JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

52.254.84.105

Neutral Activity

Abuse Confidence Score

0% Low Risk

52 reports

35 reporters · latest 11 months ago

ISP: Microsoft Corporation
Usage Type: Data Center/Web Hosting/Transit
ASN: AS8075
Domain Name: microsoft.com
Country: 🇺🇸 United States of America
City: Boydton, Virginia

ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report Whois

No reports in the last 60 days

52.254.84.105 has been reported 52 times. The most recent report is from 11 months ago.

The full history is preserved below and remains searchable. A 0% score reflects the absence of recent activity, but this is not a guarantee that earlier reports were invalid. Abuse confidence score decays, naturally, over time, when the abusive activity stops.

Abuse Reports

Export reports CSV

Total reports

52 from 35 distinct reporters

First reported

November 25th 2025

Most recent report

11 months ago

Reporter	IoA Timestamp (UTC)	Comment	Categories
Anonymous	2025-12-15 08:28:14 UTC · (11 months ago)	Blocked: Reason='Auto-block via DW'; Requests=0	Hacking
🇬🇧 openstrike.co.uk	2025-11-27 06:14:18 UTC · (11 months ago)	3 attacks on Alfa URLs: GET /wp-includes/ALFA_DATA/alfacgiapi/perl.alfa HTTP/1.1	Hacking
🇺🇦 URAN Publishing Service	2025-11-27 03:24:22 UTC · (11 months ago)	52.254.84.105 - - [27/Nov/2025:05:24:21 +0200] "GET /cgi-bin/ HTTP/1.1" 404 441 "https://www.google.fr/" "Mozilla/5.0 (Linux; Android 11; CPH2251) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Mobile Safari/537.36" ...	Web App Attack
🇩🇪 Blexyel	2025-11-27 02:13:48 UTC · (11 months ago)	52.254.84.105 - - [27/Nov/2025:03:13:47 +0100] "GET /wp-admin/js/wp-login.php HTTP/1.1" 301 169 "https://www.yahoo.com/" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Mobile Safari/537.36" "pingusmc.org" ... show more 52.254.84.105 - - [27/Nov/2025:03:13:47 +0100] "GET /wp-admin/js/wp-login.php HTTP/1.1" 301 169 "https://www.yahoo.com/" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Mobile Safari/537.36" "pingusmc.org" ... show less	Brute-Force Web App Attack
🇬🇧 [email protected]	2025-11-27 00:53:13 UTC · (11 months ago)	...	Brute-Force SSH
🇫🇷 LRob	2025-11-27 00:01:14 UTC · (11 months ago)	Repeated 404 errors, blocked by Fail2ban in custom-404 jail	Bad Web Bot
🇩🇪 oh.mg	2025-11-26 23:04:06 UTC · (11 months ago)	[Thu Nov 27 00:04:04.807248 2025] [security2:error] [pid 2039073:tid 2039096] [client 52.254.84.105:4684] [client 52.254.84.105] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:blocking_inbound_anomaly_score. [file "/u ... show more [Thu Nov 27 00:04:04.807248 2025] [security2:error] [pid 2039073:tid 2039096] [client 52.254.84.105:4684] [client 52.254.84.105] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:blocking_inbound_anomaly_score. [file "/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "233"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [ver "OWASP_CRS/4.10.0-dev"] [tag "anomaly-evaluation"] [tag "OWASP_CRS"] [hostname "mmn.cat"] [uri "/phpinfo"] [unique_id "aSeHZJbFxGjn2PITsszDpwAAAVU"], referer: https://www.google.de/ [Thu Nov 27 00:04:05.185047 2025] [security2:error] [pid 2039073:tid 2039099] [client 52.254.84.105:4684] [client 52.254.84.105] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:blocking_inbound_anomaly_score. [file "/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "233"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [ver "O ... show less	Bad Web Bot Web App Attack
🇺🇸 myagent.site	2025-11-26 22:54:49 UTC · (11 months ago)	Blocking for trying to access an exploit file: /xmlrpc.php	Hacking
