JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 43.250.53.42

43.250.53.42 was found in our database!

This IP was reported 31 times. Confidence of Abuse is 76%: ?

76%

ISP	Red Switches
Usage Type	Data Center/Web Hosting/Transit
ASN	AS50049
Domain Name	redswitches.com
Country	🇳🇱 Netherlands
City	Lelystad, Flevoland

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 43.250.53.42

Whois 43.250.53.42

IP Abuse Reports for 43.250.53.42:

This IP address has been reported a total of 31 times from 26 distinct sources. 43.250.53.42 was first reported on May 18th 2025, and the most recent report was 18 hours ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇫🇷 SpaceHost-Server	2026-09-29 22:26:43 (18 hours ago)		Brute-Force Web App Attack
🇩🇪 さいとうあすか	2026-09-29 05:40:30 (1 day ago)	Automated exploitation attempt of WordPress CVE-2026-87902 (unauthenticated path traversal in page-t ... show more Automated exploitation attempt of WordPress CVE-2026-87902 (unauthenticated path traversal in page-template resolution, GHSA-7hp8-65ch-5whp) against a self-hosted nginx web service. Double-encoded pagename traversal probes targeting local PHP file inclusion (pearcmd.php oracle variants included). Self-hosted service; no site identifiers included. show less	Hacking Web App Attack
🇳🇱 Alt255	2026-09-24 09:38:13 (6 days ago)	[ti-01ov] Web exploit scanning: 1 suspicious requests detected by fail2ban jail <name>. Example: 43. ... show more [ti-01ov] Web exploit scanning: 1 suspicious requests detected by fail2ban jail <name>. Example: 43.250.53.42 - - \[24/Sep/2026:11:38:04 +0200\] "GET /\?page_id=2384\&vcv-template-type=vc-custom-layout\&vcv-template=theme:../../../.env HTTP/1.1" 301 412 "-" "-" ... show less	Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-09-24 09:11:50 (6 days ago)	(mod_security) mod_security (id:211190) triggered by 43.250.53.42 (-): 1 in the last 300 secs; Ports ... show more (mod_security) mod_security (id:211190) triggered by 43.250.53.42 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Sep 24 05:11:44.379994 2026] [security2:error] [pid 29467:tid 29467] [client 43.250.53.42:53810] ModSecurity: Access denied with code 403 (phase 2). Match of "contains cpanel" against "REQUEST_URI" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "55"] [id "211190"] [rev "9"] [msg "COMODO WAF: Remote File Access Attempt\|\|www.takemehomedogrescue.org\|F\|2"] [data "Matched Data: /etc/ found within REQUEST_URI: /?page_id=294&vcv-template-type=vc-custom-layout&vcv-template=theme:../../../../../../etc/passwd"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.takemehomedogrescue.org"] [uri "/"] [unique_id "arTpUNndM91iqD2A3Fd2mgAAAAo"] show less	Brute-Force Bad Web Bot Web App Attack
🇩🇪 masterguru	2026-09-24 09:00:53 (6 days ago)	Path Traversal Attack (/../). Pattern match "(?i)(?:\\\\x5c\|(?:%(?:c(?:0%(?: (930100-145)	Hacking
🇧🇪 taivas.nl	2026-09-24 04:32:28 (6 days ago)	Many_bad_calls	Web App Attack
