AbuseIPDB » 52.47.85.230

52.47.85.230 was found in our database!

This IP was reported 21 times. Confidence of Abuse is 100%: ?

100%

ISP	Amazon Data Services France
Usage Type	Content Delivery Network
ASN	AS16509
Hostname(s)	ec2-52-47-85-230.eu-west-3.compute.amazonaws.com
Domain Name	amazon.com
Country	France
City	Paris, Ile-de-France

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated biweekly.

Report 52.47.85.230

Whois 52.47.85.230

IP Abuse Reports for 52.47.85.230:

This IP address has been reported a total of 21 times from 21 distinct sources. 52.47.85.230 was first reported on April 14th 2025, and the most recent report was 2 days ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp in UTC	Comment	Categories
silisoftware.com	2025-04-16 05:55:11 (2 days ago)	/wp	Web App Attack
octageeks.com	2025-04-16 04:14:36 (2 days ago)	Wordpress malicious attack:[octablocked]	Web App Attack
advena	2025-04-16 03:15:57 (2 days ago)	52.47.85.230 (AS16509 AMAZON-02) was intercepted at 2025-04-16T03:12:51Z after violating WAF directi ... show more52.47.85.230 (AS16509 AMAZON-02) was intercepted at 2025-04-16T03:12:51Z after violating WAF directive: bot_fight_mode. Pre-cautionary/corrective action applied: managed_challenge. show less	Web Spam Hacking Brute-Force Web App Attack
Gabriel Camargo	2025-04-16 03:09:33 (2 days ago)	52.47.85.230 - - [15/Apr/2025:22:09:24 -0500] "GET / HTTP/1.1" 301 178 "www.google.com" "Mozilla/5.0 ... show more52.47.85.230 - - [15/Apr/2025:22:09:24 -0500] "GET / HTTP/1.1" 301 178 "www.google.com" "Mozilla/5.0 (Linux; Android 7.0; SM-G892A Build/NRD90M; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/60.0.3112.107 Mobile Safari/537.36" 52.47.85.230 - - [15/Apr/2025:22:09:30 -0500] "GET /wp HTTP/1.1" 301 178 "www.google.com" "Mozilla/5.0 (Linux; Android 7.0; SM-G892A Build/NRD90M; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/60.0.3112.107 Mobile Safari/537.36" 52.47.85.230 - - [15/Apr/2025:22:09:32 -0500] "GET /wordpress HTTP/1.1" 301 178 "www.google.com" "Mozilla/5.0 (Linux; Android 7.0; SM-G892A Build/NRD90M; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/60.0.3112.107 Mobile Safari/537.36" ... show less	Brute-Force SSH
MAGIC	2025-04-16 02:05:55 (2 days ago)	VM1 Bad user agents ignoring web crawling rules. Draing bandwidth	DDoS Attack Bad Web Bot
polycoda	2025-04-15 23:03:54 (2 days ago)	📂 Probes for tons of inexistent directory listings	Hacking Web App Attack
Tripwire	2025-04-15 22:45:21 (2 days ago)	Fake referrer "www.google.com"	Bad Web Bot
charmicat	2025-04-15 20:12:22 (2 days ago)	AUTOMATED REPORT - suspicious request from 52.47.85.230: [Tue, 15 Apr 2025 20:12:22 +0000] GET /wp H ... show moreAUTOMATED REPORT - suspicious request from 52.47.85.230: [Tue, 15 Apr 2025 20:12:22 +0000] GET /wp HTTP/1.1 Mozilla/5.0 (Linux; Android 7.0; SM-G892A Build/NRD90M; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/60.0.3112.107 Mobile Safari/537.36 show less	Web App Attack
Carltonfsck	2025-04-15 19:11:26 (2 days ago)	52.47.85.230 - - [15/Apr/2025:19:11:24 +0000] "GET /support/wp HTTP/1.1" 404 49 52.47.85.230 - ... show more52.47.85.230 - - [15/Apr/2025:19:11:24 +0000] "GET /support/wp HTTP/1.1" 404 49 52.47.85.230 - - [15/Apr/2025:19:11:25 +0000] "GET /support/wordpress HTTP/1.1" 404 49 ... show less	Hacking Web App Attack
strefapi_com	2025-04-15 18:17:51 (3 days ago)	Brute-force, web ...	Hacking Brute-Force Web App Attack
COMAITE	2025-04-15 15:00:10 (3 days ago)	Multiple web server 400 error codes from same source ip 52.47.85.230.	Web App Attack
sverson	2025-04-15 13:40:01 (3 days ago)	Abusive use detected / Mutliple unauthorized attempts to access web resources	Hacking Web App Attack
iNetWorker	2025-04-15 12:55:31 (3 days ago)	trolling for resource vulnerabilities	Web App Attack
Thaliruth	2025-04-15 12:47:39 (3 days ago)	52.47.85.230 - - [15/Apr/2025:14:47:38 +0200] "GET /wp HTTP/1.1" 301 162 "www.google.com" "Mozilla/5 ... show more52.47.85.230 - - [15/Apr/2025:14:47:38 +0200] "GET /wp HTTP/1.1" 301 162 "www.google.com" "Mozilla/5.0 (Linux; Android 7.0; SM-G892A Build/NRD90M; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/60.0.3112.107 Mobile Safari/537.36" hdro-mail.de:443 52.47.85.230 - - [15/Apr/2025:14:47:38 +0200] "GET /wp HTTP/1.0" 404 957 "www.google.com" "Mozilla/5.0 (Linux; Android 7.0; SM-G892A Build/NRD90M; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/60.0.3112.107 Mobile Safari/537.36" 52.47.85.230 - - [15/Apr/2025:14:47:38 +0200] "GET /wp HTTP/1.0" 404 957 "www.google.com" "Mozilla/5.0 (Linux; Android 7.0; SM-G892A Build/NRD90M; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/60.0.3112.107 Mobile Safari/537.36" ... show less	Brute-Force Web App Attack
4server	2025-04-15 05:37:15 (3 days ago)	[TueApr1507:37:10.7322332025][security2:error][pid2609439:tid2609523][client52.47.85.230:0][client52 ... show more[TueApr1507:37:10.7322332025][security2:error][pid2609439:tid2609523][client52.47.85.230:0][client52.47.85.230]ModSecurity:Accessdeniedwithconnectionclose\(phase1\).OperatorEQmatched0atIP.[file\"/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-912-DOS-PROTECTION.conf\"][line\"120\"][id\"912120\"][msg\"DenialofService\(DoS\)attackidentifiedfrom52.47.85.230\(1hitssincelastalert\)\"][ver\"OWASP_CRS/3.3.7\"][tag\"application-multi\"][tag\"language-multi\"][tag\"platform-multi\"][tag\"paranoia-level/1\"][tag\"attack-dos\"][tag\"OWASP_CRS\"][tag\"capec/1000/210/227/469\"][hostname\"hercules.li\"][uri\"/backup\"][unique_id\"Z_3whjfTGCyRnvgclKcNcAAAAEI\"]\,referer:www.google.com show less	Port Scan Brute-Force Web App Attack

Is this your IP? You may request to takedown any associated reports. We will attempt to verify your ownership. Request Takedown 🚩