🇩🇪 Vegascosmetics	2025-11-26 22:50:30 UTC · (11 months ago)	Kingcopy(AI-IDS):IP is Probing for Wordpress vulnerabilities WTF:Banned	Hacking Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2025-11-26 22:20:29 UTC · (11 months ago)	(mod_security) mod_security (id:210492) triggered by 52.254.84.105 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 26 17:20:24.451467 2025] [security2:error] [pid 23380:tid 23380] [client 52.254.84.105:9642] Mo ... show more (mod_security) mod_security (id:210492) triggered by 52.254.84.105 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 26 17:20:24.451467 2025] [security2:error] [pid 23380:tid 23380] [client 52.254.84.105:9642] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpcontacts.platinumkissband.com"] [uri "/user/.env"] [unique_id "aSd9KHULIbUuAeu6SksP_AAAABA"], referer: https://www.google.de/ show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2025-11-26 18:46:38 UTC · (11 months ago)	(mod_security) mod_security (id:210492) triggered by 52.254.84.105 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 26 13:46:31.404611 2025] [security2:error] [pid 29583:tid 29583] [client 52.254.84.105:3981] Mo ... show more (mod_security) mod_security (id:210492) triggered by 52.254.84.105 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 26 13:46:31.404611 2025] [security2:error] [pid 29583:tid 29583] [client 52.254.84.105:3981] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "webmail.fgrotary.org"] [uri "/user/.env"] [unique_id "aSdLBzltZDv5hN_hVQEmGQAAAB0"], referer: https://www.google.de/ show less	Brute-Force Bad Web Bot Web App Attack
🇩🇪 FeG Deutschland	2025-11-26 17:53:09 UTC · (11 months ago)	Looking for CMS/PHP/SQL vulnerablilities/excessive crawling - 124	Exploited Host Web App Attack
🇺🇸 TPI-Abuse	2025-11-26 17:20:05 UTC · (11 months ago)	(mod_security) mod_security (id:210492) triggered by 52.254.84.105 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 26 12:19:59.634711 2025] [security2:error] [pid 30387:tid 30387] [client 52.254.84.105:9850] Mo ... show more (mod_security) mod_security (id:210492) triggered by 52.254.84.105 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 26 12:19:59.634711 2025] [security2:error] [pid 30387:tid 30387] [client 52.254.84.105:9850] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpcontacts.realstorybooks.com"] [uri "/user/.env"] [unique_id "aSc2v89NayNFf4C_z2G12wAAAAA"], referer: https://www.google.co.uk/ show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2025-11-26 16:56:52 UTC · (11 months ago)	(mod_security) mod_security (id:210492) triggered by 52.254.84.105 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 26 11:56:49.237270 2025] [security2:error] [pid 18674:tid 18674] [client 52.254.84.105:4042] Mo ... show more (mod_security) mod_security (id:210492) triggered by 52.254.84.105 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 26 11:56:49.237270 2025] [security2:error] [pid 18674:tid 18674] [client 52.254.84.105:4042] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "akramansari.com"] [uri "/user/.env"] [unique_id "aScxUaTYou9CWZFaZcjDiAAAAAY"], referer: https://www.google.co.uk/ show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 mnsf	2025-11-26 16:06:02 UTC · (11 months ago)	Too many Status 40X (18)	Brute-Force Web App Attack

Showing 1 to 15 of 52 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown

Recently Reported IPs:

🇺🇸 216.25.90.108

🇧🇷 189.90.1.22

🇦🇷 186.39.47.168

🇬🇧 185.247.137.241

🇬🇧 185.247.137.239

🇬🇧 185.247.137.231

🇬🇧 185.247.137.228

🇨🇳 61.138.154.240

🇬🇧 45.133.173.12

🇳🇱 34.3.90.10

🇨🇳 27.115.124.6

🇳🇱 195.178.110.228

🇳🇱 193.47.62.69

🇬🇧 185.247.137.227

🇬🇧 185.247.137.223

🇬🇧 185.247.137.220

🇬🇧 185.247.137.219

🇨🇳 182.44.26.211

🇫🇮 147.185.133.171

🇰🇷 118.37.214.187