JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

52.254.82.202

Neutral Activity

Abuse Confidence Score

0% Low Risk

41 reports

30 reporters · latest 10 months ago

ISP: Microsoft Corporation
Usage Type: Data Center/Web Hosting/Transit
ASN: AS8075
Domain Name: microsoft.com
Country: 🇺🇸 United States of America
City: Boydton, Virginia

ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report Whois

No reports in the last 60 days

52.254.82.202 has been reported 41 times. The most recent report is from 10 months ago.

The full history is preserved below and remains searchable. A 0% score reflects the absence of recent activity, but this is not a guarantee that earlier reports were invalid. Abuse confidence score decays, naturally, over time, when the abusive activity stops.

Abuse Reports

Export reports CSV

Total reports

41 from 30 distinct reporters

First reported

November 25th 2025

Most recent report

10 months ago

Reporter	IoA Timestamp (UTC)	Comment	Categories
Anonymous	2025-12-15 08:28:13 UTC · (10 months ago)	Blocked: Reason='Auto-block via DW'; Requests=0	Hacking
🇺🇸 Rip	2025-11-27 02:04:09 UTC · (11 months ago)	Attacks against MySQL, MariaDB, and/or phpMyAdmin.	Port Scan Web App Attack
🇩🇪 ps-center	2025-11-27 01:49:41 UTC · (11 months ago)	C1: Web Attack GET /wp-admin/css/	Web Spam Hacking Bad Web Bot Web App Attack
🇬🇧 [email protected]	2025-11-27 00:53:13 UTC · (11 months ago)	...	Brute-Force SSH
🇺🇸 bazter.pro	2025-11-27 00:22:40 UTC · (11 months ago)	[nginx-ip-monitor] 2025-11-27 02:22:40; AbuseIPDB confidence: 100%; Sensitive file access: /wp-admin/css/, /wp-admin/css, /xmlrpc.php, /wp-content/, /wp-content; Datacenter IP: Data Center/Web Hosting/Transit; Multiple 404 errors: 357; Many unique pa ... show more [nginx-ip-monitor] 2025-11-27 02:22:40; AbuseIPDB confidence: 100%; Sensitive file access: /wp-admin/css/, /wp-admin/css, /xmlrpc.php, /wp-content/, /wp-content; Datacenter IP: Data Center/Web Hosting/Transit; Multiple 404 errors: 357; Many unique paths: 443; Total requests: 443 show less	Web App Attack
🇧🇾 lns.bz	2025-11-26 23:46:38 UTC · (11 months ago)	Too many 404 requests [BY]	Web App Attack
🇳🇱 homeshowdomain.nl	2025-11-26 23:05:48 UTC · (11 months ago)	Auto-ban: 214 malicious requests on 2025-11-25 (e.g., env/backup probes, brute-force, or error bursts).	Hacking Web App Attack SSH
🇺🇸 TPI-Abuse	2025-11-26 20:31:26 UTC · (11 months ago)	(mod_security) mod_security (id:210492) triggered by 52.254.82.202 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 26 15:31:20.149120 2025] [security2:error] [pid 29885:tid 29885] [client 52.254.82.202:5833] Mo ... show more (mod_security) mod_security (id:210492) triggered by 52.254.82.202 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 26 15:31:20.149120 2025] [security2:error] [pid 29885:tid 29885] [client 52.254.82.202:5833] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "autodiscover.bringkittyhome.com"] [uri "/user/.env"] [unique_id "aSdjmPOfv4WIS1QpQy2wYwAAABQ"], referer: https://www.google.co.uk/ show less	Brute-Force Bad Web Bot Web App Attack
🇩🇪 neckaralb-admin.de	2025-11-26 20:08:23 UTC · (11 months ago)	(wordpress) Failed login wp-login.php or xmlrpc.php	Web App Attack
🇺🇸 TPI-Abuse	2025-11-26 17:31:13 UTC · (11 months ago)	(mod_security) mod_security (id:210492) triggered by 52.254.82.202 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 26 12:31:09.561026 2025] [security2:error] [pid 25837:tid 25860] [client 52.254.82.202:4126] Mo ... show more (mod_security) mod_security (id:210492) triggered by 52.254.82.202 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 26 12:31:09.561026 2025] [security2:error] [pid 25837:tid 25860] [client 52.254.82.202:4126] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpcontacts.inkandthreadllc.com"] [uri "/user/.env"] [unique_id "aSc5XYo8waOrYdA52G9R3wAAANE"], referer: https://www.yahoo.com/ show less	Brute-Force Bad Web Bot Web App Attack
