AbuseIPDB » 52.28.16.197
52.28.16.197 was found in our database!
This IP was reported 260 times. Confidence of Abuse is 100%: ?
| ISP | A100 ROW GmbH |
|---|---|
| Usage Type | Data Center/Web Hosting/Transit |
| ASN | AS16509 |
| Hostname(s) |
ec2-52-28-16-197.eu-central-1.compute.amazonaws.com |
| Domain Name | amazon.com |
| Country | 🇩🇪 Germany |
| City | Frankfurt am Main, Hesse |
IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.
IP Abuse Reports for 52.28.16.197:
This IP address has been reported a total of 260 times from 165 distinct sources. 52.28.16.197 was first reported on , and the most recent report was .
Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.
| Reporter | IoA Timestamp (UTC) | Comment | Categories | |
|---|---|---|---|---|
| 🇬🇧 openstrike.co.uk |
39 attacks on env grabbing URLs:
GET /.env HTTP/1.1
|
Hacking | ||
| 🇷🇺 DZBOT |
DZBOT: Website Scanning / Scraping
|
Bad Web Bot Exploited Host Web App Attack | ||
| 🇬🇧 Axel |
|
Web App Attack Hacking SQL Injection | ||
| 🇬🇧 thetomtaylor.co.uk |
Fail2Ban - [WEB]Custom exploit pattern detected on customexploits ... [ice01,ice02,wa01]
|
Hacking Brute-Force Bad Web Bot Web App Attack | ||
| 🇸🇬 serverutama |
|
Web App Attack Bad Web Bot | ||
| 🇺🇸 almazick |
Fail2Ban jail window on srv1.windowrepair.us banned 52.28.16.197 after 1 attempts
|
Bad Web Bot Web App Attack | ||
| 🇫🇷 alpha |
Automated honeypot: scanner probed decoy URL on cdn.aldorand.fr (honeypot decoy)
|
Bad Web Bot Web App Attack | ||
| 🇺🇸 conrad10781 |
nginx-dot-env
|
Web App Attack | ||
| 🇺🇸 mnsf |
Abuse Detected (1)
|
Brute-Force Web App Attack | ||
| 🇬🇧 thetomtaylor.co.uk |
Fail2Ban - [WEB]Custom exploit pattern detected on customexploits ... [wa02]
|
Hacking Brute-Force Bad Web Bot Web App Attack | ||
| 🇬🇧 andypiper |
CrowdSec ban for AbuseIPDB Top List
|
Brute-Force Web App Attack | ||
| 🇫🇮 Christopher Hughes |
.env scan
|
Web App Attack | ||
| 🇮🇪 Jim Keir |
2026-06-03 00:33:12 52.28.16.197 File scanning, blocking 52.28.16.197 for 5 minutes
|
Web App Attack | ||
| 🇬🇧 Mendip_Defender |
|
Brute-Force | ||
| 🇬🇧 seniorlinuxadmin |
52.28.16.197 - - [03/Jun/2026:01:23:50 +0100] "GET /.env HTTP/1.1" 403 158 "-" "Python-urllib/3.13"
|
Port Scan Web App Attack |
Showing 1 to 15 of 260 reports
Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