JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 152.53.157.69

152.53.157.69 was found in our database!

This IP was reported 19 times. Confidence of Abuse is 77%: ?

77%

This address is a Tor exit node. Neither the owner nor the provider are directly behind the offending action.

ISP	Anexia Holding GmbH
Usage Type	Data Center/Web Hosting/Transit
ASN	AS197540
Hostname(s)	v2202607381157482876.luckysrv.de
Domain Name	anexia.com
Country	🇩🇪 Germany
City	Nuremberg, Bavaria

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 152.53.157.69

Whois 152.53.157.69

IP Abuse Reports for 152.53.157.69:

This IP address has been reported a total of 19 times from 14 distinct sources. 152.53.157.69 was first reported on July 14th 2026, and the most recent report was 8 hours ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇩🇪 FeG Deutschland	2026-07-20 11:35:03 (8 hours ago)	Looking for CMS/PHP/SQL vulnerablilities/excessive crawling - 28	Exploited Host Web App Attack
🇩🇪 big-cloud.nl	2026-07-20 09:47:33 (10 hours ago)	Try to access /xmlrpc.php	Web App Attack
🇺🇸 TPI-Abuse	2026-07-19 06:35:28 (1 day ago)	(mod_security) mod_security (id:210831) triggered by 152.53.157.69 (v2202607381157482876.luckysrv.de ... show more (mod_security) mod_security (id:210831) triggered by 152.53.157.69 (v2202607381157482876.luckysrv.de): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Jul 19 02:35:24.463578 2026] [security2:error] [pid 1959877:tid 1959877] [client 152.53.157.69:43550] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url\|user-Agent\|www\\\\.weblogs\\\\.com\|(?:jakart\|vi)a\|(google\|i{0,1}explorer{0,1}\\\\.exe\|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)\|\\\\bdatacha0s\\\\b\|; widows\|\\\\\\\\r\|a(?: href=\|d(?:sarobot\|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler\|\|www.natasways.com\|F\|4"] [data "panscient.com"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "www.natasways.com"] [uri "/"] [unique_id "alxwLPCzz9GLMbdxgg_mIwAAAAI"] show less	Brute-Force Bad Web Bot Web App Attack
🇭🇺 NyaljBe	2026-07-19 05:44:00 (1 day ago)	heavy wp-login.php & xmlrpc.php attack	Web App Attack
🇺🇸 TPI-Abuse	2026-07-18 18:43:23 (2 days ago)	(mod_security) mod_security (id:225170) triggered by 152.53.157.69 (v2202607381157482876.luckysrv.de ... show more (mod_security) mod_security (id:225170) triggered by 152.53.157.69 (v2202607381157482876.luckysrv.de): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Jul 18 14:43:16.560739 2026] [security2:error] [pid 2656908:tid 2656908] [client 152.53.157.69:34982] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)\|\|esysapps.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "esysapps.com"] [uri "/wp-json/wp/v2/users"] [unique_id "alvJRCeGkh3CRMIzzVUNmQAAABo"] show less	Brute-Force Bad Web Bot Web App Attack
🇨🇭 Origon	2026-07-18 14:46:51 (2 days ago)	http-wordpress_user-enum - IP: 152.53.157.69 - time="2026-07-18T16:46:51+02:00" level=info msg="(55 ... show more http-wordpress_user-enum - IP: 152.53.157.69 - time="2026-07-18T16:46:51+02:00" level=info msg="(555f66b4f6a74558bc11e3f93469658es8App0Mcc0TKEeje/crowdsec) crowdsecurity/http-wordpress_user-enum by ip 152.53.157.69 (AT/0) : 4h ban on Ip 152.53.157.69" module=db show less	Web App Attack
