JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 158.173.74.131

158.173.74.131 was found in our database!

This IP was reported 39 times. Confidence of Abuse is 85%: ?

85%

ISP	VPN Consumer Copenhagen, Denmark
Usage Type	Data Center/Web Hosting/Transit
ASN	AS42708
Domain Name	vpnconsumer.com
Country	🇩🇰 Denmark
City	Copenhagen, Capital Region

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 158.173.74.131

Whois 158.173.74.131

IP Abuse Reports for 158.173.74.131:

This IP address has been reported a total of 39 times from 30 distinct sources. 158.173.74.131 was first reported on April 16th 2026, and the most recent report was 4 days ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇲🇽 octageeks.com	2026-06-23 04:08:35 (4 days ago)	Wordpress malicious attack:[octawp]	Web App Attack
🇨🇦 KIsmay	2026-06-22 07:58:51 (5 days ago)	Jun 22 03:58:11 www4 WPAudit[2787376]: 158.173.74.131 www.terencegower.com "Mozilla/5.0 (Windows NT ... show more Jun 22 03:58:11 www4 WPAudit[2787376]: 158.173.74.131 www.terencegower.com "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36" nora85:pass123 FAIL Jun 22 03:58:15 www4 WPAudit[2787382]: 158.173.74.131 www.terencegower.com "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36" nora85:qwert12345 FAIL Jun 22 03:58:20 www4 WPAudit[2787381]: 158.173.74.131 www.terencegower.com "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36" nora85:Qweqwe123! FAIL Jun 22 03:58:22 www4 WPAudit[2787380]: 158.173.74.131 www.terencegower.com "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36" nora85:l0g1n FAIL Jun 22 03:58:50 www4 WPAudit[2787376]: 158.173.74.131 www.terencegower.com "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chr ... show less	Brute-Force Web App Attack
🇺🇸 TPI-Abuse	2026-06-22 06:39:47 (5 days ago)	(mod_security) mod_security (id:240335) triggered by 158.173.74.131 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:240335) triggered by 158.173.74.131 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jun 22 02:39:43.071413 2026] [security2:error] [pid 25548:tid 25548] [client 158.173.74.131:41717] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 158.173.74.131 (+1 hits since last alert)\|www.airdriedrivingschool.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "www.airdriedrivingschool.com"] [uri "/xmlrpc.php"] [unique_id "ajjYr3-LhxIeGPpUjHSAcAAAAAE"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 integrantservices.com	2026-06-21 09:28:09 (5 days ago)	(wordpress) Failed wordpress login from 158.173.74.131 (DK/Denmark/-)	Brute-Force
Anonymous	2026-06-20 21:57:08 (6 days ago)	Fail2ban Nginx log integration.	Brute-Force SSH Port Scan
Anonymous	2026-06-20 15:52:12 (6 days ago)	Reported from Nginx log analysis 11. Log: 158.173.74.131 - - [20/Jun/2026:xx:xx:xx 0200] "GET /live ... show more Reported from Nginx log analysis 11. Log: 158.173.74.131 - - [20/Jun/2026:xx:xx:xx 0200] "GET /live/TCvkvDshNVDZ/uRUQQRxRRmYX/259.ts?token=HxMOU0pbQ1sSBQBaA1cAU1FUUQhUAFdTBwAIAQVSBwBRBl8DCAcAUQdDTxoVRRNSB1s6WVURWQVUCB0UQRJUSjtYAhADEVNTBFlBFERFCFoDFF8BBgtSDlcFAQ8FTRNIDVVECBsBUVQDUVENRB1DUh5CAEJfUg9oBVRHX1cEEwIKRApeFREOD28FBlUHXwUVXBRUEh0RCkQREwsUcw1Uaz1iRnN7EU1DUggXSgdFBBVcFFAHBgNBG0NSXkNaFUNBRgtEfHURTUNVGRddCEIIWAgUXxJFQEEbQ1hCaUYEQkwWVAdfXEFDWxJRQRREXABPOVUKXl9WAEMIXl9FFlsTCkYdRF9WXQgVXxM8SA9VQw1EBFUFAgNSD0NM HTTP/2.0" xxx xxx "-" "SparkleTV(Plus)/2.0.1 (SHIELD Android TV, Android 11)" "-" "DK Denmark Copenhagen" "AS42708" "Glesys AB" show less	Port Scan Brute-Force SSH
