JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

52.254.87.3

Neutral Activity

Abuse Confidence Score

0% Low Risk

45 reports

28 reporters · latest 11 months ago

ISP: Microsoft Corporation
Usage Type: Data Center/Web Hosting/Transit
ASN: AS8075
Domain Name: microsoft.com
Country: 🇺🇸 United States of America
City: Boydton, Virginia

ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report Whois

No reports in the last 60 days

52.254.87.3 has been reported 45 times. The most recent report is from 11 months ago.

The full history is preserved below and remains searchable. A 0% score reflects the absence of recent activity, but this is not a guarantee that earlier reports were invalid. Abuse confidence score decays, naturally, over time, when the abusive activity stops.

Abuse Reports

Export reports CSV

Total reports

45 from 28 distinct reporters

First reported

November 25th 2025

Most recent report

11 months ago

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇺🇸 Mainpine	2025-11-27 01:38:04 UTC · (11 months ago)	probing for vulnerable web apps	Web App Attack
Anonymous	2025-11-27 01:10:21 UTC · (11 months ago)	Multiple, malicious web requests detected	Port Scan Hacking
🇬🇧 [email protected]	2025-11-27 00:53:15 UTC · (11 months ago)	...	Brute-Force SSH
🇳🇱 Site.eu	2025-11-27 00:45:21 UTC · (11 months ago)	Excessive multi-domain requests	Brute-Force
Anonymous	2025-11-27 00:24:47 UTC · (11 months ago)	52.254.87.3 - - [27/Nov/2025:01:24:47 +0100] "GET /cgi-bin/ HTTP/1.1" 403 3940 ...	Web App Attack
🇺🇸 TPI-Abuse	2025-11-26 23:53:49 UTC · (11 months ago)	(mod_security) mod_security (id:210492) triggered by 52.254.87.3 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 26 18:53:46.208191 2025] [security2:error] [pid 8843:tid 8843] [client 52.254.87.3:9597] ModSecur ... show more (mod_security) mod_security (id:210492) triggered by 52.254.87.3 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 26 18:53:46.208191 2025] [security2:error] [pid 8843:tid 8843] [client 52.254.87.3:9597] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "webdisk.microbikinitop.com"] [uri "/user/.env"] [unique_id "aSeTCv6IN8qf3vM9I2EpZQAAAAk"], referer: https://www.yahoo.com/ show less	Brute-Force Bad Web Bot Web App Attack
🇳🇱 homeshowdomain.nl	2025-11-26 23:05:46 UTC · (11 months ago)	Auto-ban: 40 malicious requests on 2025-11-25 (e.g., env/backup probes, brute-force, or error bursts).	Hacking Web App Attack SSH
🇫🇷 tecnicorioja	2025-11-26 23:02:03 UTC · (11 months ago)	wp-login attack [26/Nov/2025:19:56:58	Brute-Force Web App Attack
Anonymous	2025-11-26 22:00:42 UTC · (11 months ago)	Malicious activity detected	DDoS Attack Bad Web Bot Web App Attack
🇵🇱 strefapi_com	2025-11-26 20:26:21 UTC · (11 months ago)	Brute-force, web ...	Hacking Brute-Force Web App Attack
🇺🇦 URAN Publishing Service	2025-11-26 18:20:01 UTC · (11 months ago)	52.254.87.3 - - [26/Nov/2025:20:20:00 +0200] "GET /cgi-bin/ HTTP/1.1" 404 438 "https://www.google.co.uk/" "Mozilla/5.0 (iPhone; CPU iPhone OS 15_7_9 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/15.6.5 Mobile/15E148 Safari/604.1" 52 ... show more 52.254.87.3 - - [26/Nov/2025:20:20:00 +0200] "GET /cgi-bin/ HTTP/1.1" 404 438 "https://www.google.co.uk/" "Mozilla/5.0 (iPhone; CPU iPhone OS 15_7_9 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/15.6.5 Mobile/15E148 Safari/604.1" 52.254.87.3 - - [26/Nov/2025:20:20:00 +0200] "GET /cgi-bin/bypass.php HTTP/1.1" 404 438 "https://www.google.fr/" "Mozilla/5.0 (iPhone; CPU iPhone OS 17_0_3 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.0.1 Mobile/15E148 Safari/604.1" ... show less	Web App Attack
