JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 157.230.29.185

157.230.29.185 was found in our database!

This IP was reported 38 times. Confidence of Abuse is 100%: ?

100%

ISP	DigitalOcean, LLC
Usage Type	Data Center/Web Hosting/Transit
ASN	AS14061
Domain Name	digitalocean.com
Country	🇩🇪 Germany
City	Frankfurt am Main, Hesse

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 157.230.29.185

Whois 157.230.29.185

IP Abuse Reports for 157.230.29.185:

This IP address has been reported a total of 38 times from 26 distinct sources. 157.230.29.185 was first reported on December 27th 2023, and the most recent report was 3 days ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
Anonymous	2026-07-16 08:46:11 (3 days ago)	Failed Wordpress Logins	Web App Attack
🇩🇪 anycast_ac	2026-07-15 22:03:07 (3 days ago)	[DDoS Attacker] This IP was attacking website anycast.ac and sent 96 requests on port 443	DDoS Attack Web App Attack
🇩🇪 raph	2026-07-15 21:41:06 (3 days ago)	[SQL INJECTION] f2b match %{+Q}r for ^.haproxy\[[0-9]+\]: <HOST>:. (GET \|POST ).\?.(%20AND%20\|%2 ... show more [SQL INJECTION] f2b match %{+Q}r for ^.haproxy\[[0-9]+\]: <HOST>:. (GET \|POST ).\?.(%20AND%20\|%20and%20\|%20OR%20\|%20or%20).* HTTP/1.1$ show less	SQL Injection
🇬🇧 Celtic	2026-07-15 20:09:20 (4 days ago)	Blocked by Fail2Ban with Jail (plesk-modsecurity)	Brute-Force SSH
🇩🇪 iGroupware	2026-07-15 19:24:23 (4 days ago)	[Invisible Captcha] Potential spam detected for IP 157.230.29.185. Timestamp threshold not reached ( ... show more [Invisible Captcha] Potential spam detected for IP 157.230.29.185. Timestamp threshold not reached (took 4s). show less	Web App Attack
🇩🇪 bsoft.de	2026-07-15 16:27:51 (4 days ago)	157.230.29.185 - - [15/Jul/2026:18:27:44 +0200] "GET /xmlrpc.php HTTP/1.1" 405 42 "-" "Mozilla/5.0 ( ... show more 157.230.29.185 - - [15/Jul/2026:18:27:44 +0200] "GET /xmlrpc.php HTTP/1.1" 405 42 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:122.0) Gecko/20100101 Firefox/122.0" 157.230.29.185 - - [15/Jul/2026:18:27:45 +0200] "GET /wp-json/wp/v2/users?per_page=100 HTTP/1.1" 404 148 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:122.0) Gecko/20100101 Firefox/122.0" 157.230.29.185 - - [15/Jul/2026:18:27:50 +0200] "GET /wp-json/wp/v2/users/1 HTTP/1.1" 404 148 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:122.0) Gecko/20100101 Firefox/122.0" show less	Web App Attack
🇺🇸 TPI-Abuse	2026-07-15 09:24:03 (4 days ago)	(mod_security) mod_security (id:210831) triggered by 157.230.29.185 (tor-exit.lightchan.online): 1 i ... show more (mod_security) mod_security (id:210831) triggered by 157.230.29.185 (tor-exit.lightchan.online): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jul 15 05:23:55.253708 2026] [security2:error] [pid 503:tid 503] [client 157.230.29.185:40060] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url\|user-Agent\|www\\\\.weblogs\\\\.com\|(?:jakart\|vi)a\|(google\|i{0,1}explorer{0,1}\\\\.exe\|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)\|\\\\bdatacha0s\\\\b\|; widows\|\\\\\\\\r\|a(?: href=\|d(?:sarobot\|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler\|\|www.woodsoninsuranceagency.com\|F\|4"] [data "panscient.com"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "www.woodsoninsuranceagency.com"] [uri "/robots.txt"] [unique_id "aldRq03T7BF13TmlSH-YvAAAAB0"] show less	Brute-Force Bad Web Bot Web App Attack
