AbuseIPDB » 72.52.131.95

Check an IP Address, Domain Name, or Subnet

e.g. 3.236.225.157, microsoft.com, or 5.188.10.0/24

72.52.131.95 was found in our database!

This IP was reported 111 times. Confidence of Abuse is 100%: ?

100%

ISP	Liquid Web L.L.C
Usage Type	Data Center/Web Hosting/Transit
Hostname(s)	host.kuware.com
Domain Name	liquidweb.com
Country	United States of America
City	Lansing, Michigan

IP info including ISP, Usage Type, and Location provided by IP2Location. Updated monthly.

Report 72.52.131.95

Whois 72.52.131.95

IP Abuse Reports for 72.52.131.95:

This IP address has been reported a total of 111 times from 34 distinct sources. 72.52.131.95 was first reported on November 15th 2021, and the most recent report was 2 days ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	Date	Comment	Categories
John Chrys.	11 Aug 2022	72.52.131.95 - - [11/Aug/2022:11:15:25 +0300] "POST /xmlrpc.php HTTP/1.1" 403 4948 "-" "Mozilla/5.0 ... show more72.52.131.95 - - [11/Aug/2022:11:15:25 +0300] "POST /xmlrpc.php HTTP/1.1" 403 4948 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36" ... show less	Brute-Force Web App Attack
dwmp	10 Aug 2022	WordPress login Brute-Force	Brute-Force Web App Attack
pusathosting.com	08 Aug 2022	polres 72.52.131.95 [08/Aug/2022:20:53:19 "-" "POST /xmlrpc.php 200 3425 72.52.131.95 [09/Aug/ ... show morepolres 72.52.131.95 [08/Aug/2022:20:53:19 "-" "POST /xmlrpc.php 200 3425 72.52.131.95 [09/Aug/2022:04:54:44 "-" "POST /xmlrpc.php 200 4336 72.52.131.95 [09/Aug/2022:04:54:44 "-" "POST /xmlrpc.php 200 4336 show less	Brute-Force Web App Attack
rsa	08 Aug 2022	POST /xmlrpc.php HTTP/1.1	Hacking Brute-Force Web App Attack
Anonymous	06 Aug 2022	FAMILIENGESUNDHEITSZENTRUM-FULDA.DE 72.52.131.95 [07/Aug/2022:03:54:05 +0200] "POST /xmlrpc.php HTTP ... show moreFAMILIENGESUNDHEITSZENTRUM-FULDA.DE 72.52.131.95 [07/Aug/2022:03:54:05 +0200] "POST /xmlrpc.php HTTP/1.1" 200 5757 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36" familiengesundheitszentrum-fulda.de 72.52.131.95 [07/Aug/2022:03:54:05 +0200] "POST /xmlrpc.php HTTP/1.1" 200 5757 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36" show less	Web App Attack
John Chrys.	04 Aug 2022	72.52.131.95 - - [04/Aug/2022:22:55:20 +0300] "POST /xmlrpc.php HTTP/1.1" 403 5579 "-" "Mozilla/5.0 ... show more72.52.131.95 - - [04/Aug/2022:22:55:20 +0300] "POST /xmlrpc.php HTTP/1.1" 403 5579 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36" ... show less	Brute-Force Web App Attack
Anonymous	04 Aug 2022	(mod_security) mod_security (id:972687) triggered by 72.52.131.95 (US/United States/host.kuware.com) ... show more(mod_security) mod_security (id:972687) triggered by 72.52.131.95 (US/United States/host.kuware.com): 2 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_MODSEC; Logs: [Thu Aug 04 08:58:45.289190 2022] [:error] [pid 978313] [client 72.52.131.95:48308] [client 72.52.131.95] ModSecurity: Access denied with code 401 (phase 2). Operator EQ matched 0 at REQUEST_HEADERS. [file "/etc/apache2/conf.d/modsec/modsec2.user.conf"] [line "7"] [id "972687"] [msg "xmlrpc request blocked, no referrer"] [hostname "www.agkarmas.com.br"] [uri "/xmlrpc.php"] [unique_id "Yuu0dTjMZ_VKOn_JQ_eNaQAAAA8"] [Thu Aug 04 08:58:45.296142 2022] [:error] [pid 979678] [client 72.52.131.95:48306] [client 72.52.131.95] ModSecurity: Access denied with code 401 (phase 2). Operator EQ matched 0 at REQUEST_HEADERS. [file "/etc/apache2/conf.d/modsec/modsec2.user.conf"] [line "7"] [id "972687"] [msg "xmlrpc request blocked, no referrer"] [hostname "www.agkarmas.com.br"] [uri "/xmlrpc.php"] [unique_id "Yuu0dSPLjhH5LSMsa9gFngAAABI"] show less	Port Scan
akac	04 Aug 2022	WordPress XML-RPC attack attempt. Request: POST /blog/xmlrpc.php User-Agent: Mozilla/5.0 ... show moreWordPress XML-RPC attack attempt. Request: POST /blog/xmlrpc.php User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 Body: <?xml version='1.0'?> <methodCall> <methodName>wp.getProfile</methodName> <params> <param><value><int>0</int></value></param> <param><value><string><DOMAIN></string></value></param> <param><value><string><DOMAIN>2020#</string></value></param> </params> </methodCall> show less	Web Spam Brute-Force Bad Web Bot Web App Attack
