JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 5.253.246.158

5.253.246.158 was found in our database!

This IP was reported 143 times. Confidence of Abuse is 100%: ?

100%

ISP	Tube-Hosting
Usage Type	Data Center/Web Hosting/Transit
ASN	AS49581
Hostname(s)	tube-server.com
Domain Name	tube-hosting.com
Country	🇩🇪 Germany
City	Aachen, North Rhine-Westphalia

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 5.253.246.158

Whois 5.253.246.158

IP Abuse Reports for 5.253.246.158:

This IP address has been reported a total of 143 times from 85 distinct sources. 5.253.246.158 was first reported on January 7th 2022, and the most recent report was 6 minutes ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇩🇪 maxpower	2026-06-21 12:33:53 (6 minutes ago)	(backdoor_scan) REGOLA 7 - Backdoor Scan Attempt 5.253.246.158 (tube-server.com): 2 in the last 3600 ... show more (backdoor_scan) REGOLA 7 - Backdoor Scan Attempt 5.253.246.158 (tube-server.com): 2 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: 5.253.246.158 - - [21/Jun/2026:14:33:45 +0200] "GET /wp-content/languages/wp-login.php HTTP/2.0" 301 0 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" "5.253.246.158" host=canarybusinesshhs.com 5.253.246.158 - - [21/Jun/2026:14:33:50 +0200] "GET /atomlib.php HTTP/2.0" 301 0 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" "5.253.246.158" host=canarybusinesshhs.com show less	Port Scan
🇩🇪 Gwyneth Llewelyn	2026-06-21 11:52:23 (48 minutes ago)	5.253.246.158 - - [21/Jun/2026:12:52:21 +0100] "GET /wp-admin.php HTTP/2.0" 404 994 "-" "Mozilla/5.0 ... show more 5.253.246.158 - - [21/Jun/2026:12:52:21 +0100] "GET /wp-admin.php HTTP/2.0" 404 994 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" show less	Bad Web Bot
Anonymous	2026-06-21 08:04:46 (4 hours ago)	5.253.246.158 - - [21/Jun/2026:08:04:44 +0000] "GET /wp-configs.php HTTP/2.0" 404 182 "-" "Mozilla/5 ... show more 5.253.246.158 - - [21/Jun/2026:08:04:44 +0000] "GET /wp-configs.php HTTP/2.0" 404 182 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" ... show less	Bad Web Bot Web App Attack
🇺🇸 rwgomes	2026-06-21 08:00:02 (4 hours ago)	Automated report from Intelligence Finance Tools. Cumulative threat score: 80. Failed logins: 0, 404 ... show more Automated report from Intelligence Finance Tools. Cumulative threat score: 80. Failed logins: 0, 404 probes: 41. show less	Web App Attack Port Scan
🇳🇱 Site.eu	2026-06-21 06:38:23 (6 hours ago)	Excessive multi-domain requests	Brute-Force
🇱🇻 garmtech.com	2026-06-21 05:51:11 (6 hours ago)	Attempted access to sensitive endpoint (/wp-admin/css/colors/midnight/colors.php) detected. Automate ... show more Attempted access to sensitive endpoint (/wp-admin/css/colors/midnight/colors.php) detected. Automated scan or unauthorized probing. show less	Web App Attack
🇳🇴 Abuse Buster	2026-06-21 04:37:29 (8 hours ago)	5.253.246.158 - - [21/Jun/2026:06:37:26 +0200] "GET /wp-configs.php HTTP/2.0" 404 22 "-" "Mozilla/5. ... show more 5.253.246.158 - - [21/Jun/2026:06:37:26 +0200] "GET /wp-configs.php HTTP/2.0" 404 22 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 5.253.246.158 - - [21/Jun/2026:06:37:26 +0200] "GET /wp-admin/css/colors/midnight/colors.php HTTP/2.0" 404 22 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 5.253.246.158 - - [21/Jun/2026:06:37:26 +0200] "GET /db.php HTTP/2.0" 404 22 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 5.253.246.158 - - [21/Jun/2026:06:37:26 +0200] "GET /wp-admin/pages.php HTTP/2.0" 404 22 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" ... show less	Web App Attack