🇩🇪 LRob	2026-07-15 08:50:07 (4 days ago)	CrowdSec: crowdsecurity/http-bad-user-agent \| req: /wp-content/plugins/ewww-image-optimizer/includes ... show more CrowdSec: crowdsecurity/http-bad-user-agent \| req: /wp-content/plugins/ewww-image-optimizer/includes/lazysizes.min.js?ver=872 \| 2 distinct paths \| UA: \x22Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36\x22 show less	Bad Web Bot
Anonymous	2026-07-15 06:51:22 (4 days ago)	[osotir.org] httpd-xmlrpc-post: sites=www.osotir.org; logs=/var/log/httpd/domains/osotir.org.log; sa ... show more [osotir.org] httpd-xmlrpc-post: sites=www.osotir.org; logs=/var/log/httpd/domains/osotir.org.log; samples=/xmlrpc.php show less	Brute-Force Web App Attack
🇺🇸 TPI-Abuse	2026-07-14 20:57:38 (4 days ago)	(mod_security) mod_security (id:210831) triggered by 157.230.29.185 (tor-exit.lightchan.online): 1 i ... show more (mod_security) mod_security (id:210831) triggered by 157.230.29.185 (tor-exit.lightchan.online): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jul 14 16:57:30.771275 2026] [security2:error] [pid 28958:tid 28958] [client 157.230.29.185:39144] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url\|user-Agent\|www\\\\.weblogs\\\\.com\|(?:jakart\|vi)a\|(google\|i{0,1}explorer{0,1}\\\\.exe\|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)\|\\\\bdatacha0s\\\\b\|; widows\|\\\\\\\\r\|a(?: href=\|d(?:sarobot\|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler\|\|www.wichita-massacre.com\|F\|4"] [data "panscient.com"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "www.wichita-massacre.com"] [uri "/robots.txt"] [unique_id "alaiupwNVFACgFwPiSosHAAAAAE"] show less	Brute-Force Bad Web Bot Web App Attack
Anonymous	2026-07-14 19:37:35 (5 days ago)	Detected by CrowdSec: crowdsecurity/http-bad-user-agent	Web App Attack
🇩🇪 psauxit	2026-07-14 16:51:46 (5 days ago)	Fail2Ban - NGINX heavily bad-bot, possible vulnerability scanning and excessive crawling/scraping	Bad Web Bot Web App Attack Hacking Web Spam
🇺🇸 oncord	2026-07-14 11:26:38 (5 days ago)	Form spam	Web Spam
🇩🇪 big-cloud.nl	2026-07-14 08:57:02 (5 days ago)	Try to access /xmlrpc.php	Web App Attack
🇺🇸 cwytech	2026-07-14 07:47:52 (5 days ago)	Fleet-wide ban from the Ghostfleet 👻. Triggered by scenario: cwy/wp-us-login-only-high.	Bad Web Bot Web App Attack

Showing 1 to 15 of 38 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇳🇱 217.121.115.17

🇺🇸 144.172.67.52

🇺🇸 2607:f8b0:4002:c0f::125

🇲🇾 183.171.158.198

🇹🇿 154.74.127.122

🇻🇳 116.99.248.140

🇿🇦 102.66.141.96

🇷🇴 92.118.39.71

🇬🇧 89.187.80.27

🇧🇬 80.66.66.66

🇩🇪 47.245.138.141

🇹🇼 34.81.36.168

🇺🇸 192.169.180.166

🇯🇴 176.241.68.242

🇺🇸 166.62.89.133

🇺🇸 147.185.132.144

🇸🇬 128.199.241.199

🇮🇩 103.164.57.37

🇺🇸 100.28.49.152

🇺🇸 74.125.75.149