🇺🇸 TPI-Abuse	2025-11-26 17:50:52 UTC · (11 months ago)	(mod_security) mod_security (id:210492) triggered by 52.254.87.3 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 26 12:50:46.466949 2025] [security2:error] [pid 31374:tid 31374] [client 52.254.87.3:1195] ModSec ... show more (mod_security) mod_security (id:210492) triggered by 52.254.87.3 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 26 12:50:46.466949 2025] [security2:error] [pid 31374:tid 31374] [client 52.254.87.3:1195] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "solcargomiami.com"] [uri "/user/.env"] [unique_id "aSc99hzO_IexaltDRlBuDQAAAA0"], referer: https://www.google.fr/ show less	Brute-Force Bad Web Bot Web App Attack
Anonymous	2025-11-26 17:22:32 UTC · (11 months ago)	Bot / scanning and/or hacking attempts: GET /index/function.php HTTP/1.1, GET /index.bak.php HTTP/1.1, GET /ini.php HTTP/1.1, GET /infos.php HTTP/1.1, GET /wp-login.php?redirect_to=https%3A%2F%2Fvannes.nl%2Fwp-admi	Hacking Web App Attack
🇺🇸 TPI-Abuse	2025-11-26 17:22:08 UTC · (11 months ago)	(mod_security) mod_security (id:210492) triggered by 52.254.87.3 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 26 12:22:05.071757 2025] [security2:error] [pid 23649:tid 23649] [client 52.254.87.3:5267] ModSec ... show more (mod_security) mod_security (id:210492) triggered by 52.254.87.3 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 26 12:22:05.071757 2025] [security2:error] [pid 23649:tid 23649] [client 52.254.87.3:5267] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpcontacts.sabbathseminars.net"] [uri "/user/.env"] [unique_id "aSc3Pe3gceYJKaco-5HHlQAAAB0"], referer: https://www.bing.com/ show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2025-11-26 15:46:31 UTC · (11 months ago)	(mod_security) mod_security (id:210492) triggered by 52.254.87.3 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 26 10:46:25.177329 2025] [security2:error] [pid 13483:tid 13483] [client 52.254.87.3:8869] ModSec ... show more (mod_security) mod_security (id:210492) triggered by 52.254.87.3 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 26 10:46:25.177329 2025] [security2:error] [pid 13483:tid 13483] [client 52.254.87.3:8869] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "wgs.cc"] [uri "/user/.env"] [unique_id "aScg0Qam_y41L5GE6D60YwAAAAc"], referer: https://www.yahoo.com/ show less	Brute-Force Bad Web Bot Web App Attack

Showing 1 to 15 of 45 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown

Recently Reported IPs:

🇯🇵 103.29.50.240

🇮🇶 65.20.184.80

🇺🇸 45.156.129.180

🇧🇷 189.38.24.199

🇮🇳 140.238.243.61

🇮🇳 117.236.124.166

🇧🇩 103.92.152.157

🇧🇷 45.229.91.2

🇳🇱 45.148.10.157

🇯🇵 43.167.198.92

🇺🇸 2a10:4a00:ff57:9ee0:bec6:7d40:670:7197

🇷🇺 109.184.111.209

🇿🇲 102.23.122.235

🇺🇦 80.93.116.174

🇺🇸 66.249.80.102

🇮🇳 49.207.182.187

🇺🇸 34.186.15.32

🇺🇸 162.216.149.33

🇻🇳 160.250.133.76

🇺🇸 160.79.106.143