104.152.52.111
Recent Activity
This IP has received recent abuse reports, which causes the score to increase.
- ISP
- Rethem Hosting LLC
- Usage Type
- Data Center/Web Hosting/Transit
- ASN
- AS14987
- Hostname(s)
- internettl.org
- Domain Name
- rethemhosting.net
- Country
- 🇺🇸 United States of America
- City
- Chicago, Illinois
Abuse Reports
Total reports
2,899 from
580 distinct
reporters
First reported
Most recent report
Recent reports
We have received reports of abusive activity from this IP address within the last week. It is
potentially still actively engaged in abusive activities.
| Reporter | IoA Timestamp (UTC) | Comment | Categories |
|---|---|---|---|
| 🇫🇷 uthul |
T-Pot honeypot: 214 hits on ports [796, 2019, 2125, 2241, 2404, 2418, 2500, 2615, 2646, 2650] (automated)
|
Port Scan | |
| 🇳🇱 donarev419 |
Connection to port 10011 with data transfer.
Data preview:
|
Port Scan Hacking | |
| 🇺🇸 seajaydaboi36 |
Automated detection: unsolicited connection to Pterodactyl Wings server.
|
Port Scan Hacking Brute-Force | |
| 🇸🇪 basil s |
Port scan sweep against closed ports. Automated TCP SYN scan exceeding 15 packets per minute across closed ports; blocked by firewall. Target: TCP/2125. First seen: 2026-11-04 03:22:40 UTC. Source: host firewall/sshd log.
|
Port Scan | |
| 🇳🇱 nandadytm |
[2026-11-04 01:35:57] Banned 104.152.52.111 after 3 attempts: Portscan probe on TCP port 139,25,9200
|
Port Scan | |
| 🇫🇷 EvoX |
🛡️ Honeypot [bsts-tpot-hive]: Unauthorized traffic (110 bytes of payload); 5902 [1] TCP
|
Port Scan | |
| 🇹🇷 neron |
CrowdSec blocked: ssh:bruteforce detected via OPNsense firewall
|
Hacking Web App Attack | |
| 🇺🇸 drewf.ink |
[09:28] Port scanning. Port(s) scanned: TCP/1, TCP/19, TCP/515
|
Port Scan | |
| 🇫🇷 uthul |
T-Pot honeypot: 4193 hits on ports [135, 2005, 2082, 2379, 2395, 2417, 2845, 3037, 3216, 3239] (automated)
|
Port Scan | |
| 🇩🇪 Progetto1 |
Detected via HAProxyScanner at 2026-11-03 04:22:02 UTC on destination port WEB (80/443). Repeated scan / connection.
|
Port Scan Hacking Brute-Force | |
| 🇺🇸 sandra361 |
|
Port Scan | |
| 🇳🇱 venix |
Unauthorized connection attempt detected from IP address 104.152.52.111 to port 139 (web01.amsterdam)
|
Brute-Force Exploited Host | |
| 🇺🇸 Phil Schuyler |
Repeated probing against public honeypot services: 2 observed events targeting VNC/5900.
|
Port Scan | |
| 🇳🇱 venix |
Unauthorized connection attempt detected from IP address 104.152.52.111 to port 1433 (web01.amsterdam)
|
Brute-Force Exploited Host | |
| 🇧🇷 diego |
[arem1] 2026-11-02 15:24:07, Client: 104.152.52.111, Protocol: 6, Unauthorized activity to HTTP: GET /
|
Web App Attack |
Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown