AbuseIPDB » 195.176.3.23

195.176.3.23 was found in our database!

This IP was reported 2,471 times. Confidence of Abuse is 97%: ?

97%

This address is a Tor exit node. Neither the owner nor the provider are directly behind the offending action.

ISP	Switch
Usage Type	Data Center/Web Hosting/Transit
Hostname(s)	tor5e1.digitale-gesellschaft.ch
Domain Name	switch.ch
Country	Switzerland
City	Basel, Basel-Stadt

IP info including ISP, Usage Type, and Location provided by IP2Location. Updated monthly.

Report 195.176.3.23

Whois 195.176.3.23

IP Abuse Reports for 195.176.3.23:

This IP address has been reported a total of 2,471 times from 298 distinct sources. 195.176.3.23 was first reported on November 22nd 2020, and the most recent report was 11 hours ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp	Comment	Categories
plzenskypruvodce.cz	2023-12-04 16:06:37 (11 hours ago)	[Mon Dec 04 17:06:36.310364 2023] [access_compat:error] [pid 717158:tid 140583884490496] [client 195 ... show more[Mon Dec 04 17:06:36.310364 2023] [access_compat:error] [pid 717158:tid 140583884490496] [client 195.176.3.23:60428] AH01797: client denied by server configuration: /var/www/tzb-chmelarova.cz/www/xmlrpc.php [Mon Dec 04 17:06:36.529892 2023] [access_compat:error] [pid 717158:tid 140584094111488] [client 195.176.3.23:60428] AH01797: client denied by server configuration: /var/www/tzb-chmelarova.cz/www/xmlrpc.php ... show less	Web App Attack
Anonymous	2023-12-04 14:09:05 (13 hours ago)	RDP brute force attack.	Port Scan Brute-Force
niceshops.com	2023-12-04 10:49:24 (16 hours ago)	Web Attack multi (Dec 23 11:49:23 Matching rules: Detect possible SQL injection - Too many SQL keyw ... show moreWeb Attack multi (Dec 23 11:49:23 Matching rules: Detect possible SQL injection - Too many SQL keywords (more than 3 times),Detect possible SQL injection - E.g. Select * from ) show less	SQL Injection Brute-Force Bad Web Bot Web App Attack
niceshops.com	2023-12-03 22:17:39 (1 day ago)	Web Attack multi (Dec 23 23:17:38 Matching rules: Detect possible SQL injection - E.g. CHR(72),Dete ... show moreWeb Attack multi (Dec 23 23:17:38 Matching rules: Detect possible SQL injection - E.g. CHR(72),Detect possible SQL injection - E.g. Select * from ) show less	SQL Injection Brute-Force Bad Web Bot Web App Attack
karger	2023-12-03 04:50:18 (1 day ago)	Wordpress attack - soft filter	Brute-Force Web App Attack
Anonymous	2023-12-02 10:32:32 (2 days ago)	Bot / scanning and/or hacking attempts: POST /wp-login.php HTTP/1.1, GET /wp-login.php HTTP/1.1	Hacking Web App Attack
TPI-Abuse	2023-12-01 21:03:17 (3 days ago)	(mod_security) mod_security (id:210492) triggered by 195.176.3.23 (tor5e1.digitale-gesellschaft.ch): ... show more(mod_security) mod_security (id:210492) triggered by 195.176.3.23 (tor5e1.digitale-gesellschaft.ch): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Dec 01 16:03:10.639391 2023] [security2:error] [pid 3915428] [client 195.176.3.23:45304] [client 195.176.3.23] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "roughexports.com"] [uri "/wp-content/plugins/cip4-folder-download-widget/cip4-download.php"] [unique_id "ZWpKDngI78sjB-JX7WmebQAAAAY"] show less	Brute-Force Bad Web Bot Web App Attack
Rizzy	2023-12-01 07:52:52 (3 days ago)	Multiple WAF Violations	Brute-Force Web App Attack
niceshops.com	2023-11-30 20:51:04 (4 days ago)	Web Attack multi (Nov 23 21:51:03 Matching rules: Detect possible SQL injection - Too many SQL keyw ... show moreWeb Attack multi (Nov 23 21:51:03 Matching rules: Detect possible SQL injection - Too many SQL keywords (more than 3 times),Detect possible SQL injection - E.g. CHR(72),Detect possible SQL injection - E.g. Select * from ) show less	SQL Injection Brute-Force Bad Web Bot Web App Attack
Tha_14	2023-11-30 16:51:53 (4 days ago)	Incoming TCP Connection from 195.176.3.23 to port: 554. Honeypot was triggered at 11/30/2023 03:50:5 ... show moreIncoming TCP Connection from 195.176.3.23 to port: 554. Honeypot was triggered at 11/30/2023 03:50:50 PM. show less	Port Scan
Savvii	2023-11-30 08:08:33 (4 days ago)	20 attempts against mh-misbehave-ban on hydra	Brute-Force Bad Web Bot Web App Attack
Savvii	2023-11-30 08:08:32 (4 days ago)	20 attempts against mh_ha-misbehave-ban on hydra	Brute-Force Bad Web Bot Web App Attack
oncord	2023-11-30 05:34:47 (4 days ago)	Form spam	Web Spam
niceshops.com	2023-11-29 21:43:21 (5 days ago)	Web Attack multi (Nov 23 22:43:20 Matching rules: Detect possible SQL injection - E.g. CHR(72) )	SQL Injection Brute-Force Bad Web Bot Web App Attack
Rizzy	2023-11-29 20:02:47 (5 days ago)	Multiple WAF Violations	Brute-Force Web App Attack