JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

52.254.82.228

Neutral Activity

Abuse Confidence Score

0% Low Risk

45 reports

25 reporters · latest 11 months ago

ISP: Microsoft Corporation
Usage Type: Data Center/Web Hosting/Transit
ASN: AS8075
Domain Name: microsoft.com
Country: 🇺🇸 United States of America
City: Boydton, Virginia

ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report Whois

No reports in the last 60 days

52.254.82.228 has been reported 45 times. The most recent report is from 11 months ago.

The full history is preserved below and remains searchable. A 0% score reflects the absence of recent activity, but this is not a guarantee that earlier reports were invalid. Abuse confidence score decays, naturally, over time, when the abusive activity stops.

Abuse Reports

Export reports CSV

Total reports

45 from 25 distinct reporters

First reported

November 25th 2025

Most recent report

11 months ago

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇦🇹 penguin-solutions.at	2025-11-27 02:29:06 UTC · (11 months ago)	Excessive 403/404 errors ...	Brute-Force Web App Attack
Anonymous	2025-11-27 02:26:12 UTC · (11 months ago)	Bot / seems abusive / Apache connections: 20	DDoS Attack Web Spam Bad Web Bot Web App Attack
🇧🇪 madeit	2025-11-27 01:43:07 UTC · (11 months ago)		Web App Attack
Anonymous	2025-11-27 00:56:46 UTC · (11 months ago)	52.254.82.228 - - [27/Nov/2025:00:56:45 +0000] "GET /cgi-bin/ HTTP/1.1" 404 341 "https://www.yahoo.com/" "Mozilla/5.0 (iPhone; CPU iPhone OS 16_6_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.6 Mobile/15E148 Safari/604.1" ...	Bad Web Bot Web App Attack
Anonymous	2025-11-27 00:36:48 UTC · (11 months ago)	Multiple, malicious web requests detected	Port Scan Hacking
🇬🇧 Greg Poulson	2025-11-27 00:19:33 UTC · (11 months ago)	Our website was hit by this DDOS at a rate of 188 in 5 minutes.	DDoS Attack Web Spam Brute-Force
🇺🇸 TPI-Abuse	2025-11-26 23:28:53 UTC · (11 months ago)	(mod_security) mod_security (id:210492) triggered by 52.254.82.228 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 26 18:28:47.545653 2025] [security2:error] [pid 3529:tid 3529] [client 52.254.82.228:4428] ModS ... show more (mod_security) mod_security (id:210492) triggered by 52.254.82.228 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 26 18:28:47.545653 2025] [security2:error] [pid 3529:tid 3529] [client 52.254.82.228:4428] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpcalendars.riccardiagency.com"] [uri "/user/.env"] [unique_id "aSeNL6NOoT0xTgJ44f--hAAAABQ"], referer: https://www.google.com/ show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2025-11-26 22:33:37 UTC · (11 months ago)	(mod_security) mod_security (id:210492) triggered by 52.254.82.228 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 26 17:33:32.556155 2025] [security2:error] [pid 2093:tid 2107] [client 52.254.82.228:5833] ModS ... show more (mod_security) mod_security (id:210492) triggered by 52.254.82.228 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 26 17:33:32.556155 2025] [security2:error] [pid 2093:tid 2107] [client 52.254.82.228:5833] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpanel.docdalton.com"] [uri "/user/.env"] [unique_id "aSeAPJWE1bcwy6EUzUYAnwAAAQo"], referer: https://www.google.de/ show less	Brute-Force Bad Web Bot Web App Attack
Anonymous	2025-11-26 22:30:04 UTC · (11 months ago)	suspicious request in access.log	Web App Attack
Anonymous	2025-11-26 22:23:36 UTC · (11 months ago)	52.254.82.228 - - [26/Nov/2025:23:23:07 +0100] "GET /cgi-bin/ HTTP/1.1" 404 451 "https://duckduckgo.com/" "Mozilla/5.0 (Linux; Android 10; LM-Q720) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Mobile Safari/537.36" 52.254.82.228 - - [26/No ... show more 52.254.82.228 - - [26/Nov/2025:23:23:07 +0100] "GET /cgi-bin/ HTTP/1.1" 404 451 "https://duckduckgo.com/" "Mozilla/5.0 (Linux; Android 10; LM-Q720) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Mobile Safari/537.36" 52.254.82.228 - - [26/Nov/2025:23:23:07 +0100] "GET /cgi-bin/bypass.php HTTP/1.1" 404 