JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 52.66.96.197

52.66.96.197 was found in our database!

This IP was reported 104 times. Confidence of Abuse is 100%: ?

100%

ISP	Amazon Data Services India
Usage Type	Data Center/Web Hosting/Transit
ASN	AS16509
Hostname(s)	ec2-52-66-96-197.ap-south-1.compute.amazonaws.com
Domain Name	amazon.com
Country	🇮🇳 India
City	Mumbai, Maharashtra

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 52.66.96.197

Whois 52.66.96.197

IP Abuse Reports for 52.66.96.197:

This IP address has been reported a total of 104 times from 53 distinct sources. 52.66.96.197 was first reported on May 25th 2026, and the most recent report was 1 week ago.

Old Reports: The most recent abuse report for this IP address is from 1 week ago . It is possible that this IP is no longer involved in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇫🇷 tecnicorioja	2026-05-29 22:00:37 (1 week ago)	wp-login attack [29/May/2026:12:40:10	Brute-Force Web App Attack
🇺🇸 1cyb3rpunk	2026-05-29 19:23:19 (1 week ago)	Honeypot trap [path_not_found_probe] on sectrace.org — path: /wp-json/wp/v2/users/me stage: credenti ... show more Honeypot trap [path_not_found_probe] on sectrace.org — path: /wp-json/wp/v2/users/me stage: credential. Automated scanner/attacker activity. show less	Port Scan Brute-Force Bad Web Bot Web App Attack
🇫🇷 masterguru	2026-05-29 10:56:24 (1 week ago)	(modsec_5040) ModSec 5040: API Basic Auth blocked from 52.66.96.197 (IN/India/ec2-52-66-96-197.ap-so ... show more (modsec_5040) ModSec 5040: API Basic Auth blocked from 52.66.96.197 (IN/India/ec2-52-66-96-197.ap-south-1.compute.amazonaws.com): 1 in the last 3600 secs (0-196) show less	Hacking
🇲🇾 Rizzy	2026-05-29 10:53:38 (1 week ago)	Multiple WAF Violations	Brute-Force Web App Attack
🇺🇸 kosada.com	2026-05-29 08:36:19 (1 week ago)	Web password guessing	Brute-Force
🇩🇪 Hazzard	2026-05-29 08:35:47 (1 week ago)	(wordpress) Failed wordpress login from 52.66.96.197 (IN/India/Maharashtra/Mumbai/ec2-52-66-96-197.a ... show more (wordpress) Failed wordpress login from 52.66.96.197 (IN/India/Maharashtra/Mumbai/ec2-52-66-96-197.ap-south-1.compute.amazonaws.com/[redacted]): (CF_ENABLE) show less	Brute-Force
🇩🇪 FeG Deutschland	2026-05-29 06:35:55 (1 week ago)	Looking for CMS/PHP/SQL vulnerablilities/excessive crawling - 2	Exploited Host Web App Attack
🇺🇸 TAY	2026-05-29 04:56:54 (1 week ago)	52.66.96.197 - - [29/May/2026:12:52:46 +0800] "POST /wp-login.php HTTP/1.1" 200 2677 "https://little ... show more 52.66.96.197 - - [29/May/2026:12:52:46 +0800] "POST /wp-login.php HTTP/1.1" 200 2677 "https://littleprairie.com.my/wp-login.php" "Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36" 52.66.96.197 - - [29/May/2026:12:53:37 +0800] "POST /wp-login.php HTTP/1.1" 200 2978 "https://mail.autism-cvc.org/wp-login.php" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36" 52.66.96.197 - - [29/May/2026:12:56:54 +0800] "POST /wp-login.php HTTP/1.1" 200 2974 "https://mail.autism-cvc.org/wp-login.php" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.3 Safari/605.1.15" ... show less	Brute-Force
🇺🇸 Mundo Bueno	2026-05-29 04:46:37 (1 week ago)	[ISILIA Protection v2.1] Tentative d'accès: /wp-json/wp/v2/users/me \| Pays: IN \| UA: Mozilla/5.0 (Ma ... show more [ISILIA Protection v2.1] Tentative d'accès: /wp-json/wp/v2/users/me \| Pays: IN \| UA: Mozilla/5.0 (Macintosh; Intel Mac OS X 11_7_10) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0. show less	Hacking Web App Attack
🇺🇸 mind5t0rm	2026-05-29 04:37:15 (1 week ago)	(WPLOGIN) WP Login Attack 52.66.96.197 (IN/India/ec2-52-66-96-197.ap-south-1.compute.amazonaws.com): ... show more (WPLOGIN) WP Login Attack 52.66.96.197 (IN/India/ec2-52-66-96-197.ap-south-1.compute.amazonaws.com): 3 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: 52.66.96.197 - - [29/May/2026:11:25:36 +0700] "GET /wp-login.php HTTP/2.0" 200 3127 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:133.0) Gecko/20100101 Firefox/133.0" 52.66.96.197 - - [29/May/2026:11:25:39 +0700] "POST /wp-login.php HTTP/2.0" 200 4169 "https://thevasilis.com/wp-login.php" "Mozilla/5.0 (X11; Linux x86_64; rv:133.0) Gecko/20100101 Firefox/133.0" 52.66.96.197 - - [29/May/2026:11:37:12 +0700] "GET /wp-login.php HTTP/2.0" 200 2453 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36" show less	Port Scan
🇫🇷 LRob.fr	2026-05-29 04:00:04 (1 week ago)	WAF repeated trigger detected by Fail2Ban in plesk-modsecurity jail	Web App Attack
🇩🇪 F242	2026-05-29 03:49:24 (1 week ago)	Wordpress Login or XMLRPC abuse	Web App Attack
🇩🇪 ger-stg-sifi1	2026-05-29 02:11:36 (1 week ago)	(wordpress) Failed wordpress login using wp-login.php or xmlrpc.php	Web App Attack
🇦🇺 MAGIC	2026-05-29 01:23:08 (1 week ago)	VM1 Bad user agents ignoring web crawling rules. Draing bandwidth	DDoS Attack Bad Web Bot
🇺🇸 TPI-Abuse	2026-05-29 00:36:27 (1 week ago)	(mod_security) mod_security (id:225170) triggered by 52.66.96.197 (ec2-52-66-96-197.ap-south-1.compu ... show more (mod_security) mod_security (id:225170) triggered by 52.66.96.197 (ec2-52-66-96-197.ap-south-1.compute.amazonaws.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu May 28 20:36:24.587688 2026] [security2:error] [pid 8155:tid 8155] [client 52.66.96.197:0] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)\|\|pixacast.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "pixacast.com"] [uri "/wp-json/wp/v2/users/me"] [unique_id "ahjfiHGCYo8U1l6rGYb3ywAAACE"] show less	Brute-Force Bad Web Bot Web App Attack

Showing 1 to 15 of 104 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇺🇸 159.223.196.51

🇹🇭 147.50.231.36

🇯🇵 47.245.1.98

🇳🇱 193.176.31.215

🇩🇪 185.233.107.116

🇵🇰 175.107.37.51

🇺🇸 156.229.163.164

🇺🇸 69.63.184.8

🇺🇸 45.79.207.252

🇸🇬 45.78.206.111

🇨🇳 42.123.124.192

🇷🇺 5.165.19.3

🇹🇷 213.43.13.6

🇺🇸 162.216.149.180

🇮🇳 159.89.163.223

🇫🇮 147.185.133.248

🇺🇸 147.185.132.108

🇹🇭 118.194.251.144

🇨🇳 101.33.247.61

🇺🇸 66.132.172.224