JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 23.129.64.158

23.129.64.158 was found in our database!

This IP was reported 1,961 times. Confidence of Abuse is 69%: ?

69%

This address is a Tor exit node. Neither the owner nor the provider are directly behind the offending action.

ISP	Emerald Onion
Usage Type	Data Center/Web Hosting/Transit
ASN	AS396507
Domain Name	emeraldonion.org
Country	🇺🇸 United States of America
City	San Jose, California

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 23.129.64.158

Whois 23.129.64.158

IP Abuse Reports for 23.129.64.158:

This IP address has been reported a total of 1,961 times from 265 distinct sources. 23.129.64.158 was first reported on June 7th 2021, and the most recent report was 8 hours ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇺🇸 xmission.com	2026-07-05 22:28:19 (8 hours ago)	Blocked by UFW (TCP on 41963) Source port: 51213 TTL: 56 Packet length: 60 TOS: 0x00 This report (f ... show more Blocked by UFW (TCP on 41963) Source port: 51213 TTL: 56 Packet length: 60 TOS: 0x00 This report (for 23.129.64.158) was generated by: https://github.com/sefinek/UFW-AbuseIPDB-Reporter show less	Port Scan
🇺🇸 xmission.com	2026-07-04 18:12:39 (1 day ago)	Blocked by UFW (TCP on 41963) Source port: 58803 TTL: 56 Packet length: 60 TOS: 0x00 This report (f ... show more Blocked by UFW (TCP on 41963) Source port: 58803 TTL: 56 Packet length: 60 TOS: 0x00 This report (for 23.129.64.158) was generated by: https://github.com/sefinek/UFW-AbuseIPDB-Reporter show less	Port Scan
🇫🇷 MatStef132	2026-06-30 22:11:38 (5 days ago)	MatShield L7: blocked on dev.mathost.eu (ua-quarantined)	Bad Web Bot
🇺🇸 xmission.com	2026-06-29 23:39:19 (6 days ago)	Blocked by UFW (TCP on 1) Source port: 20335 TTL: 56 Packet length: 60 TOS: 0x00 This report (for 2 ... show more Blocked by UFW (TCP on 1) Source port: 20335 TTL: 56 Packet length: 60 TOS: 0x00 This report (for 23.129.64.158) was generated by: https://github.com/sefinek/UFW-AbuseIPDB-Reporter show less	Port Scan
🇺🇸 bigscoots.com	2026-06-29 11:22:12 (6 days ago)	23.129.64.158 (US/United States/-), 5 distributed sshd attacks on account [root] in the last 3600 se ... show more 23.129.64.158 (US/United States/-), 5 distributed sshd attacks on account [root] in the last 3600 secs; Ports: *; Direction: 1; Trigger: LF_DISTATTACK; Logs: Jun 29 06:21:58 14379 sshd[3021]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=23.129.64.158 user=root Jun 29 06:22:00 14379 sshd[3021]: Failed password for root from 23.129.64.158 port 28625 ssh2 Jun 29 06:22:03 14379 sshd[3023]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=23.129.64.158 user=root Jun 29 06:22:05 14379 sshd[3023]: Failed password for root from 23.129.64.158 port 33373 ssh2 Jun 29 06:22:07 14379 sshd[3291]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=192.42.116.12 user=root IP Addresses Blocked: show less	Brute-Force SSH
🇳🇱 homeshowdomain.nl	2026-06-28 22:03:03 (1 week ago)	Auto-ban: >3000 req/min op 2026-06-28	Web App Attack SSH Hacking
