JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 195.158.3.254

195.158.3.254 was found in our database!

This IP was reported 14 times. Confidence of Abuse is 36%: ?

36%

ISP	Uzbektelekom Joint Stock Company
Usage Type	Fixed Line ISP
ASN	AS8193
Domain Name	bkm.uz
Country	🇺🇿 Uzbekistan
City	Tashkent, Tashkent

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 195.158.3.254

Whois 195.158.3.254

IP Abuse Reports for 195.158.3.254:

This IP address has been reported a total of 14 times from 13 distinct sources. 195.158.3.254 was first reported on November 23rd 2022, and the most recent report was 1 day ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇫🇮 as211431.net	2026-07-04 22:38:45 (1 day ago)	Triggered Cloudflare WAF (firewallCustom) from UZ. Action taken: MANAGED_CHALLENGE Protocol: HTTP/1. ... show more Triggered Cloudflare WAF (firewallCustom) from UZ. Action taken: MANAGED_CHALLENGE Protocol: HTTP/1.1 (POST method) Endpoint: /xmlrpc.php UA: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7; x86) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.0.0 Safari/537.36 This report was generated by: https://github.com/sefinek/Cloudflare-WAF-To-AbuseIPDB show less	Bad Web Bot
🇳🇱 ipoac.nl	2026-07-04 22:37:26 (1 day ago)	-:443 195.158.3.254 - - [05/Jul/2026:00:37:25 +0200] - "POST /xmlrpc.php HTTP/1.1" 403 6582 "-" "Moz ... show more -:443 195.158.3.254 - - [05/Jul/2026:00:37:25 +0200] - "POST /xmlrpc.php HTTP/1.1" 403 6582 "-" "Mozilla/5.0 (Windows NT 6.3; x86) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.0.0 Safari/537.36" show less	Bad Web Bot
🇬🇧 Smish	2026-07-04 22:37:19 (1 day ago)	HONEYPOT HIT --> Fail2ban time=1783204638 log=2026-07-04T23:37:18+01:00 ip=195.158.3.254 host=as2106 ... show more HONEYPOT HIT --> Fail2ban time=1783204638 log=2026-07-04T23:37:18+01:00 ip=195.158.3.254 host=as210667.net method=POST uri="/xmlrpc.php" status=404 ua="Mozilla/5.0 (Windows NT 10.0; arm64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.0.0 Safari/537.36" ref="-" rid=60483fbf1d991ae6e86782df58658c58 show less	Web App Attack
🇳🇱 wlt-blocker	2026-07-04 13:53:27 (2 days ago)	Unauthorized access to webpage admin	Web App Attack
🇺🇸 TPI-Abuse	2026-06-30 20:07:57 (5 days ago)	(mod_security) mod_security (id:225170) triggered by 195.158.3.254 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:225170) triggered by 195.158.3.254 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jun 30 16:07:50.922688 2026] [security2:error] [pid 10765:tid 10765] [client 195.158.3.254:64266] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)\|\|portlunchgroup.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "portlunchgroup.com"] [uri "/wp-json/wp/v2/users"] [unique_id "akQiFgPR9P0pavcwjD6hAwAAABY"] show less	Brute-Force Bad Web Bot Web App Attack
🇪🇸 10dencehispahard SL	2026-01-26 09:17:30 (5 months ago)	Wordpress probing for vulnerabilities	Hacking Exploited Host
Anonymous	2023-12-03 23:46:37 (2 years ago)	Fail2Ban - Postfix SMTP Reject - Auth Failure	Email Spam Brute-Force
🇯🇵 Kinsei Engineering Inc.	2023-11-16 07:41:57 (2 years ago)	Postfix,Possible SPAM, Postscreen, Received incorrect commands at a high frequency.	Email Spam Brute-Force
🇷🇸 Smel	2023-11-04 07:36:00 (2 years ago)	Mail/25/465/587-993/995 Probe, Reject, BadAuth, Hack, SPAM -	Email Spam Hacking Brute-Force
🇮🇩 hermawan	2023-10-17 09:18:53 (2 years ago)	[Tue Oct 17 16:18:51.703752 2023] [security2:error] [pid 84905:tid 139744643950144] [client 195.158. ... show more [Tue Oct 17 16:18:51.703752 2023] [security2:error] [pid 84905:tid 139744643950144] [client 195.158.3.254:52495] [client 195.158.3.254] ModSecurity: Access denied with code 403 (phase 1). Match of "pm www.google.com myactivity.google.com applebot iPhone bingbot https://yandex.com/ https://www.google.com.tw sih3.dpuair.jatimprov.go.id duckduckgo.com neeva.com mail.google.com dpuair.jatimprov.go.id facebookbot https://www.ecosia.org/ https://duckduck ..." against "REQUEST_HEADERS:Referer" required. [file "/etc/modsecurity/coreruleset-3.3.5/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "59"] [id "440067"] [msg "BAD Referer"] [data "Matched Data: staklim-jatim.bmkg.go.id found within REQUEST_HEADERS:Referer: https://yandex.ru/images/search?from=tabbar&img_url=https%3A%2F%2Fanba.com.br%2Fwp-content%2Fuploads%2F2019%2F06%2Ffoiz.jpg&lr=189648&pos=11&rpt=simage&text=%D1%84%D1%83%D0%B4%D0%B6%D0%B5%D0%B9%D1%80%D0%B0%D1%84%D1%80%D0%B8%20%D0%B7%D0%BE%D0%BD%D0%B0%202023 request_line = GET /i ... show less	Hacking Web App Attack
🇦🇺 Bay13	2023-09-12 22:28:15 (2 years ago)	f2b mail	Email Spam Spoofing
🇨🇦 George Horton	2023-08-03 14:08:00 (2 years ago)	Source IP is spoofing, and phishing using unauthorized sender	Phishing Email Spam Spoofing
🇨🇦 George Horton	2023-08-03 14:08:00 (2 years ago)	Source IP is spoofing, and phishing using unauthorized sender	Phishing Email Spam Spoofing
🇩🇪 vereinshosting	2022-11-23 00:21:36 (3 years ago)	SPAM email (score: 26.312476)	Email Spam

Showing 1 to 14 of 14 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇮🇳 223.233.83.180

🇩🇪 134.122.93.100

🇨🇳 124.222.193.171

🇺🇬 154.72.196.195

🇻🇳 113.161.222.150

🇮🇳 103.248.120.6

🇺🇸 44.242.145.112

🇺🇸 44.193.97.208

🇺🇸 2.56.75.152

🇺🇿 213.230.92.196

🇺🇸 66.132.172.239

🇫🇷 51.159.110.167

🇳🇱 45.148.10.67

🇺🇸 44.203.94.237

🇷🇺 37.77.105.76

🇭🇰 20.205.37.29

🇩🇪 167.94.146.73

🇷🇺 154.90.70.254

🇮🇩 124.40.252.3

🇲🇾 121.122.119.214