JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

158.173.23.23

Neutral Activity

Abuse Confidence Score

0% Low Risk

21 reports

19 reporters · latest 9 months ago

ISP: VPN Consumer London, United Kingdom
Usage Type: Data Center/Web Hosting/Transit
ASN: AS212238
Domain Name: vpnconsumer.com
Country: 🇬🇧 United Kingdom of Great Britain and Northern Ireland
City: London, England

ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report Whois

No reports in the last 60 days

158.173.23.23 has been reported 21 times. The most recent report is from 9 months ago.

The full history is preserved below and remains searchable. A 0% score reflects the absence of recent activity, but this is not a guarantee that earlier reports were invalid. Abuse confidence score decays, naturally, over time, when the abusive activity stops.

Abuse Reports

Export reports CSV

Total reports

21 from 19 distinct reporters

First reported

October 4th 2025

Most recent report

9 months ago

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇺🇸 TPI-Abuse	2026-02-06 18:29:18 UTC · (9 months ago)	(mod_security) mod_security (id:225170) triggered by 158.173.23.23 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Feb 06 13:29:11.652910 2026] [security2:error] [pid 2525002:tid 2525002] [client 158.173.23.23:2064 ... show more (mod_security) mod_security (id:225170) triggered by 158.173.23.23 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Feb 06 13:29:11.652910 2026] [security2:error] [pid 2525002:tid 2525002] [client 158.173.23.23:20647] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)\|\|kerrywood.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "kerrywood.com"] [uri "/wp-json/wp/v2/users/"] [unique_id "aYYy92ZjQA7n6MXC6qiQhgAAAAs"] show less	Brute-Force Bad Web Bot Web App Attack
Anonymous	2026-01-30 04:31:02 UTC · (9 months ago)	Failed login attempt detected by Fail2Ban in plesk-postfix jail	Brute-Force
Anonymous	2026-01-16 13:10:03 UTC · (9 months ago)	\| Common web attack.	Hacking SQL Injection Web App Attack
Anonymous	2026-01-07 13:10:55 UTC · (10 months ago)	(smtpauth) Failed SMTP AUTH login from 158.173.23.23 (GB/United Kingdom/-)	Brute-Force
🇮🇹 VHosting	2026-01-07 13:03:54 UTC · (10 months ago)	Detected mail brute force attack from 4 different servers	Brute-Force
🇺🇸 bigscoots.com	2026-01-07 13:01:07 UTC · (10 months ago)	(smtpauth) Failed SMTP AUTH login from 158.173.23.23 (GB/United Kingdom/-): 5 in the last 3600 secs; Ports: 25,465,587; Direction: 0; Trigger: LF_SMTPAUTH; Logs: 2026-01-07 08:00:24 dovecot_plain authenticator failed for H=([10.23.184.109]) [158.173. ... show more (smtpauth) Failed SMTP AUTH login from 158.173.23.23 (GB/United Kingdom/-): 5 in the last 3600 secs; Ports: 25,465,587; Direction: 0; Trigger: LF_SMTPAUTH; Logs: 2026-01-07 08:00:24 dovecot_plain authenticator failed for H=([10.23.184.109]) [158.173.23.23]:10712: 535 Incorrect authentication data ([email protected]) 2026-01-07 08:00:30 dovecot_login authenticator failed for H=([10.23.184.109]) [158.173.23.23]:10712: 535 Incorrect authentication data ([email protected]) 2026-01-07 08:00:38 dovecot_plain authenticator failed for H=([10.23.184.109]) [158.173.23.23]:21322: 535 Incorrect authentication data ([email protected]) 2026-01-07 08:00:40 dovecot_login authenticator failed for H=([10.23.184.109]) [158.173.23.23]:21322: 535 Incorrect authentication data ([email protected]) 2026-01-07 08:01:03 dovecot_plain authenticator failed for H=([10.23.184.109]) [158.173.23.23]:32340: 535 Incorrect authentication data ([email protected]) show less	Brute-Force SSH
Anonymous	2026-01-07 13:01:01 UTC · (10 months ago)	...	Brute-Force
Anonymous	2025-12-11 12:50:00 UTC · (11 months ago)	Web Server atack ...	DDoS Attack Web Spam Bad Web Bot Web App Attack
🇹🇭 thaizone.com	2025-12-05 06:10:14 UTC · (11 months ago)	Password guessing attack (SM11) #1	Email Spam Brute-Force
Anonymous	2025-12-05 06:06:02 UTC · (11 months ago)	BruteForce IMAP/POP3/SMTP	Brute-Force
🇮🇹 VHosting	2025-11-29 20:04:39 UTC · (11 months ago)	Detected mail brute force attack from 4 different servers	Brute-Force
🇦🇺 screwlooseit.com.au	2025-11-28 00:23:25 UTC · (11 months ago)	Blocked by CSF 13 firewall - Rule: mysaslmatch DK/Denmark/-	Web App Attack
🇧🇪 cmbplf	2025-11-03 09:28:04 UTC · (1 year ago)	346 requests with user_agent.original Mozilla/5.0 (iPhone; CPU iPhone OS 16_1_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Mobile/15E148 [LinkedInApp]/9.28.7586 344 requests with user_agent.original Mozilla/5.0 (X11; U; Linux i586; en- ... show more 346 requests with user_agent.original Mozilla/5.0 (iPhone; CPU iPhone OS 16_1_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Mobile/15E148 [LinkedInApp]/9.28.7586 344 requests with user_agent.original Mozilla/5.0 (X11; U; Linux i586; en-US; rv:1.0.0) Gecko/20020623 Debian/1.0.0-0.woody.1 338 requests with user_agent.original Mozilla/5.0 (Linux; Android 9) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/119.0.6045.66 Mobile DuckDuckGo/1 Lilo/1.2.3 Safari/537.36 326 requests with user_agent.original AppleCoreMedia/1.0.0.23A344 (Macintosh; U; Intel Mac OS X 14_0; da_dk) 326 requests with user_agent.original Mozilla/5.0 (Linux; Android 13; SAMSUNG SM-T220) AppleWebKit/537.36 (KHTML, like Gecko) SamsungBrowser/23.0 Chrome/115.0.0.0 Mobile Safari/537.36 326 requests with user_agent.original Mozilla/5.0 (X11; Linux x86_64; SMARTEMB Build/3.12.9076) AppleWebKit/537.36 (KHTML, like Gecko) Chromium/103.0.5060.129 Chrome/103.0.5060.129 Safari/537.36 324 requests with user_agent.original Mozil show less	Brute-Force Bad Web Bot
Anonymous	2025-11-02 04:30:42 UTC · (1 year ago)	Failed login attempt detected by Fail2Ban in plesk-postfix jail	Brute-Force
🇫🇷 SpaceHost-Server	2025-11-02 01:03:19 UTC · (1 year ago)	Nov 2 02:03:18 pegasus postfix/smtpd[2791262]: warning: unknown[158.173.23.23]: SASL LOGIN authentication failed: authentication failure, [email protected] Nov 2 02:03:18 pegasus postfix/smtpd[2793269]: warning: unknown[158.173.23 ... show more Nov 2 02:03:18 pegasus postfix/smtpd[2791262]: warning: unknown[158.173.23.23]: SASL LOGIN authentication failed: authentication failure, [email protected] Nov 2 02:03:18 pegasus postfix/smtpd[2793269]: warning: unknown[158.173.23.23]: SASL LOGIN authentication failed: authentication failure, [email protected] Nov 2 02:03:18 pegasus postfix/smtpd[2793270]: warning: unknown[158.173.23.23]: SASL LOGIN authentication failed: authentication failure, [email protected] show less	Hacking Brute-Force

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown

Recently Reported IPs:

🇳🇱 213.209.159.210

🇩🇰 158.173.74.33

🇺🇸 143.42.164.97

🇷🇴 80.94.92.55

🇮🇶 65.20.134.110

🇲🇽 38.226.48.37

🇮🇷 217.218.252.197

🇮🇶 217.142.31.165

🇧🇴 179.60.175.127

🇺🇸 172.202.106.160

🇺🇸 162.216.150.43

🇮🇳 106.51.205.147

🇩🇿 105.105.118.161

🇺🇸 51.8.102.182

🇸🇬 47.82.11.74

🇮🇩 36.81.66.22

🇬🇧 35.203.210.145

🇭🇰 223.197.146.179

🇱🇰 220.247.224.226

🇮🇶 204.157.182.52