🇺🇸 TPI-Abuse	2026-06-28 17:53:13 (1 week ago)	(mod_security) mod_security (id:210492) triggered by 23.129.64.158 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:210492) triggered by 23.129.64.158 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Jun 28 13:53:08.290312 2026] [security2:error] [pid 4353:tid 4353] [client 23.129.64.158:44541] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "trhs70.rwcartoons.com"] [uri "/.git/config"] [unique_id "akFfhGpabKiWn3F0KOzwfwAAAAQ"] show less	Brute-Force Bad Web Bot Web App Attack
🇦🇺 oncord	2026-06-28 01:31:45 (1 week ago)	Form spam	Web Spam
🇫🇷 MatStef132	2026-06-26 12:05:38 (1 week ago)	MatShield L7: blocked on mathost.eu (ua-quarantined)	Bad Web Bot
🇸🇬 securejdprop	2026-06-25 07:59:44 (1 week ago)	This IP was detected by CrowdSec triggering crowdsecurity/suricata-major-severity(ET TOR Known Tor E ... show more This IP was detected by CrowdSec triggering crowdsecurity/suricata-major-severity(ET TOR Known Tor Exit Node Traffic group 76). Ip 23.129.64.158 performed 'crowdsecurity/suricata-major-severity' (1 events over 0s) at 2026-06-25 07:59:43.111615877 +0000 UTC show less	Hacking Web App Attack
🇺🇸 xmission.com	2026-06-24 08:26:39 (1 week ago)	Blocked by UFW (TCP on 54579) Source port: 1141 TTL: 58 Packet length: 60 TOS: 0x00 This report (fo ... show more Blocked by UFW (TCP on 54579) Source port: 1141 TTL: 58 Packet length: 60 TOS: 0x00 This report (for 23.129.64.158) was generated by: https://github.com/sefinek/UFW-AbuseIPDB-Reporter show less	Port Scan
🇺🇸 TPI-Abuse	2026-06-24 03:24:02 (1 week ago)	(mod_security) mod_security (id:225170) triggered by 23.129.64.158 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:225170) triggered by 23.129.64.158 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jun 23 23:23:57.505529 2026] [security2:error] [pid 19321:tid 19321] [client 23.129.64.158:15199] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)\|\|thesmithcouple.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "thesmithcouple.com"] [uri "/wp-json/wp/v2/users"] [unique_id "ajtNzbwzkqKBe2vfoRrwJQAAABc"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 xmission.com	2026-06-21 10:20:59 (2 weeks ago)	Blocked by UFW (TCP on 1) Source port: 31685 TTL: 57 Packet length: 60 TOS: 0x00 This report (for 2 ... show more Blocked by UFW (TCP on 1) Source port: 31685 TTL: 57 Packet length: 60 TOS: 0x00 This report (for 23.129.64.158) was generated by: https://github.com/sefinek/UFW-AbuseIPDB-Reporter show less	Port Scan
🇺🇸 xmission.com	2026-06-20 15:33:59 (2 weeks ago)	Blocked by UFW (TCP on 1024) Source port: 59631 TTL: 57 Packet length: 60 TOS: 0x00 This report (fo ... show more Blocked by UFW (TCP on 1024) Source port: 59631 TTL: 57 Packet length: 60 TOS: 0x00 This report (for 23.129.64.158) was generated by: https://github.com/sefinek/UFW-AbuseIPDB-Reporter show less	Port Scan
🇩🇪 psauxit	2026-06-19 23:22:03 (2 weeks ago)	Fail2Ban - NGINX heavily bad-bot, possible vulnerability scanning and excessive crawling/scraping	Bad Web Bot Web App Attack Hacking Web Spam

Showing 1 to 15 of 1961 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇻🇳 118.70.182.193

🇺🇸 64.62.197.18

🇧🇪 34.62.123.52

🇲🇾 2001:e68:668a:7d00:1d23:b3f4:e38a:d63c

🇺🇸 195.184.76.64

🇻🇪 190.89.31.48

🇺🇸 162.141.167.14

🇩🇪 151.243.11.245

🇻🇳 116.109.216.74

🇷🇺 109.173.38.135

🇵🇹 109.50.185.153

🇭🇰 101.36.108.175

🇦🇹 87.249.133.25

🇺🇸 64.62.156.87

🇸🇪 31.134.13.150

🇮🇳 27.97.180.56

🇺🇸 20.168.127.155

🇩🇪 195.230.103.245

🇹🇭 171.96.137.26

🇺🇸 165.154.36.71