JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

52.254.84.124

Neutral Activity

Abuse Confidence Score

0% Low Risk

37 reports

29 reporters · latest 10 months ago

ISP: Microsoft Corporation
Usage Type: Data Center/Web Hosting/Transit
ASN: AS8075
Domain Name: microsoft.com
Country: 🇺🇸 United States of America
City: Boydton, Virginia

ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report Whois

No reports in the last 60 days

52.254.84.124 has been reported 37 times. The most recent report is from 10 months ago.

The full history is preserved below and remains searchable. A 0% score reflects the absence of recent activity, but this is not a guarantee that earlier reports were invalid. Abuse confidence score decays, naturally, over time, when the abusive activity stops.

Abuse Reports

Export reports CSV

Total reports

37 from 29 distinct reporters

First reported

November 25th 2025

Most recent report

10 months ago

Reporter	IoA Timestamp (UTC)	Comment	Categories
Anonymous	2025-12-15 08:28:16 UTC · (10 months ago)	Blocked: Reason='Auto-block via DW'; Requests=0	Hacking
🇬🇧 [email protected]	2025-11-28 00:53:07 UTC · (11 months ago)	...	Brute-Force SSH
🇩🇪 Vegascosmetics	2025-11-27 22:50:27 UTC · (11 months ago)	Kingcopy(AI-IDS):IP is Probing for Wordpress vulnerabilities WTF:Banned	Hacking Bad Web Bot Web App Attack
🇬🇧 openstrike.co.uk	2025-11-27 06:14:05 UTC · (11 months ago)	1 attack on Alfa URLs: GET /wp-includes/ALFA_DATA/alfacgiapi/perl.alfa HTTP/1.1	Hacking
🇨🇳 ThreatBook.io	2025-11-27 03:49:43 UTC · (11 months ago)	ThreatBook Intelligence: Zombie,Spam more details on https://threatbook.io/ip/52.254.84.124 2025-11-26 08:51:56 /radio.php 2025-11-26 08:51:55 /cgi-bin/ 2025-11-26 08:51:57 /1index.php 2025-11-26 08:51:55 /cgi-bin/bypass.php 2025-11-26 08:51:56 /inde ... show more ThreatBook Intelligence: Zombie,Spam more details on https://threatbook.io/ip/52.254.84.124 2025-11-26 08:51:56 /radio.php 2025-11-26 08:51:55 /cgi-bin/ 2025-11-26 08:51:57 /1index.php 2025-11-26 08:51:55 /cgi-bin/bypass.php 2025-11-26 08:51:56 /index1.php 2025-11-26 08:51:56 /xmlrpc.php 2025-11-26 08:51:56 /wp-content/ 2025-11-26 08:51:55 /filemanager/dialog.php 2025-11-26 08:51:55 /wp-admin/css/ show less	Web App Attack
🇺🇦 URAN Publishing Service	2025-11-27 02:11:53 UTC · (11 months ago)	52.254.84.124 - - [27/Nov/2025:04:11:52 +0200] "GET /cgi-bin/ HTTP/1.1" 404 438 "https://duckduckgo.com/" "Mozilla/5.0 (Linux; Android 12; SM-A525F) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Mobile Safari/537.36" 52.254.84.124 - - [27/N ... show more 52.254.84.124 - - [27/Nov/2025:04:11:52 +0200] "GET /cgi-bin/ HTTP/1.1" 404 438 "https://duckduckgo.com/" "Mozilla/5.0 (Linux; Android 12; SM-A525F) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Mobile Safari/537.36" 52.254.84.124 - - [27/Nov/2025:04:11:52 +0200] "GET /cgi-bin/bypass.php HTTP/1.1" 404 438 "https://www.bing.com/" "Mozilla/5.0 (iPhone; CPU iPhone OS 17_0_3 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.0.1 Mobile/15E148 Safari/604.1" ... show less	Web App Attack
🇲🇾 Rizzy	2025-11-27 01:17:46 UTC · (11 months ago)	Multiple WAF Violations	Brute-Force Web App Attack
🇺🇸 TPI-Abuse	2025-11-27 01:03:16 UTC · (11 months ago)	(mod_security) mod_security (id:210492) triggered by 52.254.84.124 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 26 20:03:12.155449 2025] [security2:error] [pid 9005:tid 9005] [client 52.254.84.124:13050] Mod ... show more (mod_security) mod_security (id:210492) triggered by 52.254.84.124 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 26 20:03:12.155449 2025] [security2:error] [pid 9005:tid 9005] [client 52.254.84.124:13050] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "goldenfrytech.net"] [uri "/user/.env"] [unique_id "aSejUJ-b288E0qa2jA1-9AAAAAk"], referer: https://www.google.de/ show less	Brute-Force Bad Web Bot Web App Attack