🇦🇺 oncord	2026-06-15 18:57:02 (1 week ago)	Form spam	Web Spam
Anonymous	2026-06-14 21:57:09 (1 week ago)	Fail2ban Nginx log integration.	Brute-Force SSH Port Scan
🇩🇪 BestFans.com	2026-06-13 17:08:17 (1 week ago)	Credential brute-force attacks on webpage logins	Brute-Force
Anonymous	2026-06-11 15:57:07 (2 weeks ago)	Fail2ban Nginx log integration.	Brute-Force SSH Port Scan
Anonymous	2026-06-09 21:53:07 (2 weeks ago)	Reported from Nginx log analysis 17. Log: 158.173.74.131 - - [09/Jun/2026:xx:xx:xx 0200] "GET /live ... show more Reported from Nginx log analysis 17. Log: 158.173.74.131 - - [09/Jun/2026:xx:xx:xx 0200] "GET /live/dgBpg4XTncmE/wDxePeqExnQ5/17.ts?token=TEAKBBFbQFsVUwBQUABQD1cBD1UAVAMABAQHAAtWCgdSV1MBVFFVUQNAHEMQF0BcUghoDFYTCwdWHEMXQFZAOl4GQF9AAldUAkAcQxcKX1wRXwZSCgABBVMEVFEfEUIMU0BYR1ECUlcGUAJDT0FXQUcARQtTXW5SBEYIAVYRCAtCDg5JQFwMPlMHXQANBxADEVQVSRBYQkZDCkMlX1ZhPGRCIydAH0ADXhZCABcGEAMRUQJTBxMdFAJfFAxHQUtHDUAsKUAfQARPFlUPEApdVxFfFRFBEx0UCEM EFZARhdSAw8AEBFYQwdAHEMOAkpmUApZC1dSRV8OXhJACREARxtADwoMWhYORT1ACAdBCBsAVAdTAwAJFBw= HTTP/2.0" xxx xxx "-" "SparkleTV(Plus)/2.0.1 (LEAP-S1, Android 14)" "-" "DK Denmark Copenhagen" "AS42708" "Glesys AB" show less	Port Scan Brute-Force SSH
🇬🇧 consul.to	2026-06-05 20:40:55 (3 weeks ago)	Web attack/malicious scanning detected	Web App Attack
🇺🇸 tedmichalik.com	2026-06-03 18:22:21 (3 weeks ago)	158.173.74.131 - - [03/Jun/2026:14:22:11 -0400] "GET /?author=10 HTTP/1.1" 200 9357 "-" "Mozilla/5.0 ... show more 158.173.74.131 - - [03/Jun/2026:14:22:11 -0400] "GET /?author=10 HTTP/1.1" 200 9357 "-" "Mozilla/5.0 (iPhone; CPU iPhone OS 17_2 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.2 Mobile/15E148 Safari/604.1" ... show less	Web App Attack
🇩🇪 BlueWire Hosting	2026-06-02 12:20:17 (3 weeks ago)	Probing websites for vulnerabilities	Web App Attack SQL Injection
🇩🇪 pscriptos	2026-06-02 10:00:23 (3 weeks ago)	{"ClientAddr":"158.173.74.131:43867","ClientHost":"158.173.74.131","ClientPort":"43867","ClientUsern ... show more {"ClientAddr":"158.173.74.131:43867","ClientHost":"158.173.74.131","ClientPort":"43867","ClientUsername":"-","DownstreamContentSize":418,"DownstreamStatus":403,"Duration":418923325,"OriginContentSize":418,"OriginDuration":406043676,"OriginStatus":403,"Overhead":12879649,"RequestAddr":"www.cleveradmin.de","RequestContentSize":187,"RequestCount":1074718,"RequestHost":"www.cleveradmin.de","RequestMethod":"POST","RequestPath":"/xmlrpc.php","RequestPort":"-","RequestProtocol":"HTTP/1.1","RequestScheme":"https","RetryAttempts":0,"RouterName":"cleveradmin-www-websecure@file","ServiceAddr":"172.16.80.10:80","ServiceName":"cleveradmin-www@file","ServiceURL":"http://172.16.80.10:80","StartLocal":"2026-06-02T12:00:15.623204247+02:00","StartUTC":"2026-06-02T10:00:15.623204247Z","TLSCipher":"TLS_AES_128_GCM_SHA256","TLSVersion":"1.3","entryPointName":"websecure","level":"info","msg":"","time":"2026-06-02T12:00:16+02:00"} {"ClientAddr":"158.173.74.131:43867","ClientHost":"158.173.74.131","ClientPort ... show less	Brute-Force Web App Attack

Showing 1 to 15 of 39 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇺🇸 162.216.150.68

🇺🇸 162.216.149.91

🇩🇪 139.19.117.131

🇨🇳 106.13.56.235

🇧🇩 103.213.220.14

🇮🇳 103.159.85.123

🇵🇱 87.251.64.145

🇫🇷 85.217.140.47

🇱🇻 81.30.98.49

🇳🇱 45.148.10.141

🇸🇬 45.78.198.199

🇩🇪 5.83.136.39

🇬🇧 2a06:4880:8000::b5

🇺🇸 209.141.47.217

🇩🇪 194.187.176.251

🇮🇩 182.4.135.111

🇺🇸 162.216.149.207

🇰🇭 117.20.119.70

🇺🇸 100.56.198.86

🇧🇾 81.30.98.142