JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 213.95.149.22

213.95.149.22 was found in our database!

This IP was reported 526 times. Confidence of Abuse is 19%: ?

19%

This address is a Tor exit node. Neither the owner nor the provider are directly behind the offending action.

ISP	noris network AG
Usage Type	Data Center/Web Hosting/Transit
ASN	AS12337
Hostname(s)	tor.m-u.xyz
Domain Name	noris.de
Country	🇩🇪 Germany
City	Nurnberg, Bavaria

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 213.95.149.22

Whois 213.95.149.22

IP Abuse Reports for 213.95.149.22:

This IP address has been reported a total of 526 times from 130 distinct sources. 213.95.149.22 was first reported on November 30th 2020, and the most recent report was 2 weeks ago.

Old Reports: The most recent abuse report for this IP address is from 2 weeks ago . It is possible that this IP is no longer involved in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇦🇺 oncord	2026-05-19 10:17:06 (2 weeks ago)	Form spam	Web Spam
Anonymous	2026-05-06 04:02:59 (1 month ago)	2026-05-05 19:00:30,702 fail2ban.actions [3625835]: NOTICE [tor] Ban 213.95.149.22 2026-05-0 ... show more 2026-05-05 19:00:30,702 fail2ban.actions [3625835]: NOTICE [tor] Ban 213.95.149.22 2026-05-05 22:00:28,065 fail2ban.actions [3625835]: NOTICE [tor] Ban 213.95.149.22 2026-05-06 01:00:27,635 fail2ban.actions [3625835]: NOTICE [tor] Ban 213.95.149.22 2026-05-06 04:00:36,180 fail2ban.actions [3625835]: NOTICE [tor] Ban 213.95.149.22 2026-05-06 07:02:58,122 fail2ban.actions [3625835]: NOTICE [tor] Ban 213.95.149.22 show less	Brute-Force
Anonymous	2026-04-24 21:03:09 (1 month ago)	2026-04-24 12:00:31,069 fail2ban.actions [7718]: NOTICE [tor] Ban 213.95.149.22 2026-04-24 1 ... show more 2026-04-24 12:00:31,069 fail2ban.actions [7718]: NOTICE [tor] Ban 213.95.149.22 2026-04-24 15:00:29,210 fail2ban.actions [7718]: NOTICE [tor] Ban 213.95.149.22 2026-04-24 18:00:31,022 fail2ban.actions [7718]: NOTICE [tor] Ban 213.95.149.22 2026-04-24 21:00:40,111 fail2ban.actions [7718]: NOTICE [tor] Ban 213.95.149.22 2026-04-25 00:03:08,670 fail2ban.actions [7718]: NOTICE [tor] Ban 213.95.149.22 show less	Brute-Force
🇺🇸 ipblock.com	2026-04-24 15:24:00 (1 month ago)	IPBlock protected site ID [3717-sec]. Robotic site crawling, undeclared spider	Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-04-16 14:58:39 (1 month ago)	(mod_security) mod_security (id:210492) triggered by 213.95.149.22 (tor.m-u.xyz): 1 in the last 300 ... show more (mod_security) mod_security (id:210492) triggered by 213.95.149.22 (tor.m-u.xyz): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Apr 16 10:58:35.475207 2026] [security2:error] [pid 31391:tid 31391] [client 213.95.149.22:38580] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.gcdata.wisdomwfm.com"] [uri "/.git/config"] [unique_id "aeD5Gx83ig14se8A1kMFyQAAAA4"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 xmission.com	2026-04-08 11:32:28 (1 month ago)	Blocked by UFW (TCP on 1) Source port: 54920 TTL: 45 Packet length: 60 TOS: 0x08 This report (for 2 ... show more Blocked by UFW (TCP on 1) Source port: 54920 TTL: 45 Packet length: 60 TOS: 0x08 This report (for 213.95.149.22) was generated by: https://github.com/sefinek/UFW-AbuseIPDB-Reporter show less	Port Scan
