JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

162.158.95.215

Neutral Activity Whitelisted Subnet

Abuse Confidence Score

0% Low Risk

162 reports

52 reporters · latest 4 days ago

162.158.95.215 is an IP address from within our whitelist belonging to the subnet 162.158.0.0/15, which we identify as "Cloudflare Reverse Proxy".

ISP: Cloudflare, Inc.
Usage Type: Data Center/Web Hosting/Transit
ASN: AS13335
Domain Name: cloudflare.com
Country: 🇩🇪 Germany
City: Frankfurt am Main, Hesse

ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report Whois

Example preview

Account required for the enhanced features Log in Sign up

Abuse Reports

Export reports CSV

Total reports

162 from 52 distinct reporters

First reported

November 19th 2023

Most recent report

4 days ago

Last 60 days

Top reporter locations 🇩🇪 Germany 4 🇧🇪 Belgium 2 🇹🇷 Turkey 2

Most common categories Web App Attack 8 Brute-Force 2 Hacking 2 Port Scan 2 DDoS Attack 1

Recent reports We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
Anonymous	2026-10-24 07:29:49 (4 days ago)	{"reqId":"3dXkRzUeq3spwyTwLhDT","level":1,"time":"2026-10-24T09:29:48+02:00","remoteAddr":"162.158.95.215","user":"--","app":"core","method":"GET","url":"/login.php","scriptName":"/index.php","message":"Trusted domain error. \"162.158.95.215\" tried ... show more {"reqId":"3dXkRzUeq3spwyTwLhDT","level":1,"time":"2026-10-24T09:29:48+02:00","remoteAddr":"162.158.95.215","user":"--","app":"core","method":"GET","url":"/login.php","scriptName":"/index.php","message":"Trusted domain error. \"162.158.95.215\" tried to access using \"proxy.khomri.com\" as host.","userAgent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.3 Safari/605.1.15","version":"35.0.2.2","data":{"app":"core"}} {"reqId":"uRzfHCj85RTccY0L8Lwm","level":1,"time":"2026-10-24T09:29:48+02:00","remoteAddr":"162.158.95.215","user":"--","app":"core","method":"GET","url":"/index.php","scriptName":"/index.php","message":"Trusted domain error. \"162.158.95.215\" tried to access using \"proxy.khomri.com\" as host.","userAgent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.3 Safari/605.1.15","version":"35.0.2.2","data":{"app":"core"}} {"reqId":"PqkDtKtwokOq4lviPkFF","level":1,"time":"2026 ... show less	Web App Attack
🇺🇸 dot.mg	2026-10-23 17:21:13 (5 days ago)	Scan of vulnerable files	Web App Attack
🇧🇪 madeit	2026-10-21 17:34:27 (1 week ago)		Web App Attack
🇺🇸 TPI-Abuse	2026-10-18 11:32:29 (1 week ago)	(mod_security) mod_security (id:210730) triggered by 162.158.95.215 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Oct 18 07:32:25.875352 2026] [security2:error] [pid 25549:tid 25549] [client 162.158.95.215:9234] ... show more (mod_security) mod_security (id:210730) triggered by 162.158.95.215 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Oct 18 07:32:25.875352 2026] [security2:error] [pid 25549:tid 25549] [client 162.158.95.215:9234] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy\|\|astariaentertainment.com\|F\|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "astariaentertainment.com"] [uri "/astariaentertainment.sql"] [unique_id "atSuSZDt4qIc4aG4IGKl7gAAAAc"] show less	Brute-Force Bad Web Bot Web App Attack
🇮🇪 eyesilyurt	2026-10-18 01:15:30 (1 week ago)	p- login authenticator failed Incorrect authentication data	Brute-Force SSH
🇹🇷 crnpekgoz	2026-10-15 14:54:41 (1 week ago)	Malicious HTTP GET request for '/config.json' (HTTP 301) from 162.158.95.215. Threat: Web Güvenlik Açığı Taraması (.env/bot). Blocked by WardenGuard Web Shield.	Web App Attack
