JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 38.246.32.195

38.246.32.195 was found in our database!

This IP was reported 42 times. Confidence of Abuse is 45%: ?

45%

ISP	Limestone Networks, Inc.
Usage Type	Data Center/Web Hosting/Transit
ASN	AS46475
Hostname(s)	195-32-246-38.static.reverse.lstn.net
Domain Name	limestonenetworks.com
Country	🇩🇪 Germany
City	Frankfurt am Main, Hesse

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 38.246.32.195

Whois 38.246.32.195

IP Abuse Reports for 38.246.32.195:

This IP address has been reported a total of 42 times from 30 distinct sources. 38.246.32.195 was first reported on June 17th 2025, and the most recent report was 3 days ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇩🇪 netclix.gr	2026-07-24 03:38:42 (3 days ago)	(wordpress) Failed wordpress login from 38.246.32.195 (DE/Germany/195-32-246-38.static.reverse.lstn. ... show more (wordpress) Failed wordpress login from 38.246.32.195 (DE/Germany/195-32-246-38.static.reverse.lstn.net): (CF_ENABLE) show less	Brute-Force
🇺🇸 integrantservices.com	2026-07-24 03:37:54 (3 days ago)	(wordpress) Failed wordpress login from 38.246.32.195 (DE/Germany/195-32-246-38.static.reverse.lstn. ... show more (wordpress) Failed wordpress login from 38.246.32.195 (DE/Germany/195-32-246-38.static.reverse.lstn.net) show less	Brute-Force
🇺🇸 TPI-Abuse	2026-07-19 23:23:34 (1 week ago)	(mod_security) mod_security (id:240335) triggered by 38.246.32.195 (195-32-246-38.static.reverse.lst ... show more (mod_security) mod_security (id:240335) triggered by 38.246.32.195 (195-32-246-38.static.reverse.lstn.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Jul 19 19:23:30.029788 2026] [security2:error] [pid 32623:tid 32623] [client 38.246.32.195:63967] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 38.246.32.195 (+1 hits since last alert)\|thesalonx.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "thesalonx.com"] [uri "/xmlrpc.php"] [unique_id "al1ccsj7VEOB4orZF5MD5gAAABE"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-07-01 07:46:45 (3 weeks ago)	(mod_security) mod_security (id:240335) triggered by 38.246.32.195 (195-32-246-38.static.reverse.lst ... show more (mod_security) mod_security (id:240335) triggered by 38.246.32.195 (195-32-246-38.static.reverse.lstn.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jul 01 03:46:39.388978 2026] [security2:error] [pid 28389:tid 28389] [client 38.246.32.195:59663] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 38.246.32.195 (+1 hits since last alert)\|odysseydogasporlari.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "odysseydogasporlari.com"] [uri "/xmlrpc.php"] [unique_id "akTF3wkMNHQFjui934tkrAAAAAE"] show less	Brute-Force Bad Web Bot Web App Attack
🇫🇷 security.rdmc.fr	2026-06-25 09:44:51 (1 month ago)	VoIP Attack proto:UDP src:51366 dst:5060	Port Scan Fraud VoIP
🇬🇧 James Walker	2026-06-25 09:32:00 (1 month ago)	SIP scan attack	Brute-Force Fraud VoIP
🇺🇸 mc4bbs	2026-06-25 09:14:02 (1 month ago)	[2026-06-25 05:09:03] NOTICE[3064] chan_sip.c: Registration from '<sip:[email protected]:5060>' fail ... show more [2026-06-25 05:09:03] NOTICE[3064] chan_sip.c: Registration from '<sip:[email protected]:5060>' failed for '38.246.32.195:62264' - Wrong password [2026-06-25 05:09:03] SECURITY[3207] res_security_log.c: SecurityEvent="InvalidPassword",EventTV="2026-06-25T05:09:03.836-0400",Severity="Error",Service="SIP",EventVersion="2",AccountID="100",SessionID="0x7f6aa005d6a0",LocalAddress="IPV4/UDP/108.54.115.236/5060",RemoteAddress="IPV4/UDP/38.246.32.195/62264",Challenge="7a02d90b",ReceivedChallenge="7a02d90b",ReceivedHash="c8298fbb1a29c60f7b7f02e756d92f32" [2026-06-25 05:14:01] NOTICE[3064] chan_sip.c: Registration from '<sip:[email protected]:5060>' failed for '38.246.32.195:61268' - Wrong password ... show less	Fraud VoIP Brute-Force
🇨🇭 ale	2026-06-25 09:13:37 (1 month ago)	SIP auth scanning - multiple failed SIP authentication	Fraud VoIP
🇺🇸 BirdCo Telecom	2026-06-25 09:13:16 (1 month ago)		Brute-Force Fraud VoIP
🇩🇪 NxtGenIT	2026-06-25 09:11:15 (1 month ago)	Sentrypeer Honeypot hit, SIP Method: REGISTER, User Agent: Grandstream GXP2130 1.0.5.23	FTP Brute-Force
Anonymous	2026-06-25 09:07:12 (1 month ago)	B: f2b asterisk aggressive 3x	Email Spam
🇮🇹 Francesco Ippoliti	2026-06-25 09:05:11 (1 month ago)	[Jun 25 11:05:10] NOTICE[9080] res_pjsip/pjsip_distributor.c: Request 'REGISTER' from '<sip:100@154. ... show more [Jun 25 11:05:10] NOTICE[9080] res_pjsip/pjsip_distributor.c: Request 'REGISTER' from '<sip:[email protected]>' failed for '38.246.32.195:60002' (callid: [email protected]) - No matching endpoint found [Jun 25 11:05:10] NOTICE[2425] res_pjsip/pjsip_distributor.c: Request 'REGISTER' from '<sip:[email protected]>' failed for '38.246.32.195:60002' (callid: [email protected]) - No matching endpoint found ... show less	Brute-Force Port Scan
🇩🇪 defkev	2026-06-25 09:04:51 (1 month ago)		Fraud VoIP
🇷🇺 Reaper	2026-06-08 09:04:07 (1 month ago)	GET /wp-login.php	Web App Attack
🇮🇹 [email protected]	2026-04-30 08:35:26 (2 months ago)	38.246.32.195 - - [30/Apr/2026:08:56:39 +0200] "POST /xmlrpc.php HTTP/1.1" 403 3762 "-" "Mozilla/5.0 ... show more 38.246.32.195 - - [30/Apr/2026:08:56:39 +0200] "POST /xmlrpc.php HTTP/1.1" 403 3762 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36" ... show less	Brute-Force Web App Attack

Showing 1 to 15 of 42 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇪🇸 158.158.32.226

🇺🇸 50.116.72.209

🇺🇸 216.73.217.103

🇳🇱 193.176.31.218

🇳🇱 172.71.98.139

🇺🇸 170.205.17.164

🇺🇸 165.154.163.89

🇦🇺 115.129.248.67

🇺🇸 100.28.153.226

🇬🇧 90.251.17.151

🇸🇬 68.183.236.1

🇺🇸 66.132.186.239

🇧🇷 43.157.191.20

🇬🇧 195.206.182.214

🇸🇪 171.25.158.68

🇺🇸 109.105.210.59

🇨🇿 109.81.123.126

🇹🇷 94.154.43.160

🇺🇸 66.132.186.218

🇨🇦 52.139.36.144