Anonymous	30 Jul 2022	(mod_security) mod_security (id:972687) triggered by 72.52.131.95 (US/United States/host.kuware.com) ... show more(mod_security) mod_security (id:972687) triggered by 72.52.131.95 (US/United States/host.kuware.com): 2 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_MODSEC; Logs: [Sat Jul 30 06:24:29.392710 2022] [:error] [pid 544377] [client 72.52.131.95:41156] [client 72.52.131.95] ModSecurity: Access denied with code 401 (phase 2). Operator EQ matched 0 at REQUEST_HEADERS. [file "/etc/apache2/conf.d/modsec/modsec2.user.conf"] [line "7"] [id "972687"] [msg "xmlrpc request blocked, no referrer"] [hostname "iberobrasil.net"] [uri "/WP/xmlrpc.php"] [unique_id "YuT4zZbuv-4OorOfg2pcOwAAAAA"] [Sat Jul 30 06:24:29.411224 2022] [:error] [pid 543774] [client 72.52.131.95:41176] [client 72.52.131.95] ModSecurity: Access denied with code 401 (phase 2). Operator EQ matched 0 at REQUEST_HEADERS. [file "/etc/apache2/conf.d/modsec/modsec2.user.conf"] [line "7"] [id "972687"] [msg "xmlrpc request blocked, no referrer"] [hostname "iberobrasil.net"] [uri "/wp/xmlrpc.php"] [unique_id "YuT4zSUVcbVGDWvnqMfQPgAAAA8"] show less	Port Scan
iNetWorker	26 Jul 2022	trolling for resource vulnerabilities	Web App Attack
Anonymous	25 Jul 2022	XMLRPC Hack Attempts	Hacking Brute-Force
F242	23 Jul 2022	Jul 24 02:23:06 mx1 wordpress(pixel64.de)[17900]: XML-RPC authentication failure for pixel64 from 72 ... show moreJul 24 02:23:06 mx1 wordpress(pixel64.de)[17900]: XML-RPC authentication failure for pixel64 from 72.52.131.95 Jul 24 02:23:07 mx1 wordpress(PIXEL64.DE)[17900]: XML-RPC authentication failure for pixel64 from 72.52.131.95 ... show less	Web App Attack
F242	22 Jul 2022	Jul 22 11:33:22 mx1 wordpress(MEDDLSTADL.DE)[808]: XML-RPC authentication attempt for unknown user H ... show moreJul 22 11:33:22 mx1 wordpress(MEDDLSTADL.DE)[808]: XML-RPC authentication attempt for unknown user Henker from 72.52.131.95 ... show less	Web App Attack
Anonymous	22 Jul 2022	(mod_security) mod_security (id:972687) triggered by 72.52.131.95 (US/United States/host.kuware.com) ... show more(mod_security) mod_security (id:972687) triggered by 72.52.131.95 (US/United States/host.kuware.com): 2 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_MODSEC; Logs: [Fri Jul 22 03:39:05.308135 2022] [:error] [pid 2699586] [client 72.52.131.95:37000] [client 72.52.131.95] ModSecurity: Access denied with code 401 (phase 2). Operator EQ matched 0 at REQUEST_HEADERS. [file "/etc/apache2/conf.d/modsec/modsec2.user.conf"] [line "7"] [id "972687"] [msg "xmlrpc request blocked, no referrer"] [hostname "eurodeck.net.br"] [uri "/xmlrpc.php"] [unique_id "YtpGCW2lASbQcSzjjzKiuAAAABc"] [Fri Jul 22 03:39:05.352291 2022] [:error] [pid 2699577] [client 72.52.131.95:37052] [client 72.52.131.95] ModSecurity: Access denied with code 401 (phase 2). Operator EQ matched 0 at REQUEST_HEADERS. [file "/etc/apache2/conf.d/modsec/modsec2.user.conf"] [line "7"] [id "972687"] [msg "xmlrpc request blocked, no referrer"] [hostname "eurodeck.net.br"] [uri "/xmlrpc.php"] [unique_id "YtpGCQF_yM7sgUX4Pemc1QAAAA8"] show less	Port Scan
akac	20 Jul 2022	WordPress XML-RPC attack attempt. Request: POST /wordpress/xmlrpc.php User-Agent: Mozill ... show moreWordPress XML-RPC attack attempt. Request: POST /wordpress/xmlrpc.php User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 Body: <?xml version='1.0'?> <methodCall> <methodName>wp.getProfile</methodName> <params> <param><value><int>0</int></value></param> <param><value><string>admin</string></value></param> <param><value><string>1111</string></value></param> </params> </methodCall> show less	Web Spam Brute-Force Bad Web Bot Web App Attack