JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 143.20.129.157

143.20.129.157 was found in our database!

This IP was reported 50 times. Confidence of Abuse is 100%: ?

100%

ISP	Ohz Digital S.L.
Usage Type	Data Center/Web Hosting/Transit
ASN	AS202673
Hostname(s)	es-residential.ohz.es
Domain Name	ohz.es
Country	🇪🇸 Spain
City	Madrid, Madrid

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 143.20.129.157

Whois 143.20.129.157

IP Abuse Reports for 143.20.129.157:

This IP address has been reported a total of 50 times from 46 distinct sources. 143.20.129.157 was first reported on June 4th 2026, and the most recent report was 2 weeks ago.

Old Reports: The most recent abuse report for this IP address is from 2 weeks ago . It is possible that this IP is no longer involved in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇦🇹 urnilxfgbez	2026-06-05 22:45:00 (2 weeks ago)	Last 24 Hours suspicious: (DPT=445\|DPT=3389\|DPT=22\|DPT=3306\|DPT=8080\|DPT=23\|DPT=5900\|DPT=1433)	Port Scan
Anonymous	2026-06-05 12:03:08 (2 weeks ago)	Unauthorized connection attempt	Port Scan Hacking Exploited Host
🇺🇸 TPI-Abuse	2026-06-05 11:06:44 (2 weeks ago)	(mod_security) mod_security (id:218420) triggered by 143.20.129.157 (es-residential.ohz.es): 1 in th ... show more (mod_security) mod_security (id:218420) triggered by 143.20.129.157 (es-residential.ohz.es): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jun 05 07:06:40.287349 2026] [security2:error] [pid 5796:tid 5796] [client 143.20.129.157:45748] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i)php://(std(in\|out\|err)\|(in\|out)put\|fd\|memory\|temp\|filter)" at ARGS_NAMES:\\xadd allow_url_include=1 \\xadd auto_prepend_file=php://input. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/21_PHP_PHPGen.conf"] [line "38"] [id "218420"] [rev "2"] [msg "COMODO WAF: PHP Injection Attack: I/O Stream Found\|\|192.64.150.91:80\|F\|2"] [data "Matched Data: php://input found within ARGS_NAMES:\\x5cxadd allow_url_include=1 \\x5cxadd auto_prepend_file=php://input: \\xadd allow_url_include=1 \\xadd auto_prepend_file=php://input"] [severity "CRITICAL"] [tag "CWAF"] [tag "PHPGen"] [hostname "192.64.150.91"] [uri "/hello.world"] [unique_id "aiKtwKLEKf1NPyTn5OTmPQAAAAQ"] show less	Brute-Force Bad Web Bot Web App Attack
🇩🇪 demonsword	2026-06-05 10:44:25 (2 weeks ago)	SSH brute-force detected: 4 failed login attempts in the last 1 hour.	Brute-Force SSH
🇺🇸 xmission.com	2026-06-05 10:28:41 (2 weeks ago)	Blocked by UFW (TCP on 443) Source port: 36344 TTL: 49 Packet length: 44 TOS: 0x08 This report (for ... show more Blocked by UFW (TCP on 443) Source port: 36344 TTL: 49 Packet length: 44 TOS: 0x08 This report (for 143.20.129.157) was generated by: https://github.com/sefinek/UFW-AbuseIPDB-Reporter show less	Port Scan Web App Attack
🇩🇪 BennetLe	2026-06-05 10:26:20 (2 weeks ago)	Jun 5 12:01:36 ubuntu sshd[417646]: Invalid user admin from 143.20.129.157 port 45180 Jun 5 12:03: ... show more Jun 5 12:01:36 ubuntu sshd[417646]: Invalid user admin from 143.20.129.157 port 45180 Jun 5 12:03:41 ubuntu sshd[419798]: Invalid user orangepi from 143.20.129.157 port 55656 Jun 5 12:18:10 ubuntu sshd[434359]: Invalid user test from 143.20.129.157 port 36822 Jun 5 12:20:10 ubuntu sshd[436416]: Invalid user user from 143.20.129.157 port 54982 Jun 5 12:24:10 ubuntu sshd[440421]: Invalid user admin from 143.20.129.157 port 35184 Jun 5 12:26:19 ubuntu sshd[442544]: Invalid user cirros from 143.20.129.157 port 33572 ... show less	Brute-Force SSH
🇺🇸 xmission.com	2026-06-05 10:02:36 (2 weeks ago)	Blocked by UFW (TCP on 2375) Source port: 48628 TTL: 48 Packet length: 44 TOS: 0x08 This report (fo ... show more Blocked by UFW (TCP on 2375) Source port: 48628 TTL: 48 Packet length: 44 TOS: 0x08 This report (for 143.20.129.157) was generated by: https://github.com/sefinek/UFW-AbuseIPDB-Reporter show less	Port Scan
