JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

162.158.22.29

Neutral Activity Whitelisted Subnet

Abuse Confidence Score

0% Low Risk

57 reports

15 reporters · latest 4 days ago

162.158.22.29 is on our whitelist as Cloudflare Reverse Proxy via the subnet 162.158.0.0/15.

ISP: Cloudflare, Inc.
Usage Type: Data Center/Web Hosting/Transit
ASN: AS13335
Domain Name: cloudflare.com
Country: 🇫🇷 France
City: Marseille, Provence-Alpes-Cote d'Azur

ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report Whois

Example preview

Account required for the enhanced features Log in Sign up

Abuse Reports

Export reports CSV

Total reports

57 from 15 distinct reporters

First reported

July 28th 2021

Most recent report

4 days ago

Last 60 days

Top reporter locations 🇺🇸 United States of America 6 🇩🇪 Germany 4 🇧🇪 Belgium 1

Most common categories Web App Attack 10 Brute-Force 9 Bad Web Bot 7 Hacking 2 SSH 1

Recent reports We have received reports of abusive activity from this IP address within the last week. This IP is on our whitelist as Cloudflare Reverse Proxy. Shared services like this are often reported for traffic that is not abuse, so review the reports before blocking.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇩🇪 abdubhai	2026-11-10 04:47:33 UTC · (4 days ago)	162.158.22.29 - - [10/Nov/2026:0 ...	Brute-Force
🇧🇪 madeit	2026-11-01 12:40:57 UTC · (1 week ago)		Web App Attack
🇧🇷 paradoxnetworks	2026-10-24 05:01:16 UTC · (3 weeks ago)	2026-10-24T05:01:10.276099+00:00 edge-con-sao01.int.pdx.net.uk sshd-session[4110095]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=162.158.22.29 2026-10-24T05:01:12.599577+00:00 edge-con-sao01.int.pdx.net.uk ... show more 2026-10-24T05:01:10.276099+00:00 edge-con-sao01.int.pdx.net.uk sshd-session[4110095]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=162.158.22.29 2026-10-24T05:01:12.599577+00:00 edge-con-sao01.int.pdx.net.uk sshd-session[4110095]: Failed password for invalid user admin from 162.158.22.29 port 63632 ssh2 2026-10-24T05:01:15.459021+00:00 edge-con-sao01.int.pdx.net.uk sshd-session[4110095]: Failed password for invalid user admin from 162.158.22.29 port 63632 ssh2 ... show less	Brute-Force SSH
🇩🇪 abdubhai	2026-10-23 09:29:52 UTC · (3 weeks ago)	162.158.22.29 - - [23/Oct/2026:1 ...	Brute-Force
🇩🇪 altenglaner	2026-10-14 14:44:51 UTC · (4 weeks ago)	Web scanner probing for sensitive files (.env, .git, backups) or path traversal. Reported by fail2ban.	Hacking Web App Attack
🇺🇸 TPI-Abuse	2026-10-13 09:03:59 UTC · (1 month ago)	(mod_security) mod_security (id:210492) triggered by 162.158.22.29 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 13 05:03:48.112946 2026] [security2:error] [pid 22534:tid 22534] [client 162.158.22.29:10011] M ... show more (mod_security) mod_security (id:210492) triggered by 162.158.22.29 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 13 05:03:48.112946 2026] [security2:error] [pid 22534:tid 22534] [client 162.158.22.29:10011] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "chavarri.com"] [uri "/.env.local"] [unique_id "as3z9KhALmRmymuawwkizAAAAAU"] show less	Brute-Force Bad Web Bot Web App Attack
🇩🇪 altenglaner	2026-10-11 03:30:22 UTC · (1 month ago)	Web scanner probing for sensitive files (.env, .git, backups) or path traversal. Reported by fail2ban.	Hacking Web App Attack
