JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 154.53.58.161

154.53.58.161 was found in our database!

This IP was reported 382 times. Confidence of Abuse is 54%: ?

54%

This address is a Tor exit node. Neither the owner nor the provider are directly behind the offending action.

ISP	Contabo Inc
Usage Type	Data Center/Web Hosting/Transit
ASN	AS40021
Hostname(s)	usaseattle1tor.quetzalcoatl-relays.org
Domain Name	contabo.com
Country	🇺🇸 United States of America
City	Seattle, Washington

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 154.53.58.161

Whois 154.53.58.161

IP Abuse Reports for 154.53.58.161:

This IP address has been reported a total of 382 times from 121 distinct sources. 154.53.58.161 was first reported on May 24th 2025, and the most recent report was 1 day ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇺🇸 xmission.com	2026-06-04 00:34:57 (1 day ago)	Blocked by UFW (TCP on 52082) Source port: 9000 TTL: 55 Packet length: 76 TOS: 0x08 This report (fo ... show more Blocked by UFW (TCP on 52082) Source port: 9000 TTL: 55 Packet length: 76 TOS: 0x08 This report (for 154.53.58.161) was generated by: https://github.com/sefinek/UFW-AbuseIPDB-Reporter show less	Port Scan
🇺🇸 xmission.com	2026-06-02 14:01:18 (2 days ago)	Blocked by UFW (TCP on 46160) Source port: 9100 TTL: 55 Packet length: 76 TOS: 0x08 This report (fo ... show more Blocked by UFW (TCP on 46160) Source port: 9100 TTL: 55 Packet length: 76 TOS: 0x08 This report (for 154.53.58.161) was generated by: https://github.com/sefinek/UFW-AbuseIPDB-Reporter show less	Port Scan
🇫🇷 ✨	2026-06-02 01:47:18 (3 days ago)	Rule : PLESK BOT 2026-06-02 03:45:38 Unauthorized login attempt to Plesk Panel from IP 154.53.58.161 ... show more Rule : PLESK BOT 2026-06-02 03:45:38 Unauthorized login attempt to Plesk Panel from IP 154.53.58.161 with username admin show less	Hacking Brute-Force Web App Attack
🇺🇸 xmission.com	2026-06-02 00:16:52 (3 days ago)	Blocked by UFW (TCP on 57878) Source port: 9000 TTL: 55 Packet length: 76 TOS: 0x08 This report (fo ... show more Blocked by UFW (TCP on 57878) Source port: 9000 TTL: 55 Packet length: 76 TOS: 0x08 This report (for 154.53.58.161) was generated by: https://github.com/sefinek/UFW-AbuseIPDB-Reporter show less	Port Scan
🇩🇪 Martin Lundstrom	2026-05-28 15:26:52 (1 week ago)	Blocked by EagleEye Security (https://www.eagleeye-intelligence.com) on server.imagia.ma. Attack typ ... show more Blocked by EagleEye Security (https://www.eagleeye-intelligence.com) on server.imagia.ma. Attack type: IDS: network scan [rule 100570]. Origin: US. Source: usaseattle1tor.quetzalcoatl-relays.org (Contabo Inc). AbuseIPDB score: 58/100. Automated detection and blocking. show less	Port Scan Web App Attack
🇺🇸 xmission.com	2026-05-27 22:29:14 (1 week ago)	Blocked by UFW (TCP on 49834) Source port: 9000 TTL: 55 Packet length: 76 TOS: 0x08 This report (fo ... show more Blocked by UFW (TCP on 49834) Source port: 9000 TTL: 55 Packet length: 76 TOS: 0x08 This report (for 154.53.58.161) was generated by: https://github.com/sefinek/UFW-AbuseIPDB-Reporter show less	Port Scan
🇺🇸 TPI-Abuse	2026-05-26 10:20:06 (1 week ago)	(mod_security) mod_security (id:210730) triggered by 154.53.58.161 (usaseattle1tor.quetzalcoatl-rela ... show more (mod_security) mod_security (id:210730) triggered by 154.53.58.161 (usaseattle1tor.quetzalcoatl-relays.org): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue May 26 06:20:00.664541 2026] [security2:error] [pid 29579:tid 29579] [client 154.53.58.161:55520] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy\|\|ladymfashion.com\|F\|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "ladymfashion.com"] [uri "/dump.sql"] [unique_id "ahVz0HEuDXKYU_ZyH8S7kAAAABE"], referer: ladymfashion.com/dump.sql show less	Brute-Force Bad Web Bot Web App Attack
🇿🇦 slartybartfast69420blazit	2026-05-23 20:27:10 (1 week ago)	Fail2ban picked up 154.53.58.161 attacking nginx	Web App Attack
🇿🇦 slartybartfast69420blazit	2026-05-22 20:24:08 (1 week ago)	Fail2ban picked up 154.53.58.161 attacking nginx	Web App Attack
🇿🇦 slartybartfast69420blazit	2026-05-21 20:19:56 (2 weeks ago)	Fail2ban picked up 154.53.58.161 attacking nginx	Web App Attack
🇺🇸 TPI-Abuse	2026-05-20 23:32:32 (2 weeks ago)	(mod_security) mod_security (id:210730) triggered by 154.53.58.161 (usaseattle1tor.quetzalcoatl-rela ... show more (mod_security) mod_security (id:210730) triggered by 154.53.58.161 (usaseattle1tor.quetzalcoatl-relays.org): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed May 20 19:32:26.978946 2026] [security2:error] [pid 9108:tid 9108] [client 154.53.58.161:46326] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy\|\|pa-ksa.com\|F\|2"] [data ".dll"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "pa-ksa.com"] [uri "/docs/Zqxmwhflnje.dll"] [unique_id "ag5Einf5U06hmfutYUFryQAAAA4"] show less	Brute-Force Bad Web Bot Web App Attack
🇿🇦 slartybartfast69420blazit	2026-05-20 20:18:29 (2 weeks ago)	Fail2ban picked up 154.53.58.161 attacking nginx	Web App Attack
🇿🇦 slartybartfast69420blazit	2026-05-19 20:16:27 (2 weeks ago)	Fail2ban picked up 154.53.58.161 attacking nginx	Web App Attack
🇿🇦 slartybartfast69420blazit	2026-05-18 20:14:08 (2 weeks ago)	Fail2ban picked up 154.53.58.161 attacking nginx	Web App Attack
🇿🇦 slartybartfast69420blazit	2026-05-16 20:32:48 (2 weeks ago)	Fail2ban picked up 154.53.58.161 attacking nginx	Web App Attack

Showing 1 to 15 of 382 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇨🇳 221.10.221.104

🇺🇸 146.88.240.179

🇺🇸 146.88.240.139

🇹🇭 143.14.200.130

🇦🇺 134.199.155.60

🇺🇸 129.159.42.31

🇹🇼 128.14.236.128

🇱🇹 81.30.98.44

🇦🇱 172.71.138.133

🇺🇸 144.126.215.119

🇺🇸 124.198.131.39

🇹🇭 124.121.31.13

🇨🇳 117.64.65.255

🇻🇳 103.153.254.96

🇳🇱 81.19.216.118

🇺🇸 50.35.168.148

🇭🇺 45.11.172.194

🇻🇳 14.228.102.172

🇩🇪 2a00:1637:409:93:9999::217

🇹🇼 198.235.24.37