🇩🇪 NoaQT	2026-04-05 15:58:59 (2 months ago)	213.95.149.22 - - [05/Apr/2026:17:58:57 +0200] "GET /web/login HTTP/1.1" 499 0 "https://social.ca/ho ... show more 213.95.149.22 - - [05/Apr/2026:17:58:57 +0200] "GET /web/login HTTP/1.1" 499 0 "https://social.ca/home" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36" 213.95.149.22 - - [05/Apr/2026:17:58:57 +0200] "GET /web/login HTTP/1.1" 499 0 "https://www.pinterest.com/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36" 213.95.149.22 - - [05/Apr/2026:17:58:57 +0200] "GET /web/login HTTP/1.1" 499 0 "https://advance-super.info/products" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36" 213.95.149.22 - - [05/Apr/2026:17:58:57 +0200] "GET /web/login HTTP/1.1" 499 0 "https://app.tech.uk/blog" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36" 213.95.149.22 - - [05/Apr/2026:17:58:57 +0200] "GET /web/login HTTP/1.1" 499 0 "https://www.youtube.com/" "Mozilla/5. ... show less	DDoS Attack
🇺🇸 xmission.com	2026-04-04 07:55:08 (2 months ago)	Blocked by UFW (TCP on 34906) Source port: 34806 TTL: 45 Packet length: 60 TOS: 0x08 This report (f ... show more Blocked by UFW (TCP on 34906) Source port: 34806 TTL: 45 Packet length: 60 TOS: 0x08 This report (for 213.95.149.22) was generated by: https://github.com/sefinek/UFW-AbuseIPDB-Reporter show less	Port Scan
🇩🇪 big-cloud.nl	2026-03-30 19:18:07 (2 months ago)	Try to access /xmlrpc.php	Web App Attack
🇺🇸 TPI-Abuse	2026-03-30 13:47:40 (2 months ago)	(mod_security) mod_security (id:210350) triggered by 213.95.149.22 (tor.m-u.xyz): 1 in the last 300 ... show more (mod_security) mod_security (id:210350) triggered by 213.95.149.22 (tor.m-u.xyz): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Mar 30 09:47:35.839814 2026] [security2:error] [pid 1037:tid 1037] [client 213.95.149.22:37696] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close\|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close\|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found\|\|leanoperationsmanagement.com\|F\|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "leanoperationsmanagement.com"] [uri "/cpanel/"] [unique_id "acp-9zUjmcMQ7-lxSd-dWgAAAAw"] show less	Brute-Force Bad Web Bot Web App Attack
🇮🇳 liveaspankaj	2026-03-18 05:22:48 (2 months ago)	DDoS attack: 174 requests in 5m (GET / or repair.php).	DDoS Attack
Anonymous	2026-03-17 20:01:03 (2 months ago)	2026-03-17 11:00:11,439 fail2ban.actions [3511917]: NOTICE [tor] Ban 213.95.149.22 2026-03-1 ... show more 2026-03-17 11:00:11,439 fail2ban.actions [3511917]: NOTICE [tor] Ban 213.95.149.22 2026-03-17 13:00:55,899 fail2ban.actions [3511917]: NOTICE [tor] Ban 213.95.149.22 2026-03-17 16:00:30,898 fail2ban.actions [3511917]: NOTICE [tor] Ban 213.95.149.22 2026-03-17 19:01:01,392 fail2ban.actions [3511917]: NOTICE [tor] Ban 213.95.149.22 2026-03-17 22:00:53,549 fail2ban.actions [3511917]: NOTICE [tor] Ban 213.95.149.22 show less	Brute-Force
🇬🇧 oncord	2026-03-09 13:39:03 (2 months ago)	Form spam	Web Spam
🇦🇺 oncord	2026-03-01 15:46:30 (3 months ago)	Form spam	Web Spam
🇺🇸 oncord	2026-02-25 09:14:58 (3 months ago)	Form spam	Web Spam

Showing 1 to 15 of 526 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇺🇸 2602:80d:1007::5d

🇺🇸 23.95.137.106

🇺🇸 13.222.182.239

🇧🇷 205.210.31.241

🇳🇱 204.76.203.219

🇳🇱 204.76.203.213

🇧🇬 78.128.113.22

🇳🇱 77.83.39.54

🇺🇸 64.23.214.73

🇺🇸 13.222.179.236

🇺🇸 13.222.169.249

🇺🇸 8.229.80.148

🇺🇸 205.210.31.42

🇷🇺 176.109.97.11

🇵🇪 161.132.50.236

🇨🇦 159.89.124.112

🇱🇹 141.98.11.83

🇻🇳 103.138.113.149

🇨🇳 47.113.113.162

🇺🇸 13.222.168.56