JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

52.254.84.121

Neutral Activity

Abuse Confidence Score

0% Low Risk

40 reports

25 reporters · latest 10 months ago

ISP: Microsoft Corporation
Usage Type: Data Center/Web Hosting/Transit
ASN: AS8075
Domain Name: microsoft.com
Country: 🇺🇸 United States of America
City: Boydton, Virginia

ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report Whois

No reports in the last 60 days

52.254.84.121 has been reported 40 times. The most recent report is from 10 months ago.

The full history is preserved below and remains searchable. A 0% score reflects the absence of recent activity, but this is not a guarantee that earlier reports were invalid. Abuse confidence score decays, naturally, over time, when the abusive activity stops.

Abuse Reports

Export reports CSV

Total reports

40 from 25 distinct reporters

First reported

November 25th 2025

Most recent report

10 months ago

Reporter	IoA Timestamp (UTC)	Comment	Categories
Anonymous	2025-12-15 08:28:15 UTC · (10 months ago)	Blocked: Reason='Auto-block via DW'; Requests=0	Hacking
🇺🇸 TPI-Abuse	2025-11-27 02:45:54 UTC · (11 months ago)	(mod_security) mod_security (id:210492) triggered by 52.254.84.121 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 26 21:45:50.672653 2025] [security2:error] [pid 17799:tid 17799] [client 52.254.84.121:2768] Mo ... show more (mod_security) mod_security (id:210492) triggered by 52.254.84.121 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 26 21:45:50.672653 2025] [security2:error] [pid 17799:tid 17799] [client 52.254.84.121:2768] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpcontacts.colbygrenier.com"] [uri "/user/.env"] [unique_id "aSe7XviJ6SrUbhkRvgV7wQAAABI"], referer: https://www.google.com/ show less	Brute-Force Bad Web Bot Web App Attack
🇬🇧 [email protected]	2025-11-27 00:53:14 UTC · (11 months ago)	...	Brute-Force SSH
🇺🇸 TPI-Abuse	2025-11-27 00:46:15 UTC · (11 months ago)	(mod_security) mod_security (id:210492) triggered by 52.254.84.121 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 26 19:46:12.463047 2025] [security2:error] [pid 21353:tid 21353] [client 52.254.84.121:1642] Mo ... show more (mod_security) mod_security (id:210492) triggered by 52.254.84.121 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 26 19:46:12.463047 2025] [security2:error] [pid 21353:tid 21353] [client 52.254.84.121:1642] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpcalendars.gictd.com"] [uri "/user/.env"] [unique_id "aSefVF7znx5Dhg_JtEmVMQAAAAY"], referer: https://www.google.com/ show less	Brute-Force Bad Web Bot Web App Attack
🇩🇪 Vegascosmetics	2025-11-26 22:51:48 UTC · (11 months ago)	Kingcopy(AI-IDS):IP is Probing for Wordpress vulnerabilities WTF:Banned	Hacking Bad Web Bot Web App Attack
🇫🇷 COMAITE	2025-11-26 22:09:05 UTC · (11 months ago)	Multiple web server 400 error codes from same source ip 52.254.84.121.	Web App Attack
🇺🇸 TPI-Abuse	2025-11-26 21:11:28 UTC · (11 months ago)	(mod_security) mod_security (id:210492) triggered by 52.254.84.121 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 26 16:11:25.326808 2025] [security2:error] [pid 5423:tid 5423] [client 52.254.84.121:9163] ModS ... show more (mod_security) mod_security (id:210492) triggered by 52.254.84.121 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 26 16:11:25.326808 2025] [security2:error] [pid 5423:tid 5423] [client 52.254.84.121:9163] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "celebrationofdiana.com"] [uri "/user/.env"] [unique_id "aSds_SIr5AJsVyUgDSC20gAAAAQ"], referer: https://www.google.co.uk/ show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2025-11-26 20:40:30 UTC · (11 months ago)	(mod_security) mod_security (id:210492) triggered by 52.254.84.121 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 26 15:40:23.865643 2025] [security2:error] [pid 18305:tid 18305] [client 52.254.84.121:3438] Mo ... show more (mod_security) mod_security (id:210492) triggered by 52.254.84.121 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 26 15:40:23.865643 2025] [security2:error] [pid 18305:tid 18305] [client 52.254.84.121:3438] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "tsaifd.org"] [uri "/user/.env"] [unique_id "aSdlt6NiWuCsTp41flR_6gAAABA"], referer: https://www.google.com/ show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2025-11-26 19:08:30 UTC · (11 months ago)	(mod_security) mod_security (id:210492) triggered by 52.254.84.121 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 26 14:08:23.450602 2025] [security2:error] [pid 18913:tid 18913] [client 52.254.84.121:9644] Mo ... show more (mod_security) mod_security (id:210492) triggered by 52.254.84.121 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 26 14:08:23.450602 2025] [security2:error] [pid 18913:tid 18913] [client 52.254.84.121:9644] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "railsolutions.mx"] [uri "/user/.env"] [unique_id "aSdQJ9YdD94Ds8zbAQzr3QAAAAc"], referer: https://duckduckgo.com/ show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2025-11-26 18:19:12 UTC · (11 months ago)	(mod_security) mod_security (id:210492) triggered by 52.254.84.121 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 26 13:19:06.565286 2025] [security2:error] [pid 8070:tid 8070] [client 52.254.84.121:5282] ModS ... show more (mod_security) mod_security (id:210492) triggered by 52.254.84.121 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 26 13:19:06.565286 2025] [security2:error] [pid 8070:tid 8070] [client 52.254.84.121:5282] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpanel.pazzidipizza.com"] [uri "/user/.env"] [unique_id "aSdEmoVBn0Xy49I7KoN5QgAAAAs"], referer: https://www.yahoo.com/ show less	Brute-Force Bad Web Bot Web App Attack
🇪🇸 robotstxt	2025-11-26 17:53:13 UTC · (11 months ago)	52.254.84.121 - - [26/Nov/2025:17:52:09 +0000] "GET /cgi-bin/ HTTP/1.1" 404 27393 "https://www.google.fr/" rt="0.330" "Mozilla/5.0 (iPhone; CPU iPhone OS 17_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/119.0.6045.109 Mobile/15E148 ... show more 52.254.84.121 - - [26/Nov/2025:17:52:09 +0000] "GET /cgi-bin/ HTTP/1.1" 404 27393 "https://www.google.fr/" rt="0.330" "Mozilla/5.0 (iPhone; CPU iPhone OS 17_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/119.0.6045.109 Mobile/15E148 Safari/604.1" "109.202.168.37" h="www.serenitas.es" sn="www.serenitas.es" ru="/cgi-bin/" u="/index.php" ucs="-" ua="unix:/var/run/php/serenitas82.sock" us="404" uct="0.000" urt="0.330" 52.254.84.121 - - [26/Nov/2025:17:52:11 +0000] "GET /cgi-bin/bypass.php HTTP/1.1" 404 27393 "https://www.bing.com/" rt="0.123" "Mozilla/5.0 (Linux; Android 12; SM-A525F) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Mobile Safari/537.36" "217.213.153.31" h="www.serenitas.es" sn="www.serenitas.es" ru="/cgi-bin/bypass.php" u="/index.php" ucs="-" ua="unix:/var/run/php/serenitas82.sock" us="404" uct="0.000" urt="0.123" 52.254.84.121 - - [26/Nov/2025:17:52:09 +0000] "GET /cgi-bin/ HTTP/1.1" 404 27393 "https://www.google.fr/" "Mozilla/5.0 (iPhone; CPU iPh ... show less	Bad Web Bot
🇩🇪 R.G.	2025-11-26 17:32:46 UTC · (11 months ago)	(ScanningForFiles) Scanning for files triggerd 52.254.84.121 (US/United States/-): 10 in the last 900 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs:	Web App Attack
🇺🇸 Rbot	2025-11-26 16:52:00 UTC · (11 months ago)	more than 20 404 requests for the file /upload/image/	Web App Attack
🇪🇸 robotstxt	2025-11-26 16:23:54 UTC · (11 months ago)	52.254.84.121 - - [26/Nov/2025:16:22:54 +0000] "GET /cgi-bin/ HTTP/1.1" 404 27825 "https://www.google.com/" rt="0.249" "Mozilla/5.0 (iPhone; CPU iPhone OS 16_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) FxiOS/118.0 Mobile/15E148 Safari/6 ... show more 52.254.84.121 - - [26/Nov/2025:16:22:54 +0000] "GET /cgi-bin/ HTTP/1.1" 404 27825 "https://www.google.com/" rt="0.249" "Mozilla/5.0 (iPhone; CPU iPhone OS 16_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) FxiOS/118.0 Mobile/15E148 Safari/605.1.15" "56.209.117.221" h="www.rfc8.com" sn="www.rfc8.com" ru="/cgi-bin/" u="/index.php" ucs="-" ua="unix:/var/run/php/rfc882.sock" us="404" uct="0.000" urt="0.249" 52.254.84.121 - - [26/Nov/2025:16:22:54 +0000] "GET /cgi-bin/bypass.php HTTP/1.1" 404 27825 "https://duckduckgo.com/" rt="0.072" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Mobile Safari/537.36" "0.235.13.80" h="www.rfc8.com" sn="www.rfc8.com" ru="/cgi-bin/bypass.php" u="/index.php" ucs="-" ua="unix:/var/run/php/rfc882.sock" us="404" uct="0.000" urt="0.072" 52.254.84.121 - - [26/Nov/2025:16:23:10 +0000] "GET /cgi-bin/xmrlpc.php HTTP/1.1" 404 27825 "https://duckduckgo.com/" rt="2.484" "Mozilla/5.0 (iPhone; CPU iPhone OS 16_0 like ... show less	Bad Web Bot
🇺🇸 TPI-Abuse	2025-11-26 16:19:28 UTC · (11 months ago)	(mod_security) mod_security (id:210492) triggered by 52.254.84.121 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 26 11:19:24.938891 2025] [security2:error] [pid 28181:tid 28181] [client 52.254.84.121:2838] Mo ... show more (mod_security) mod_security (id:210492) triggered by 52.254.84.121 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 26 11:19:24.938891 2025] [security2:error] [pid 28181:tid 28181] [client 52.254.84.121:2838] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "autodiscover.abecasis.com"] [uri "/user/.env"] [unique_id "aScojMoLv-x8YFp0McJD1AAAABo"], referer: https://www.bing.com/ show less	Brute-Force Bad Web Bot Web App Attack

Showing 1 to 15 of 40 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown

Recently Reported IPs:

🇺🇸 154.51.242.28

🇧🇷 124.198.135.160

🇺🇸 66.132.186.246

🇨🇳 221.228.203.3

🇧🇷 186.209.77.236

🇧🇷 179.221.200.133

🇭🇰 103.210.239.194

🇳🇱 45.148.10.157

🇮🇶 37.236.132.25

🇧🇪 34.38.19.77

🇻🇳 180.93.1.126

🇳🇱 176.65.149.224

🇩🇪 151.243.11.175

🇺🇸 147.185.132.21

🇨🇮 102.142.248.59

🇺🇦 95.47.110.159

🇧🇬 78.128.113.74

🇻🇪 45.186.211.38

🇻🇳 123.31.31.125

🇧🇬 91.92.199.36