JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 80.251.153.113

80.251.153.113 was found in our database!

This IP was reported 31 times. Confidence of Abuse is 100%: ?

100%

This address is a Tor exit node. Neither the owner nor the provider are directly behind the offending action.

ISP	Amarutu Technology Ltd
Usage Type	Data Center/Web Hosting/Transit
ASN	AS206264
Domain Name	koddos.net
Country	🇳🇱 Netherlands
City	Lelystad, Flevoland

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 80.251.153.113

Whois 80.251.153.113

IP Abuse Reports for 80.251.153.113:

This IP address has been reported a total of 31 times from 24 distinct sources. 80.251.153.113 was first reported on July 11th 2026, and the most recent report was 9 hours ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇩🇪 MusicLibrary	2026-07-23 02:37:25 (9 hours ago)	Probing foreign-stack admin panels / known exploit paths (Joomla, phpMyAdmin, phpunit, OWA, etc.)	Bad Web Bot Web App Attack
🇺🇸 xmission.com	2026-07-22 12:34:38 (23 hours ago)	Blocked by UFW (TCP on 55801) Source port: 46364 TTL: 49 Packet length: 60 TOS: 0x08 This report (f ... show more Blocked by UFW (TCP on 55801) Source port: 46364 TTL: 49 Packet length: 60 TOS: 0x08 This report (for 80.251.153.113) was generated by: https://github.com/sefinek/UFW-AbuseIPDB-Reporter show less	Port Scan
🇩🇪 london2038.com	2026-07-22 06:16:35 (1 day ago)	Detected by WP fail2ban 2026-07-22T08:16:35.132745+02:00 wordpress: Authentication attempt from 80.2 ... show more Detected by WP fail2ban 2026-07-22T08:16:35.132745+02:00 wordpress: Authentication attempt from 80.251.153.113 show less	Brute-Force Web App Attack
🇩🇪 4server	2026-07-22 02:28:01 (1 day ago)	[WedJul2204:27:58.3045162026][security2:error][pid3720026:tid3720161][client80.251.153.113:0]ModSecu ... show more [WedJul2204:27:58.3045162026][security2:error][pid3720026:tid3720161][client80.251.153.113:0]ModSecurity:Accessdeniedwithcode403\(phase1\).Stringmatch\"/xmlrpc.php\"atREQUEST_URI.[file\"/etc/apache2/conf.d/modsec_custom_rules.conf\"][line\"170\"][id\"960024\"][msg\"XML-RPCdisabled\"][hostname\"specialfood.ch\"][uri\"/xmlrpc.php\"][unique_id\"amAqrltb1euJ4xaBhav4lAAAAM8\"] show less	Port Scan Brute-Force Web App Attack
🇸🇪 vaia.cloud	2026-07-22 01:50:01 (1 day ago)	crowdsecurity/http-admin-interface-probing	Brute-Force Web App Attack
🇮🇹 CoreTech srl	2026-07-22 01:48:48 (1 day ago)	[DC: IP:151.1.252.27] ntopng alert: blacklisted_client_contact	Hacking
🇩🇪 LRob	2026-07-22 01:48:26 (1 day ago)	CrowdSec: crowdsecurity/http-bad-user-agent \| req: /wp-content/uploads/uag-plugin/assets/2000/uag-js ... show more CrowdSec: crowdsecurity/http-bad-user-agent \| req: /wp-content/uploads/uag-plugin/assets/2000/uag-js-2142.js?ver=1784684878 \| 2 distinct paths \| UA: \x22Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36\x22 show less	Bad Web Bot
Anonymous	2026-07-22 00:26:02 (1 day ago)	Bot / scanning and/or hacking attempts: POST /xmlrpc.php HTTP/1.1	Hacking Web App Attack
🇺🇸 xmission.com	2026-07-21 23:39:37 (1 day ago)	Blocked by UFW (TCP on 50000) Source port: 40710 TTL: 51 Packet length: 60 TOS: 0x08 This report (f ... show more Blocked by UFW (TCP on 50000) Source port: 40710 TTL: 51 Packet length: 60 TOS: 0x08 This report (for 80.251.153.113) was generated by: https://github.com/sefinek/UFW-AbuseIPDB-Reporter show less	Port Scan
🇩🇪 LRob	2026-07-21 18:06:39 (1 day ago)	CrowdSec: crowdsecurity/http-bad-user-agent \| req: / \| 2 distinct paths \| UA: \x22Mozilla/5.0 (Macin ... show more CrowdSec: crowdsecurity/http-bad-user-agent \| req: / \| 2 distinct paths \| UA: \x22Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36\x22 show less	Bad Web Bot
🇺🇸 TPI-Abuse	2026-07-21 09:30:35 (2 days ago)	(mod_security) mod_security (id:225170) triggered by 80.251.153.113 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:225170) triggered by 80.251.153.113 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jul 21 05:30:28.503594 2026] [security2:error] [pid 11371:tid 11371] [client 80.251.153.113:39474] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)\|\|silalaw.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "silalaw.com"] [uri "/wp-json/wp/v2/users/1"] [unique_id "al88NK8wU1sYXnEVKKQTygAAAAU"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-07-21 07:36:46 (2 days ago)	(mod_security) mod_security (id:225170) triggered by 80.251.153.113 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:225170) triggered by 80.251.153.113 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jul 21 03:36:41.375096 2026] [security2:error] [pid 20842:tid 20842] [client 80.251.153.113:53106] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)\|\|dancingbearprinting.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "dancingbearprinting.com"] [uri "/wp-json/wp/v2/users"] [unique_id "al8hiTRwYxYiegK2HGdYcwAAAAc"] show less	Brute-Force Bad Web Bot Web App Attack
🇧🇪 taivas.nl	2026-07-21 04:32:59 (2 days ago)	Many_bad_calls	Web App Attack
🇨🇭 YF	2026-07-20 23:30:18 (2 days ago)	Attaque distribuée subnet	DDoS Attack Web App Attack
🇺🇸 Tect.host	2026-07-20 21:59:02 (2 days ago)	Brute-force SFTP server detected by Fail2ban	FTP Brute-Force Brute-Force

Showing 1 to 15 of 31 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇰🇿 178.90.250.133

🇫🇷 51.38.224.114

🇭🇰 45.249.247.243

🇭🇰 2602:80d:1003::3b

🇳🇱 195.178.110.227

🇬🇧 195.96.139.6

🇨🇳 183.221.93.138

🇺🇸 162.216.150.147

🇮🇹 151.0.154.194

🇮🇳 139.59.58.126

🇬🇧 132.243.173.200

🇨🇳 123.145.10.116

🇵🇱 74.248.139.103

🇮🇪 52.169.20.222

🇺🇸 43.159.133.239

🇹🇷 38.60.255.131

🇨🇳 27.18.131.40

🇨🇦 4.204.201.85

🇮🇪 2a06:5900:40c4:2b00:d022:df:2113:6ea9

🇯🇴 176.29.28.87