🇧🇪 madeit	2026-10-01 15:24:58 (3 weeks ago)		Web App Attack
Anonymous	2026-09-28 18:29:01 (1 month ago)	Web scanner: GET /.env.production.local	Web App Attack Hacking
🇩🇪 updown.io	2026-09-21 22:28:39 (1 month ago)	{"level":"info","ts":1790026420.5578897,"logger":"http.log.access.log1","msg":"handled request","request":{"remote_ip":"162.158.95.215","remote_port":"10098","client_ip":"127.0.0.1","proto":"HTTP/2.0","method":"GET","host":"status.rosua.org","uri":"/ ... show more {"level":"info","ts":1790026420.5578897,"logger":"http.log.access.log1","msg":"handled request","request":{"remote_ip":"162.158.95.215","remote_port":"10098","client_ip":"127.0.0.1","proto":"HTTP/2.0","method":"GET","host":"status.rosua.org","uri":"/lara/%2eenv","headers":{"Cf-Visitor":["{\"scheme\":\"https\"}"],"Cf-Ray":["a3ec30885b2b6f9a-FRA"],"Accept-Encoding":["gzip, br"],"X-Forwared":["127.0.0.1"],"User-Agent":["curl/8.7.1"],"X-Azure-Clientip":["127.0.0.1"],"Cdn-Loop":["cloudflare; loops=1"],"Cf-Ipcountry":["FR"],"Cf-Connecting-Ip":["185.177.72.23"],"X-Client-Ip":["127.0.0.1"],"X-Originating-Ip":["127.0.0.1"],"Accept":["/"],"True-Client-Ip":["127.0.0.1"],"Accept-Language":["en-US,en;q=0.9"],"X-Forwarded-For":["127.0.0.1,185.177.72.23"],"X-Azure-Socketip":["127.0.0.1"],"X-Forwarded-Proto":["https"],"X-Host":["127.0.0.1"]},"tls":{"resumed":false,"version":772,"cipher_suite":4865,"proto":"h2","server_name":"status.rosua.org","ech":false}},"bytes_read":0,"user_id":"","duration":0.01 ... show less	DDoS Attack Web App Attack
🇹🇷 muratkaya665	2026-09-17 19:36:34 (1 month ago)	IPS Attack Blocked by server.mura******.com.tr Fortigate-80E. Attack Name: Langflow.validate_code.Remote.Code.Execution. Dest Port: 80. Service: HTTP. Message: applications3: Langflow.validate_code.Remote.Code.Execution.	Hacking
Anonymous	2026-09-08 12:26:16 (1 month ago)	Blocked by firewall on hugin [8443/tcp] \| Rule: UFW \| SPT: 22181 \| TTL: 57 \| LEN: 60 \| TOS: 0x00 • Reported by: github.com/sefinek/UFW-AbuseIPDB-Reporter	Port Scan
Anonymous	2026-09-03 12:07:46 (1 month ago)	Blocked by firewall on hugin [8443/tcp] \| Rule: UFW \| SPT: 22776 \| TTL: 57 \| LEN: 60 \| TOS: 0x00 • Reported by: github.com/sefinek/UFW-AbuseIPDB-Reporter	Port Scan
🇧🇪 madeit	2026-08-22 23:41:29 (2 months ago)		Web App Attack
🇺🇸 TPI-Abuse	2026-08-10 21:08:12 (2 months ago)	(mod_security) mod_security (id:210492) triggered by 162.158.95.215 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Aug 10 17:08:02.183430 2026] [security2:error] [pid 918160:tid 918205] [client 162.158.95.215:9564 ... show more (mod_security) mod_security (id:210492) triggered by 162.158.95.215 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Aug 10 17:08:02.183430 2026] [security2:error] [pid 918160:tid 918205] [client 162.158.95.215:9564] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "certifiedwealthmanager.com"] [uri "/.env"] [unique_id "ano9sj2BMAfWvfCi4JFJ1wAAAdg"] show less	Brute-Force Bad Web Bot Web App Attack
🇧🇪 madeit	2026-08-07 06:25:37 (2 months ago)		Web App Attack

Showing 1 to 15 of 162 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown

Recently Reported IPs:

🇷🇴 193.32.162.84

🇨🇭 179.43.139.58

🇺🇸 20.65.178.121

🇺🇸 199.96.167.187

🇮🇩 69.5.7.218

🇮🇳 59.90.111.74

🇺🇸 50.116.58.253

🇭🇰 47.86.16.203

🇺🇸 20.83.59.254

🇫🇮 13.140.81.107

🇺🇸 2600:1f18:5b75:b802:7d45:4a70:8861:e11

🇨🇳 2407:c080:1400:2e:4b53:aacc:38fc:646d

🇨🇳 221.0.10.186

🇧🇷 177.104.203.174

🇸🇪 165.231.143.109

🇫🇮 155.212.36.105

🇨🇳 115.190.213.206

🇺🇸 64.227.15.156

🇺🇸 47.201.84.125

🇰🇷 220.122.115.9