🇬🇧 Swiptly	2025-11-26 16:49:15 UTC · (11 months ago)	Excessive 403/404/405 PHP/CMS errors from scanning or broken bots ...	Web App Attack
🇫🇮 Shaik Sai Meera	2025-11-26 16:30:08 UTC · (11 months ago)	IM360 WAF: Infectors: Suspicious access attempt (webshell)	FTP Brute-Force Open Proxy Brute-Force
🇺🇸 TPI-Abuse	2025-11-26 15:39:19 UTC · (11 months ago)	(mod_security) mod_security (id:210492) triggered by 52.254.82.202 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 26 10:39:16.901823 2025] [security2:error] [pid 7685:tid 7685] [client 52.254.82.202:1169] ModS ... show more (mod_security) mod_security (id:210492) triggered by 52.254.82.202 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 26 10:39:16.901823 2025] [security2:error] [pid 7685:tid 7685] [client 52.254.82.202:1169] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpcontacts.vaezi.com"] [uri "/user/.env"] [unique_id "aScfJEQnwPEhKdt61VvjpgAAAAU"], referer: https://www.google.fr/ show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2025-11-26 12:46:35 UTC · (11 months ago)	(mod_security) mod_security (id:210492) triggered by 52.254.82.202 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 26 07:46:29.153267 2025] [security2:error] [pid 32493:tid 32493] [client 52.254.82.202:3271] Mo ... show more (mod_security) mod_security (id:210492) triggered by 52.254.82.202 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 26 07:46:29.153267 2025] [security2:error] [pid 32493:tid 32493] [client 52.254.82.202:3271] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpanel.iainrealtor.com"] [uri "/user/.env"] [unique_id "aSb2pSh6geZtOYhXLZp78wAAAAA"], referer: https://www.google.co.uk/ show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 Jason Howell	2025-11-26 12:39:08 UTC · (11 months ago)	52.254.82.202 - - [26/Nov/2025:06:38:30 -0600] "GET /xmlrpc.php HTTP/1.1" 301 547 "https://www.bing.com/" "Mozilla/5.0 (Linux; Android 12; SM-A525F) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Mobile Safari/537.36" 52.254.82.202 - - [26/N ... show more 52.254.82.202 - - [26/Nov/2025:06:38:30 -0600] "GET /xmlrpc.php HTTP/1.1" 301 547 "https://www.bing.com/" "Mozilla/5.0 (Linux; Android 12; SM-A525F) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Mobile Safari/537.36" 52.254.82.202 - - [26/Nov/2025:06:38:30 -0600] "GET /xmlrpc.php HTTP/1.1" 405 409 "https://www.bing.com/" "Mozilla/5.0 (Linux; Android 12; SM-A525F) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Mobile Safari/537.36" 52.254.82.202 - - [26/Nov/2025:06:39:06 -0600] "GET /wp-admin/js/wp-login.php HTTP/1.1" 301 575 "https://www.google.de/" "Mozilla/5.0 (iPad; CPU OS 16_7_2 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.6 Mobile/15E148 Safari/604.1" 52.254.82.202 - - [26/Nov/2025:06:39:06 -0600] "GET /wp-admin/js/wp-login.php HTTP/1.1" 404 29957 "https://www.google.de/" "Mozilla/5.0 (iPad; CPU OS 16_7_2 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.6 Mobile/15E148 Safari/604.1" 52.254.82.202 - - [26/Nov/2025:06:39:08 ... show less	Web App Attack

Showing 1 to 15 of 41 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown

Recently Reported IPs:

🇩🇪 2001:470:6d:792:2222:3679:4d9c:6000

🇨🇴 201.184.50.251

🇩🇪 188.104.221.83

🇺🇸 162.216.149.195

🇺🇸 162.158.186.18

🇮🇳 128.185.208.42

🇺🇸 104.28.233.159

🇺🇸 98.80.4.126

🇺🇸 66.132.159.66

🇩🇪 64.89.163.138

🇨🇦 45.198.224.125

🇧🇪 35.210.185.30

🇩🇪 193.124.20.231

🇺🇸 162.216.150.252

🇺🇸 162.216.149.179

🇺🇸 162.158.63.186

🇳🇵 103.155.21.173

🇧🇪 35.210.167.3

🇸🇮 31.57.37.52

🇸🇬 2a09:bac5:55f8:1014::19a:1ec