Anonymous	2026-06-05 10:00:00 (2 weeks ago)	SSH Brute-Force	DDoS Attack Port Scan Hacking Brute-Force SSH
🇺🇸 TPI-Abuse	2026-06-05 09:34:55 (2 weeks ago)	(mod_security) mod_security (id:218420) triggered by 143.20.129.157 (es-residential.ohz.es): 1 in th ... show more (mod_security) mod_security (id:218420) triggered by 143.20.129.157 (es-residential.ohz.es): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jun 05 05:34:51.879817 2026] [security2:error] [pid 18863:tid 18863] [client 143.20.129.157:46342] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i)php://(std(in\|out\|err)\|(in\|out)put\|fd\|memory\|temp\|filter)" at ARGS_NAMES:\\xadd allow_url_include=1 \\xadd auto_prepend_file=php://input. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/21_PHP_PHPGen.conf"] [line "22"] [id "218420"] [rev "2"] [msg "COMODO WAF: PHP Injection Attack: I/O Stream Found\|\|192.64.150.16:80\|F\|2"] [data "Matched Data: php://input found within ARGS_NAMES:\\x5cxadd allow_url_include=1 \\x5cxadd auto_prepend_file=php://input: \\xadd allow_url_include=1 \\xadd auto_prepend_file=php://input"] [severity "CRITICAL"] [tag "CWAF"] [tag "PHPGen"] [hostname "192.64.150.16"] [uri "/hello.world"] [unique_id "aiKYO0riqHs11R-W4JesKwAAAAs"] show less	Brute-Force Bad Web Bot Web App Attack
🇩🇪 Libra	2026-06-05 09:25:29 (2 weeks ago)	Fail2ban jail=sshd increase=1	Brute-Force SSH
🇫🇷 security.rdmc.fr	2026-06-05 09:20:47 (2 weeks ago)	Port Scan Attack proto:TCP src:40682 dst:23	Port Scan
🇺🇸 bigscoots.com	2026-06-05 08:55:29 (2 weeks ago)	(sshd) Failed SSH login from 143.20.129.157 (ES/Spain/es-residential.ohz.es): 5 in the last 3600 sec ... show more (sshd) Failed SSH login from 143.20.129.157 (ES/Spain/es-residential.ohz.es): 5 in the last 3600 secs; Ports: *; Direction: 1; Trigger: LF_SSHD; Logs: Jun 5 03:51:41 14039 sshd[10314]: Invalid user admin from 143.20.129.157 port 58032 Jun 5 03:51:43 14039 sshd[10314]: Failed password for invalid user admin from 143.20.129.157 port 58032 ssh2 Jun 5 03:53:31 14039 sshd[11622]: Invalid user orangepi from 143.20.129.157 port 36336 Jun 5 03:53:33 14039 sshd[11622]: Failed password for invalid user orangepi from 143.20.129.157 port 36336 ssh2 Jun 5 03:55:20 14039 sshd[13050]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=143.20.129.157 user=root show less	Brute-Force SSH
Anonymous	2026-06-05 08:53:58 (2 weeks ago)	2026-06-05T08:39:49.271927+00:00 de-fra2-unifi1 sshd[1303116]: Invalid user admin from 143.20.129.15 ... show more 2026-06-05T08:39:49.271927+00:00 de-fra2-unifi1 sshd[1303116]: Invalid user admin from 143.20.129.157 port 34674 2026-06-05T08:41:38.087155+00:00 de-fra2-unifi1 sshd[1303125]: Invalid user orangepi from 143.20.129.157 port 45938 2026-06-05T08:53:57.418117+00:00 de-fra2-unifi1 sshd[1303467]: Invalid user test from 143.20.129.157 port 53638 ... show less	Brute-Force SSH
🇩🇪 ghostwarriors	2026-06-05 08:50:14 (2 weeks ago)	Webpage scraping	Brute-Force Bad Web Bot Web App Attack
🇩🇪 Justin F. \| AS204464	2026-06-05 08:30:57 (2 weeks ago)	Honeypot [nx-infrastructure]: Brute-force attack detected on 22/SSH • Credentials: admin:admin, oran ... show more Honeypot [nx-infrastructure]: Brute-force attack detected on 22/SSH • Credentials: admin:admin, orangepi:orangepi, root:P, root:password • Number of login attempts: 4 • Client: SSH-2.0-libssh2_1.11.1 Reported by: Justin F. show less	Brute-Force SSH

Showing 1 to 15 of 50 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇹🇷 195.33.200.58

🇺🇸 129.121.102.3

🇨🇳 124.115.219.14

🇻🇳 113.177.27.200

🇳🇱 91.92.40.44

🇬🇧 82.36.230.142

🇷🇺 80.115.211.109

🇨🇳 27.155.77.43

🇨🇭 209.99.191.19

🇬🇧 193.163.125.239

🇦🇷 186.148.224.219

🇫🇮 178.20.210.208

🇨🇳 175.27.241.235

🇱🇹 91.224.92.19

🇫🇷 85.217.140.2

🇬🇧 35.203.210.150

🇩🇪 240b:4005:25:5600:9be0:5941:a0b2:e493

🇬🇧 193.163.125.175

🇸🇬 165.154.200.214

🇳🇱 158.94.210.233