz_core:error] [pid 3556] [client 52.254.82.172:2737] AH01630: client denied by server configuration: /var/www/ecuries-des-pres.lu/web/1index.php, referer: https://www.bing.com/ [Wed Nov 26 19:00:05.663313 2025] [authz_core:error] [pid 3556] [client 52.254.82.172:2737] AH01630: client denied by server configurat ... show less	Brute-Force Web App Attack
🇺🇸 TPI-Abuse	2025-11-26 17:42:18 UTC · (11 months ago)	(mod_security) mod_security (id:210492) triggered by 52.254.82.172 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 26 12:42:12.733350 2025] [security2:error] [pid 1726:tid 1726] [client 52.254.82.172:5739] ModS ... show more (mod_security) mod_security (id:210492) triggered by 52.254.82.172 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 26 12:42:12.733350 2025] [security2:error] [pid 1726:tid 1726] [client 52.254.82.172:5739] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "colbygrenier.com"] [uri "/user/.env"] [unique_id "aSc79AU9EeY-UfV1qIhGzwAAAAQ"], referer: https://www.bing.com/ show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2025-11-26 16:38:16 UTC · (11 months ago)	(mod_security) mod_security (id:210492) triggered by 52.254.82.172 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 26 11:38:09.660716 2025] [security2:error] [pid 31824:tid 31824] [client 52.254.82.172:1121] Mo ... show more (mod_security) mod_security (id:210492) triggered by 52.254.82.172 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 26 11:38:09.660716 2025] [security2:error] [pid 31824:tid 31824] [client 52.254.82.172:1121] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "autodiscover.globalpackets.net"] [uri "/user/.env"] [unique_id "aScs8d5p_BgkCoz65ZNO2gAAABA"], referer: https://www.yahoo.com/ show less	Brute-Force Bad Web Bot Web App Attack

Showing 1 to 15 of 43 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown

Recently Reported IPs:

🇰🇷 211.116.107.222

🇩🇪 64.226.88.200

🇸🇬 185.200.116.79

🇮🇳 115.241.188.162

🇨🇳 111.197.131.51

🇳🇱 109.160.32.129

🇳🇱 85.155.15.23

🇩🇪 85.155.14.246

🇸🇬 47.82.51.135

🇺🇸 40.124.116.13

🇺🇦 31.40.19.202

🇭🇰 8.210.28.151

🇬🇧 185.247.137.134

🇮🇳 152.32.156.50

🇺🇸 76.34.40.189

🇺🇸 66.132.224.26

🇰🇷 58.122.253.78

🇸🇬 47.79.200.39

🇺🇸 20.118.252.14

🇨🇴 200.122.246.58