JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 23.129.64.172

23.129.64.172 was found in our database!

This IP was reported 2,914 times. Confidence of Abuse is 83%: ?

83%

This address is a Tor exit node. Neither the owner nor the provider are directly behind the offending action.

ISP	Emerald Onion
Usage Type	Data Center/Web Hosting/Transit
ASN	AS396507
Domain Name	emeraldonion.org
Country	🇺🇸 United States of America
City	San Jose, California

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 23.129.64.172

Whois 23.129.64.172

IP Abuse Reports for 23.129.64.172:

This IP address has been reported a total of 2,914 times from 436 distinct sources. 23.129.64.172 was first reported on September 23rd 2021, and the most recent report was 3 hours ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇺🇸 xmission.com	2026-06-17 03:08:39 (3 hours ago)	Blocked by UFW (TCP on 42387) Source port: 35655 TTL: 57 Packet length: 60 TOS: 0x00 This report (f ... show more Blocked by UFW (TCP on 42387) Source port: 35655 TTL: 57 Packet length: 60 TOS: 0x00 This report (for 23.129.64.172) was generated by: https://github.com/sefinek/UFW-AbuseIPDB-Reporter show less	Port Scan
🇺🇸 xmission.com	2026-06-15 04:01:59 (2 days ago)	Blocked by UFW (TCP on 42387) Source port: 38077 TTL: 57 Packet length: 60 TOS: 0x00 This report (f ... show more Blocked by UFW (TCP on 42387) Source port: 38077 TTL: 57 Packet length: 60 TOS: 0x00 This report (for 23.129.64.172) was generated by: https://github.com/sefinek/UFW-AbuseIPDB-Reporter show less	Port Scan
🇦🇺 MAGIC	2026-06-15 02:17:33 (2 days ago)	VM1 Bad user agents ignoring web crawling rules. Draing bandwidth	DDoS Attack Bad Web Bot
🇳🇱 Site.eu	2026-06-14 09:55:25 (2 days ago)	Repeated wp-login/xmlrpc attempts	Brute-Force SSH
🇺🇸 xmission.com	2026-06-14 00:47:39 (3 days ago)	Blocked by UFW (TCP on 42387) Source port: 37873 TTL: 56 Packet length: 60 TOS: 0x00 This report (f ... show more Blocked by UFW (TCP on 42387) Source port: 37873 TTL: 56 Packet length: 60 TOS: 0x00 This report (for 23.129.64.172) was generated by: https://github.com/sefinek/UFW-AbuseIPDB-Reporter show less	Port Scan
🇺🇸 xmission.com	2026-06-13 12:12:39 (3 days ago)	Blocked by UFW (TCP on 38667) Source port: 11135 TTL: 57 Packet length: 60 TOS: 0x00 This report (f ... show more Blocked by UFW (TCP on 38667) Source port: 11135 TTL: 57 Packet length: 60 TOS: 0x00 This report (for 23.129.64.172) was generated by: https://github.com/sefinek/UFW-AbuseIPDB-Reporter show less	Port Scan
🇫🇷 MatStef132	2026-06-12 22:47:49 (4 days ago)	MatShield L7: blocked on mathost.eu (ua-quarantined)	Bad Web Bot
🇺🇸 xmission.com	2026-06-12 20:46:39 (4 days ago)	Blocked by UFW (TCP on 42387) Source port: 44261 TTL: 57 Packet length: 60 TOS: 0x00 This report (f ... show more Blocked by UFW (TCP on 42387) Source port: 44261 TTL: 57 Packet length: 60 TOS: 0x00 This report (for 23.129.64.172) was generated by: https://github.com/sefinek/UFW-AbuseIPDB-Reporter show less	Port Scan
🇺🇸 xmission.com	2026-06-11 17:51:39 (5 days ago)	Blocked by UFW (TCP on 46787) Source port: 62141 TTL: 56 Packet length: 60 TOS: 0x00 This report (f ... show more Blocked by UFW (TCP on 46787) Source port: 62141 TTL: 56 Packet length: 60 TOS: 0x00 This report (for 23.129.64.172) was generated by: https://github.com/sefinek/UFW-AbuseIPDB-Reporter show less	Port Scan
🇲🇽 Centynova Corp.	2026-06-10 13:59:21 (6 days ago)	Blocked by threat detection service. Centynova Security	Port Scan Email Spam Brute-Force SSH
🇺🇸 xmission.com	2026-06-10 12:33:59 (6 days ago)	Blocked by UFW (TCP on 46787) Source port: 49955 TTL: 57 Packet length: 60 TOS: 0x00 This report (f ... show more Blocked by UFW (TCP on 46787) Source port: 49955 TTL: 57 Packet length: 60 TOS: 0x00 This report (for 23.129.64.172) was generated by: https://github.com/sefinek/UFW-AbuseIPDB-Reporter show less	Port Scan
🇺🇸 TPI-Abuse	2026-06-10 03:46:11 (1 week ago)	(mod_security) mod_security (id:210730) triggered by 23.129.64.172 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:210730) triggered by 23.129.64.172 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jun 09 23:46:04.725366 2026] [security2:error] [pid 5298:tid 5298] [client 23.129.64.172:39775] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy\|\|test.nationalccl.com\|F\|2"] [data ".nationalccl.com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "test.nationalccl.com"] [uri "/1781063152/facts/test.nationalccl.com"] [unique_id "aijd_OHPgMS-haOm2WrvjwAAABQ"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-06-09 18:17:22 (1 week ago)	(mod_security) mod_security (id:211220) triggered by 23.129.64.172 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:211220) triggered by 23.129.64.172 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jun 09 14:17:17.599910 2026] [security2:error] [pid 953:tid 953] [client 23.129.64.172:31189] ModSecurity: Access denied with code 403 (phase 2). Pattern match "<\\\\?(?!xml\\\\s)" at ARGS:vars[0]. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "70"] [id "211220"] [rev "4"] [msg "COMODO WAF: PHP Injection Attack\|\|adm-sal.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "adm-sal.com"] [uri "/index.php"] [unique_id "aihYrQ7-qTUMDJxhlT14fgAAAA0"] show less	Brute-Force Bad Web Bot Web App Attack
Anonymous	2026-06-09 16:30:27 (1 week ago)	Failed login attempt detected by Fail2Ban in plesk-postfix jail	Brute-Force
🇺🇸 xmission.com	2026-06-09 14:36:19 (1 week ago)	Blocked by UFW (TCP on 46787) Source port: 41023 TTL: 57 Packet length: 60 TOS: 0x00 This report (f ... show more Blocked by UFW (TCP on 46787) Source port: 41023 TTL: 57 Packet length: 60 TOS: 0x00 This report (for 23.129.64.172) was generated by: https://github.com/sefinek/UFW-AbuseIPDB-Reporter show less	Port Scan

Showing 1 to 15 of 2914 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇩🇪 213.209.159.239

🇩🇪 185.132.46.108

🇺🇸 162.216.149.162

🇨🇳 118.212.122.150

🇰🇷 106.246.224.218

🇨🇦 85.217.149.56

🇮🇳 223.228.135.151

🇰🇷 220.87.67.230

🇧🇬 213.183.62.12

🇦🇷 186.148.224.183

🇨🇳 182.242.168.172

🇧🇷 177.84.92.181

🇵🇰 153.117.127.229

🇵🇰 153.117.32.248

🇨🇳 124.88.113.253

🇨🇳 124.31.107.247

🇨🇳 123.150.80.157

🇻🇳 118.71.20.55

🇨🇳 111.113.88.210

🇺🇸 104.28.213.40