451 "https://www.google.co.uk/" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Mobile Safari/537.36" 52.254.82.228 - - [26/Nov/2025:23:23:07 +0100] "GET /filemanager/dialog.php HTTP/1.1" 404 451 "https://www.google.co.uk/" "Mozilla/5.0 (Linux; Android 14; Pixel 8 Pro) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Mobile Safari/537.36" 52.254.82.228 - - [26/Nov/2025:23:23:07 +0100] "GET /wp-admin/css/ HTTP/1.1" 404 451 "https://www.google.com/" "Mozilla/5.0 (iPhone; CPU iPhone OS 16_6_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.6 Mobile/15E148 Safari/604.1" 52.254.82.228 - - [26/Nov/2025:23:23:08 +0100 ... show less	DDoS Attack
🇺🇸 TPI-Abuse	2025-11-26 20:58:41 UTC · (11 months ago)	(mod_security) mod_security (id:210492) triggered by 52.254.82.228 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 26 15:58:34.749034 2025] [security2:error] [pid 27990:tid 27990] [client 52.254.82.228:2190] Mo ... show more (mod_security) mod_security (id:210492) triggered by 52.254.82.228 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 26 15:58:34.749034 2025] [security2:error] [pid 27990:tid 27990] [client 52.254.82.228:2190] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "emailaegis.axiomemail.net"] [uri "/user/.env"] [unique_id "aSdp-o1FwEeawuvJxOugQwAAAAM"], referer: https://www.google.co.uk/ show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2025-11-26 19:01:59 UTC · (11 months ago)	(mod_security) mod_security (id:210492) triggered by 52.254.82.228 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 26 14:01:53.863356 2025] [security2:error] [pid 26770:tid 26862] [client 52.254.82.228:8883] Mo ... show more (mod_security) mod_security (id:210492) triggered by 52.254.82.228 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 26 14:01:53.863356 2025] [security2:error] [pid 26770:tid 26862] [client 52.254.82.228:8883] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpanel.lauricella.us"] [uri "/user/.env"] [unique_id "aSdOoaYYBb1oBezR6MbKAAAAAIY"], referer: https://www.bing.com/ show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2025-11-26 18:39:36 UTC · (11 months ago)	(mod_security) mod_security (id:210492) triggered by 52.254.82.228 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 26 13:39:32.882914 2025] [security2:error] [pid 25642:tid 25642] [client 52.254.82.228:9018] Mo ... show more (mod_security) mod_security (id:210492) triggered by 52.254.82.228 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 26 13:39:32.882914 2025] [security2:error] [pid 25642:tid 25642] [client 52.254.82.228:9018] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "webmail.mixmediallc.com"] [uri "/user/.env"] [unique_id "aSdJZEDp4WE2XSc6u3TCUgAAAA0"], referer: https://www.bing.com/ show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2025-11-26 14:16:14 UTC · (11 months ago)	(mod_security) mod_security (id:210492) triggered by 52.254.82.228 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 26 09:16:05.910549 2025] [security2:error] [pid 21169:tid 21169] [client 52.254.82.228:2381] Mo ... show more (mod_security) mod_security (id:210492) triggered by 52.254.82.228 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 26 09:16:05.910549 2025] [security2:error] [pid 21169:tid 21169] [client 52.254.82.228:2381] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "tritec.com.gt"] [uri "/user/.env"] [unique_id "aScLpREzoJD3Dh3vyV1UIwAAAB0"], referer: https://www.google.de/ show less	Brute-Force Bad Web Bot Web App Attack
🇫🇷 dynamix	2025-11-26 14:13:27 UTC · (11 months ago)	Multiple WAF Violations	Web App Attack

Showing 1 to 15 of 45 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown

Recently Reported IPs:

🇳🇱 195.178.110.30

🇮🇳 122.170.216.130

🇬🇭 196.50.29.16

🇳🇱 192.253.248.225

🇫🇷 185.177.72.29

🇩🇪 142.93.97.192

🇩🇪 141.11.36.184

🇯🇵 139.162.99.58

🇨🇳 81.70.2.239

🇺🇸 71.225.118.206

🇺🇸 45.136.25.178

🇬🇧 5.252.83.18

🇮🇷 5.239.172.166

🇵🇰 202.47.53.162

🇺🇸 147.78.182.84

🇺🇸 146.88.240.172

🇸🇬 129.226.198.250

🇮🇷 78.38.26.124

🇮🇷 77.237.185.21

🇳🇱 45.74.28.6