🇬🇧 NotCool	2025-11-26 21:58:40 UTC · (11 months ago)	[7200] (XMLRPC,ADMINPROBE) Login failure/trigger from 52.254.84.124 (US/United States/-): 10 in the last 3600 secs	Brute-Force
🇨🇭 zynex	2025-11-26 19:08:17 UTC · (11 months ago)	URL Probing: /.well-known/acme-challenge/xa.php	Web App Attack
🇺🇸 ambor	2025-11-26 18:41:51 UTC · (11 months ago)	Attack type: wordpress_attack_attempt \| Target: /cgi-bin/ \| UA: Mozilla/5.0 (Linux; Android 13; SM-G991U) AppleWeb \| Country: US	Brute-Force Web App Attack
🇺🇸 TPI-Abuse	2025-11-26 18:21:56 UTC · (11 months ago)	(mod_security) mod_security (id:210492) triggered by 52.254.84.124 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 26 13:21:51.922408 2025] [security2:error] [pid 17438:tid 17438] [client 52.254.84.124:0] ModSe ... show more (mod_security) mod_security (id:210492) triggered by 52.254.84.124 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 26 13:21:51.922408 2025] [security2:error] [pid 17438:tid 17438] [client 52.254.84.124:0] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "upskirtcrazy.com"] [uri "/user/.env"] [unique_id "aSdFP-Omlrwn-8WcQLA4rwAAAA8"], referer: https://www.google.com/ show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2025-11-26 17:53:49 UTC · (11 months ago)	(mod_security) mod_security (id:210492) triggered by 52.254.84.124 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 26 12:53:43.044689 2025] [security2:error] [pid 20138:tid 20138] [client 52.254.84.124:8828] Mo ... show more (mod_security) mod_security (id:210492) triggered by 52.254.84.124 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 26 12:53:43.044689 2025] [security2:error] [pid 20138:tid 20138] [client 52.254.84.124:8828] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "mayflowersgifts.com"] [uri "/user/.env"] [unique_id "aSc-p1B5quqPpyXCYUbFbQAAAAw"], referer: https://duckduckgo.com/ show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2025-11-26 16:05:46 UTC · (11 months ago)	(mod_security) mod_security (id:210492) triggered by 52.254.84.124 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 26 11:05:42.339679 2025] [security2:error] [pid 15972:tid 15972] [client 52.254.84.124:7972] Mo ... show more (mod_security) mod_security (id:210492) triggered by 52.254.84.124 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 26 11:05:42.339679 2025] [security2:error] [pid 15972:tid 15972] [client 52.254.84.124:7972] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "webmail.digitaldatatechnologies.net"] [uri "/user/.env"] [unique_id "aSclVs99C9hbqDTR-9tNDAAAAAE"], referer: https://www.google.co.uk/ show less	Brute-Force Bad Web Bot Web App Attack
🇬🇧 Globe2	2025-11-26 12:53:45 UTC · (11 months ago)	ModSec - Multiple 403s within a short period of time [server: H3]	Web App Attack

Showing 1 to 15 of 37 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown

Recently Reported IPs:

🇫🇷 213.32.24.214

🇮🇹 50.118.132.98

🇳🇱 45.129.234.104

🇬🇧 35.203.211.59

🇩🇪 194.187.176.197

🇵🇱 194.113.248.175

🇬🇧 193.176.29.26

🇦🇷 149.104.92.245

🇫🇮 130.49.76.109

🇮🇳 117.253.130.123

🇮🇩 103.247.13.54

🇫🇷 85.217.140.39

🇨🇦 45.198.224.94

🇺🇸 34.143.65.12

🇨🇭 20.203.184.59

🇻🇳 210.245.30.140

🇵🇱 194.113.248.168

🇬🇧 193.32.209.242

🇭🇰 150.5.132.241

🇻🇳 113.163.50.116