🇩🇪 netclix.gr	2026-07-18 02:27:27 (2 days ago)	(wordpress) Failed wordpress login from 152.53.157.69 (DE/Germany/v2202607381157482876.luckysrv.de): ... show more (wordpress) Failed wordpress login from 152.53.157.69 (DE/Germany/v2202607381157482876.luckysrv.de): (CF_ENABLE) show less	Brute-Force
🇩🇪 neckaralb-admin.de	2026-07-18 02:26:27 (2 days ago)	(wordpress) Failed login wp-login.php or xmlrpc.php	Web App Attack
🇩🇪 THYRAKLES_EINZELUNTERNEHMEN_NOAH_FINLEY WOLF	2026-07-18 01:59:06 (2 days ago)	systemd timer sync; source=sshd host=ns2 ip=152.53.157.69; evidence=fail2ban log NOTICE Ban event	Brute-Force SSH
🇦🇺 oncord	2026-07-18 00:46:58 (2 days ago)	Form spam	Web Spam
🇳🇱 homeshowdomain.nl	2026-07-16 22:01:23 (3 days ago)	Auto-ban: single probe for restricted files (.env / backups / admin endpoints). Likely mass-scan on ... show more Auto-ban: single probe for restricted files (.env / backups / admin endpoints). Likely mass-scan on 2026-07-15. show less	Web App Attack SSH Hacking
🇫🇷 dynamix	2026-07-15 13:06:37 (5 days ago)	Multiple WAF Violations	Web App Attack
🇺🇸 TPI-Abuse	2026-07-15 11:56:38 (5 days ago)	(mod_security) mod_security (id:225170) triggered by 152.53.157.69 (v2202607381157482876.luckysrv.de ... show more (mod_security) mod_security (id:225170) triggered by 152.53.157.69 (v2202607381157482876.luckysrv.de): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jul 15 07:56:33.343300 2026] [security2:error] [pid 29026:tid 29026] [client 152.53.157.69:39356] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)\|\|thenewplantation.org\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "thenewplantation.org"] [uri "/wp-json/wp/v2/users"] [unique_id "ald1cWbmDg29max3pMV1jAAAABU"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-07-15 10:18:44 (5 days ago)	(mod_security) mod_security (id:210831) triggered by 152.53.157.69 (v2202607381157482876.luckysrv.de ... show more (mod_security) mod_security (id:210831) triggered by 152.53.157.69 (v2202607381157482876.luckysrv.de): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jul 15 06:18:36.517073 2026] [security2:error] [pid 31214:tid 31214] [client 152.53.157.69:59840] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url\|user-Agent\|www\\\\.weblogs\\\\.com\|(?:jakart\|vi)a\|(google\|i{0,1}explorer{0,1}\\\\.exe\|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)\|\\\\bdatacha0s\\\\b\|; widows\|\\\\\\\\r\|a(?: href=\|d(?:sarobot\|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler\|\|www.k2medianetworks.com\|F\|4"] [data "panscient.com"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "www.k2medianetworks.com"] [uri "/"] [unique_id "aldefBBOoMqhGjxPGhGVOgAAAAQ"] show less	Brute-Force Bad Web Bot Web App Attack
🇦🇺 oncord	2026-07-15 05:35:54 (5 days ago)	Form spam	Web Spam

Showing 1 to 15 of 19 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇷🇺 195.19.49.233

🇺🇸 148.153.250.111

🇳🇬 102.140.97.134

🇬🇧 87.236.176.28

🇬🇧 35.203.211.109

🇹🇭 202.29.228.248

🇨🇳 183.54.229.249

🇺🇸 172.232.160.26

🇷🇺 88.205.172.170

🇲🇾 47.254.206.59

🇳🇱 31.77.131.189

🇧🇷 205.210.31.212

🇪🇬 197.120.152.63

🇦🇴 193.163.125.220

🇵🇱 176.53.159.197

🇲🇦 154.144.255.209

🇺🇸 104.194.9.81

🇧🇷 45.174.162.68

🇪🇬 41.42.9.21

🇨🇳 36.134.211.170