Anonymous	2026-09-23 17:32:30 (6 days ago)	Automated mass web-app vuln scan across multiple hosts behind Akamai WAF in ~5 min window. Observed: ... show more Automated mass web-app vuln scan across multiple hosts behind Akamai WAF in ~5 min window. Observed: time-based blind SQLi (SLEEP(6)) on wp-admin/admin-ajax.php and chopslider plugin; LFI/path traversal (../../etc/passwd) on several endpoints; OS command injection (cat /etc/passwd) on pandora_console/ajax.php; Apache Struts2 OGNL RCE attempts (Runtime.exec sh -c id) on index.action/login.action; SSRF/RCE probe via soap.cgi using wget/curl to an oast.pro collaborator domain; PHP pearcmd LFI-to-RCE probe. All requests blocked by Akamai WAF (403 SQL-INJECTION-ANOMALY/LFI-ANOMALY/CMD-INJECTION-ANOMALY/WAT-ANOMALY rules) or 404. IP is hosting/datacenter range already reported by multiple independent parties for identical scanning against unrelated third-party sites in the same time window, confirming broad internet-wide automated scanning rather than a targeted attack. show less	SQL Injection Web App Attack Hacking
🇺🇸 cwytech	2026-09-23 15:10:30 (1 week ago)	Fleet-wide ban from the Ghostfleet 👻. Triggered by scenario: cwy/wordpress-geofence-sus.	Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-09-23 14:38:04 (1 week ago)	(mod_security) mod_security (id:211220) triggered by 43.250.53.42 (-): 1 in the last 300 secs; Ports ... show more (mod_security) mod_security (id:211220) triggered by 43.250.53.42 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Sep 23 10:37:56.577456 2026] [security2:error] [pid 17832:tid 17832] [client 43.250.53.42:38664] ModSecurity: Access denied with code 403 (phase 2). Pattern match "<\\\\?(?!xml\\\\s)" at ARGS_NAMES: config-create /<?. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "70"] [id "211220"] [rev "4"] [msg "COMODO WAF: PHP Injection Attack\|\|drgtek.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "drgtek.com"] [uri "/"] [unique_id "arPkRGKpCYGioH-RIB168QAAADs"] show less	Brute-Force Bad Web Bot Web App Attack
🇩🇪 FeG Deutschland	2026-09-23 14:17:34 (1 week ago)	Looking for CMS/PHP/SQL vulnerablilities/excessive crawling - 247	Exploited Host Web App Attack
Anonymous	2026-09-23 13:14:00 (1 week ago)	continent_name:Europe country_name:The Netherlands ip:43.250.53.42	Brute-Force Bad Web Bot Web App Attack
🇫🇮 paissangroup	2026-09-23 11:23:08 (1 week ago)	Multiple WAF Violations	Web App Attack
🇩🇪 FD-IX	2026-09-23 09:19:00 (1 week ago)		Bad Web Bot
🇩🇪 expandmade.com	2026-09-22 23:17:58 (1 week ago)	unauthorized rest api call [22/Sep/2026:23:17:58 "GET /index.php?rest_route=/wp/v2/pages&per_page=3& ... show more unauthorized rest api call [22/Sep/2026:23:17:58 "GET /index.php?rest_route=/wp/v2/pages&per_page=3&_fields=id,template"] show less	Web App Attack
🇫🇮 [email protected]	2026-09-22 22:58:07 (1 week ago)	Attack attempt against Interwebbi servers; (WPNINJA) Ninja Firewall attack on www.ideaviihde.fi (Dir ... show more Attack attempt against Interwebbi servers; (WPNINJA) Ninja Firewall attack on www.ideaviihde.fi (Directory traversal #1) 43.250.53.42 (-): 1 in the last 3600 secs (CF_ENABLE); IP: 43.250.53.42; Ports: *; Direction: 0; Trigger: LF_CUSTOMTRIGGER; show less	Web App Attack

Showing 1 to 15 of 31 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇨🇱 186.10.86.130

🇳🇵 157.10.100.12

🇺🇸 147.185.132.234

🇳🇱 109.160.32.200

🇰🇷 91.204.224.17

🇸🇬 85.203.21.11

🇰🇷 52.231.30.175

🇫🇷 51.68.226.87

🇺🇸 34.128.172.90

🇩🇪 31.76.119.187

🇺🇾 200.40.204.66

🇿🇦 165.165.159.105

🇮🇩 163.7.6.114

🇨🇳 153.99.92.11

🇩🇪 151.243.11.149

🇮🇳 121.242.232.147

🇮🇱 79.177.163.89

🇨🇳 47.111.234.74

🇩🇪 8.211.33.200

🇷🇺 130.49.213.197