JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 52.66.113.242

52.66.113.242 was found in our database!

This IP was reported 22 times. Confidence of Abuse is 0%: ?

ISP	Amazon Data Services India
Usage Type	Data Center/Web Hosting/Transit
ASN	AS16509
Hostname(s)	ec2-52-66-113-242.ap-south-1.compute.amazonaws.com
Domain Name	amazon.com
Country	🇮🇳 India
City	Mumbai, Maharashtra

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 52.66.113.242

Whois 52.66.113.242

IP Abuse Reports for 52.66.113.242:

This IP address has been reported a total of 22 times from 18 distinct sources. 52.66.113.242 was first reported on December 18th 2020, and the most recent report was 4 years ago.

Old Reports: The most recent abuse report for this IP address is from 4 years ago . It is possible that this IP is no longer involved in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇺🇸 joschuak	2022-06-29 01:50:18 (4 years ago)	SSH brute force attack detected from [52.66.113.242]	Brute-Force SSH
🇩🇪 roki.ovh	2022-06-29 00:15:37 (4 years ago)	Jun 29 06:48:54 solidvpn sshd\[28559\]: pam_unix$sshd:auth$: authentication failure\; logname= uid ... show more Jun 29 06:48:54 solidvpn sshd\[28559\]: pam_unix$sshd:auth$: authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=52.66.113.242 user=root Jun 29 06:48:56 solidvpn sshd\[28559\]: Failed password for root from 52.66.113.242 port 49712 ssh2 Jun 29 07:07:47 solidvpn sshd\[28716\]: pam_unix$sshd:auth$: authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=52.66.113.242 user=root Jun 29 07:07:49 solidvpn sshd\[28716\]: Failed password for root from 52.66.113.242 port 49916 ssh2 Jun 29 07:15:37 solidvpn sshd\[28787\]: pam_unix$sshd:auth$: authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=52.66.113.242 user=root ... show less	Brute-Force SSH
🇺🇸 Custard	2022-06-28 12:07:30 (4 years ago)	Jun 28 11:07:30 localhost sshd[4156444]: Connection closed by 52.66.113.242 port 43594 [preauth]	Brute-Force SSH
🇺🇸 mckinneylaw	2021-06-09 07:34:25 (5 years ago)	probing for PHP exploits	Web App Attack
🇬🇧 CrystalMaker	2021-06-09 04:51:37 (5 years ago)	Vulnerability scan - GET /.env	Hacking
🇮🇩 hermawan	2021-06-09 00:13:59 (5 years ago)	[Wed Jun 09 11:13:56.535809 2021] [:error] [pid 24932:tid 139780440450816] [client 52.66.113.242:616 ... show more [Wed Jun 09 11:13:56.535809 2021] [:error] [pid 24932:tid 139780440450816] [client 52.66.113.242:61610] [client 52.66.113.242] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/modsecurity/coreruleset-3.3.1-rc1/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "128"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.1"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "karangploso.jatim.bmkg.go.id"] [uri "/.env"] [unique_id "YMBABFQVtlUjiYOhfaVyjgAAANM"] ... show less	Hacking Web App Attack
🇺🇸 WebWizards.NZ	2021-06-08 23:45:12 (5 years ago)	Trolling for resource vulnerabilities	Web App Attack
🇮🇩 hermawan	2021-06-08 21:27:15 (5 years ago)	[Wed Jun 09 08:27:13.307407 2021] [:error] [pid 24206:tid 139642900051712] [client 52.66.113.242:562 ... show more [Wed Jun 09 08:27:13.307407 2021] [:error] [pid 24206:tid 139642900051712] [client 52.66.113.242:56204] [client 52.66.113.242] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?:^\|[\\\\/])\\\\.\\\\.(?:[\\\\/]\|$)" at ARGS:img. [file "/etc/modsecurity/coreruleset-3.3.1-rc1/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "73"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:img: ../wp-config.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.1"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "karangploso.jatim.bmkg.go.id"] [uri "/wp-admin/admin-ajax.php"] [unique_id "YMAY8dnA-B-3hnelPBYgegAAAPY"] ... show less	Hacking Web App Attack
🇬🇧 findlab	2021-06-08 17:30:02 (5 years ago)	Backdrop CMS module report: Request: /wp-content/plugins/apikey/apikey.php	Brute-Force Bad Web Bot Web App Attack
🇮🇩 hermawan	2021-06-08 17:10:43 (5 years ago)	[Wed Jun 09 04:10:40.782396 2021] [:error] [pid 7514:tid 140269253023488] [client 52.66.113.242:5051 ... show more [Wed Jun 09 04:10:40.782396 2021] [:error] [pid 7514:tid 140269253023488] [client 52.66.113.242:50519] [client 52.66.113.242] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "python-requests" at REQUEST_HEADERS:User-Agent. [file "/etc/modsecurity/coreruleset-3.3.1-rc1/rules/REQUEST-913-SCANNER-DETECTION.conf"] [line "146"] [id "913101"] [msg "Found User-Agent associated with scripting/generic HTTP client"] [data "Matched Data: python-requests found within REQUEST_HEADERS:User-Agent: python-requests/2.25.0"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.1"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-reputation-scripting"] [tag "OWASP_CRS"] [tag "capec/1000/118/224/541/310"] [tag "PCI/6.5.10"] [tag "paranoia-level/2"] [hostname "karangploso.jatim.bmkg.go.id"] [uri "/wp-content/plugins/apikey/apikey.php"] [unique_id "YL-c0OrelznbEo-rSAro9AAAANY"] ... show less	Hacking Web App Attack
🇨🇭 zynex	2021-06-08 09:28:44 (5 years ago)	URL Probing: /system/.env	Web App Attack
🇺🇸 LloydChristmas	2021-06-08 07:33:32 (5 years ago)	Probing	Port Scan Hacking Web App Attack
🇳🇿 Tripwire	2021-06-08 03:45:45 (5 years ago)	Scanning for exploits - /.env	Web App Attack
🇺🇸 HJ5Ss4Ju	2021-06-08 01:17:47 (5 years ago)	Forbidden directory scan :: 2021/06/08 05:17:46 [error] 950#950: 98031 access forbidden by rule, cl ... show more Forbidden directory scan :: 2021/06/08 05:17:46 [error] 950#950: 98031 access forbidden by rule, client: 52.66.113.242, server: [censored_1], request: "GET /.env HTTP/1.1", host: "www.[censored_1]" show less	Hacking
🇺🇸 GeekOnTheHill	2021-06-08 01:17:27 (5 years ago)	GET /wp-admin/admin-ajax.php?action=revslider_show_image	Hacking Web App Attack

Showing 1 to 15 of 22 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇺🇸 195.184.76.75

🇳🇱 195.178.110.232

🇹🇭 110.171.151.27

🇯🇴 109.107.230.96

🇺🇸 69.242.112.215

🇺🇸 66.132.172.227

🇺🇸 65.49.1.212

🇺🇸 2607:f8b0:4001:c0b::120

🇧🇬 213.91.249.211

🇵🇦 201.218.208.220

🇪🇹 196.189.99.218

🇸🇦 178.73.109.192

🇺🇸 162.216.149.135

🇮🇹 162.158.130.23

🇮🇹 162.158.129.211

🇨🇳 112.224.193.35

🇪🇬 102.188.179.120

🇷🇺 94.103.12.172

🇺🇸 66.132.172.251

🇺🇸 64.62.156.58