🇺🇸 antlac1	2026-06-21 02:23:27 (10 hours ago)	crowdsecurity/http-admin-interface-probing	Brute-Force Web App Attack
🇬🇧 Mendip_Defender	2026-06-21 02:05:09 (10 hours ago)	5.253.246.158 - - [21/Jun/2026:03:05:02 +0100] "GET /alfa.php HTTP/1.1" 404 4037 "-" "Mozilla/5.0 (W ... show more 5.253.246.158 - - [21/Jun/2026:03:05:02 +0100] "GET /alfa.php HTTP/1.1" 404 4037 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 5.253.246.158 - - [21/Jun/2026:03:05:02 +0100] "GET /lock360.php HTTP/1.1" 404 4037 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 5.253.246.158 - - [21/Jun/2026:03:05:02 +0100] "GET /flower.php HTTP/1.1" 404 4037 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" ... show less	Hacking Web App Attack
🇩🇪 maxpower	2026-06-21 01:19:47 (11 hours ago)	(aggressive_scanner) REGOLA 9 - Aggressive Web Scanner 5.253.246.158 (tube-server.com): 1 in the las ... show more (aggressive_scanner) REGOLA 9 - Aggressive Web Scanner 5.253.246.158 (tube-server.com): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: 5.253.246.158 - - [21/Jun/2026:03:19:41 +0200] "GET /lock360.php HTTP/2.0" 301 0 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" "5.253.246.158" host=canarybusinesshhs.com show less	Port Scan
🇳🇿 Antinson	2026-06-21 00:39:51 (12 hours ago)	Requests to unauthorized or suspicious endpoints (.git, .well-known, .php, etc.)	Bad Web Bot
🇺🇸 nodepile	2026-06-20 23:09:23 (13 hours ago)	Requests denied due to active blacklist hits (tenant=82 method=GET path=/flower.php ua='Mozilla/5.0 ... show more Requests denied due to active blacklist hits (tenant=82 method=GET path=/flower.php ua='Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36') show less	Web App Attack Exploited Host
🇫🇷 SpaceHost-Server	2026-06-20 22:31:21 (14 hours ago)		Brute-Force Web App Attack
🇩🇪 maxpower	2026-06-20 22:25:31 (14 hours ago)	(aggressive_scanner) REGOLA 9 - Aggressive Web Scanner 5.253.246.158 (tube-server.com): 1 in the las ... show more (aggressive_scanner) REGOLA 9 - Aggressive Web Scanner 5.253.246.158 (tube-server.com): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: 5.253.246.158 - - [21/Jun/2026:00:25:24 +0200] "GET /lock360.php HTTP/2.0" 404 96673 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" "5.253.246.158" host=www.tikitakaplanet.it show less	Port Scan
🇩🇪 LRob.fr	2026-06-20 21:15:02 (15 hours ago)	Repeated 404 errors, blocked by Fail2ban in custom-404 jail	Bad Web Bot

Showing 1 to 15 of 143 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇸🇮 176.65.134.8

🇺🇸 66.132.186.253

🇦🇪 145.241.123.102

🇺🇸 130.131.55.227

🇩🇪 69.5.169.243

🇺🇸 20.118.248.174

🇧🇷 200.189.23.102

🇷🇴 193.32.162.16

🇷🇺 128.71.65.34

🇫🇷 85.217.140.46

🇺🇸 43.135.135.17

🇺🇸 34.121.63.49

🇨🇳 14.103.107.234

🇫🇷 5.135.250.1

🇷🇴 2.57.121.25

🇫🇷 2001:41d0:303:a1d0::1

🇱🇰 220.247.224.226

🇺🇸 209.225.102.212

🇭🇰 165.154.41.50

🇮🇳 116.73.240.74