🇺🇸 TPI-Abuse	2026-10-11 03:24:27 UTC · (1 month ago)	(mod_security) mod_security (id:210492) triggered by 162.158.22.29 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 10 23:24:14.831550 2026] [security2:error] [pid 18079:tid 18079] [client 162.158.22.29:11248] M ... show more (mod_security) mod_security (id:210492) triggered by 162.158.22.29 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 10 23:24:14.831550 2026] [security2:error] [pid 18079:tid 18079] [client 162.158.22.29:11248] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "mail.halleycpa.com"] [uri "/.env"] [unique_id "assBXtv9pokYQgSogqbe4gAAAA4"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-10-10 16:49:50 UTC · (1 month ago)	(mod_security) mod_security (id:210492) triggered by 162.158.22.29 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 10 12:49:41.936972 2026] [security2:error] [pid 28469:tid 28469] [client 162.158.22.29:10925] M ... show more (mod_security) mod_security (id:210492) triggered by 162.158.22.29 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 10 12:49:41.936972 2026] [security2:error] [pid 28469:tid 28469] [client 162.158.22.29:10925] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "kronrod.com"] [uri "/.env.local"] [unique_id "aspspReGwghoVfp81oa0TgAAAAI"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-10-10 07:39:15 UTC · (1 month ago)	(mod_security) mod_security (id:210492) triggered by 162.158.22.29 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 10 03:39:09.209253 2026] [security2:error] [pid 2573:tid 2582] [client 162.158.22.29:10354] Mod ... show more (mod_security) mod_security (id:210492) triggered by 162.158.22.29 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 10 03:39:09.209253 2026] [security2:error] [pid 2573:tid 2582] [client 162.158.22.29:10354] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "curubin.com"] [uri "/.env.local"] [unique_id "asnrnfc2lMJkylfz3XkGqwAAAIc"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇦 URAN Publishing Service	2026-10-10 00:56:36 UTC · (1 month ago)	[10/Oct/2026:03:56:35 +0300] -- 162.158.22.29 Ban reason: Scanner [SENSITIVE_FILES] \| Request: GET /.docker/config.json HTTP/1.1	Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-10-09 10:14:30 UTC · (1 month ago)	(mod_security) mod_security (id:210492) triggered by 162.158.22.29 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 09 06:14:07.875890 2026] [security2:error] [pid 24395:tid 24395] [client 162.158.22.29:9560] Mo ... show more (mod_security) mod_security (id:210492) triggered by 162.158.22.29 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 09 06:14:07.875890 2026] [security2:error] [pid 24395:tid 24395] [client 162.158.22.29:9560] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "thomaschemical.net"] [uri "/.env.backup"] [unique_id "asi-bw4uPM3nK5v7-XMH8AAAABo"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-10-09 01:49:10 UTC · (1 month ago)	(mod_security) mod_security (id:210492) triggered by 162.158.22.29 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 08 21:49:00.993453 2026] [security2:error] [pid 24652:tid 24652] [client 162.158.22.29:10347] M ... show more (mod_security) mod_security (id:210492) triggered by 162.158.22.29 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 08 21:49:00.993453 2026] [security2:error] [pid 24652:tid 24652] [client 162.158.22.29:10347] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "myouenji.ichi51e.net"] [uri "/wp-config.php.bak"] [unique_id "ashIDOxPB93YPaday9teoAAAAAM"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 MPL	2026-07-30 07:27:02 UTC · (3 months ago)	tcp/443 (10 or more attempts)	Port Scan
🇯🇵 Kinsei Engineering Inc.	2026-03-20 06:30:19 UTC · (7 months ago)	UFW:High-frequency access to unused ports	Port Scan

Showing 1 to 15 of 57 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown

Recently Reported IPs:

🇦🇿 216.147.123.216

🇸🇬 145.223.146.89

🇧🇩 103.112.131.46

🇷🇴 92.118.39.75

🇻🇳 27.64.93.98

🇨🇳 222.210.35.197

🇦🇲 217.113.7.142

🇨🇳 202.100.41.30

🇧🇧 196.3.215.142

🇬🇧 193.163.125.180

🇹🇭 172.68.241.23

🇨🇳 116.231.241.38

🇸🇬 104.28.160.165

🇳🇬 102.220.45.186

🇷🇺 94.190.80.16

🇨🇦 85.217.149.22

🇦🇱 79.106.127.75

🇺🇸 66.132.172.183

🇳🇱 45.156.128.156

🇧🇾 37.214.22.213