52.254.84.112

Neutral Activity There is no recent abuse activity, or the IP address is whitelisted.
Abuse Confidence Score
0% Low Risk
39 reports
24 reporters · latest 11 months ago
ISP
Microsoft Corporation
Usage Type
Data Center/Web Hosting/Transit
ASN
AS8075
Domain Name
microsoft.com
Country
🇺🇸 United States of America
City
Boydton, Virginia
Log in to view charts and search reports for this IP. Log In

No reports in the last 60 days

52.254.84.112 has been reported 39 times. The most recent report is from .

The full history is preserved below and remains searchable. A 0% score reflects the absence of recent activity, but this is not a guarantee that earlier reports were invalid. Abuse confidence score decays, naturally, over time, when the abusive activity stops.

Abuse Reports

Total reports
39 from 24 distinct reporters
First reported
Most recent report
Reporter IoA Timestamp (UTC) Comment Categories
🇬🇧 [email protected]
...
Brute-Force SSH
🇳🇱 homeshowdomain.nl
Auto-ban: 15 malicious requests on 2025-11-26 (e.g., env/backup probes, brute-force, or error bursts).
Hacking Web App Attack SSH
🇺🇸 Carltonfsck
52.254.84.112 - - [27/Nov/2025:03:28:00 +0000] "GET /.well-known/ HTTP/1.1" 404 49 52.254.84.112 - - [27/Nov/2025:03:28:00 +0000] "GET /.well-known/acme-challenge/ HTTP/1.1" 404 49 ...
Hacking Web App Attack
🇺🇸 TPI-Abuse
Brute-Force Bad Web Bot Web App Attack
Anonymous
Fail2Ban apache-noscript
Bad Web Bot
🇺🇸 TPI-Abuse
Brute-Force Bad Web Bot Web App Attack
Anonymous
Hacking Web App Attack
🇺🇸 Major Hostility
"GET /cgi-bin/ HTTP/1.1" 404 "GET /cgi-bin/bypass.php HTTP/1.1" 404 "GET /filemanager/dialog.php HTTP/1.1" 404 "GET /xmlrpc.php HTTP/1.1" 403 "GET /index1.php HTTP/1.1" 404 "GET /radio.php HTTP/1.1" 404 "GET /1index.php HTTP/1.1" 404
Web App Attack
🇺🇸 TPI-Abuse
Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse
Brute-Force Bad Web Bot Web App Attack
Anonymous
Failed login attempt detected by Fail2Ban in plesk-modsecurity jail
Exploited Host
🇳🇱 Mangelot Hosting
(upload_shell) srv101 Shell upload 52.254.84.112 (US/United States/-): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs:
Web App Attack
🇫🇮 Shaik Sai Meera
IM360 WAF: Infectors: Suspicious access attempt (webshell)
FTP Brute-Force Open Proxy Brute-Force
🇺🇸 TPI-Abuse
Brute-Force Bad Web Bot Web App Attack
🇧🇾 lns.bz
Too many 404 requests [BY]
Web App Attack

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown

Recently Reported IPs:

🇨🇳 139.226.161.98
🇨🇦 138.197.175.109
🇺🇸 50.196.228.76
🇸🇬 194.5.82.141
🇧🇷 187.63.23.20
🇺🇸 45.135.1.145
🇺🇸 3.131.24.55
🇺🇸 162.158.175.99
🇳🇱 130.12.180.168
🇨🇳 120.36.16.96
🇧🇷 45.236.98.111
🇳🇱 45.144.212.158
🇲🇦 41.250.200.222
🇲🇽 38.35.231.68
🇧🇾 37.212.91.219
🇬🇧 35.203.211.96
🇪🇹 196.189.236.67
🇮🇶 65.20.142.193
🇺🇸 64.207.225.55
🇹🇼 60.249.251.88
feedback