JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 82.152.211.71

82.152.211.71 was found in our database!

This IP was reported 33 times. Confidence of Abuse is 100%: ?

100%

ISP	GCI Network Solutions Limited
Usage Type	Data Center/Web Hosting/Transit
ASN	AS16276
Domain Name	nasstar.com
Country	🇩🇪 Germany
City	Limburg an der Lahn, Hesse

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 82.152.211.71

Whois 82.152.211.71

IP Abuse Reports for 82.152.211.71:

This IP address has been reported a total of 33 times from 30 distinct sources. 82.152.211.71 was first reported on August 17th 2026, and the most recent report was 1 week ago.

Old Reports: The most recent abuse report for this IP address is from 1 week ago . It is possible that this IP is no longer involved in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇺🇸 yzfdude1	2026-08-17 23:29:32 (1 week ago)	2026-08-17T17:28:57.805070-06:00 coordinator sshd[4009845]: pam_unix(sshd:auth): authentication fail ... show more 2026-08-17T17:28:57.805070-06:00 coordinator sshd[4009845]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=82.152.211.71 2026-08-17T17:28:59.350003-06:00 coordinator sshd[4009845]: Failed password for invalid user admin from 82.152.211.71 port 49736 ssh2 2026-08-17T17:29:31.313263-06:00 coordinator sshd[4009848]: Invalid user orangepi from 82.152.211.71 port 52074 ... show less	Brute-Force SSH
🇺🇸 TPI-Abuse	2026-08-17 23:27:12 (1 week ago)	(mod_security) mod_security (id:218420) triggered by 82.152.211.71 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:218420) triggered by 82.152.211.71 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Aug 17 19:27:07.797292 2026] [security2:error] [pid 5437:tid 5437] [client 82.152.211.71:36876] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i)php://(std(in\|out\|err)\|(in\|out)put\|fd\|memory\|temp\|filter)" at ARGS_NAMES:\\xadd allow_url_include=1 \\xadd auto_prepend_file=php://input. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/21_PHP_PHPGen.conf"] [line "22"] [id "218420"] [rev "2"] [msg "COMODO WAF: PHP Injection Attack: I/O Stream Found\|\|192.64.150.150:443\|F\|2"] [data "Matched Data: php://input found within ARGS_NAMES:\\x5cxadd allow_url_include=1 \\x5cxadd auto_prepend_file=php://input: \\xadd allow_url_include=1 \\xadd auto_prepend_file=php://input"] [severity "CRITICAL"] [tag "CWAF"] [tag "PHPGen"] [hostname "192.64.150.150"] [uri "/hello.world"] [unique_id "aoOYy6Lk0Szhkdtw2vWo4QAAAAM"] show less	Brute-Force Bad Web Bot Web App Attack
🇱🇹 sobakintech	2026-08-17 23:25:41 (1 week ago)	Detected by CrowdSec on Traefik reverse proxy: crowdsecurity/http-probing	Port Scan Web App Attack
🇩🇪 focusnic.com	2026-08-17 23:23:25 (1 week ago)	Multiple SSH login attempts from 82.152.211.71 targeting user(s): orangepi,root \| Server Managed by ... show more Multiple SSH login attempts from 82.152.211.71 targeting user(s): orangepi,root \| Server Managed by Focusnic show less	Brute-Force SSH
🇩🇪 simsung	2026-08-17 22:46:19 (1 week ago)	82.152.211.71 - - [17/Aug/2026:22:46:17 +0000] "POST /index.php?%25ADd+allow_url_include%3D1+%25ADd+ ... show more 82.152.211.71 - - [17/Aug/2026:22:46:17 +0000] "POST /index.php?%25ADd+allow_url_include%3D1+%25ADd+auto_prepend_file%3Dphp://input HTTP/1.1" 404 146 "-" "libredtail-http" 82.152.211.71 - - [17/Aug/2026:22:46:18 +0000] "POST /index.php?-d+allow_url_include%3don+-d+auto_prepend_file%3dphp%3a//input HTTP/1.1" 404 146 "-" "libredtail-http" 82.152.211.71 - - [17/Aug/2026:22:46:18 +0000] "GET /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1" 404 146 "-" "libredtail-http" ... show less	Web App Attack
Anonymous	2026-08-17 22:03:53 (1 week ago)	ssh bruteforce	Brute-Force SSH
🇧🇾 sashan	2026-08-17 21:00:22 (1 week ago)	2026-08-18T00:00:22.068292+03:00 gate kernel: nftables: JAIL-MSS IN=wan OUT= MAC= SRC=82.152.211.71 ... show more 2026-08-18T00:00:22.068292+03:00 gate kernel: nftables: JAIL-MSS IN=wan OUT= MAC= SRC=82.152.211.71 DST=xxx.xxx.xxx.xxx LEN=44 TOS=0x00 PREC=0x00 TTL=50 ID=52375 PROTO=TCP SPT=56001 DPT=2375 WINDOW=65535 RES=0x00 SYN URGP=0 ... show less	Port Scan
🇺🇸 TPI-Abuse	2026-08-17 20:26:47 (1 week ago)	(mod_security) mod_security (id:218420) triggered by 82.152.211.71 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:218420) triggered by 82.152.211.71 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Aug 17 16:26:40.516454 2026] [security2:error] [pid 10131:tid 10131] [client 82.152.211.71:38536] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i)php://(std(in\|out\|err)\|(in\|out)put\|fd\|memory\|temp\|filter)" at ARGS_NAMES:\\xadd allow_url_include=1 \\xadd auto_prepend_file=php://input. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/21_PHP_PHPGen.conf"] [line "22"] [id "218420"] [rev "2"] [msg "COMODO WAF: PHP Injection Attack: I/O Stream Found\|\|192.64.150.101:80\|F\|2"] [data "Matched Data: php://input found within ARGS_NAMES:\\x5cxadd allow_url_include=1 \\x5cxadd auto_prepend_file=php://input: \\xadd allow_url_include=1 \\xadd auto_prepend_file=php://input"] [severity "CRITICAL"] [tag "CWAF"] [tag "PHPGen"] [hostname "192.64.150.101"] [uri "/hello.world"] [unique_id "aoNugJ6WwuT6iGgBNdQQ4QAAAAQ"] show less	Brute-Force Bad Web Bot Web App Attack
🇬🇧 billy549	2026-08-17 20:25:20 (1 week ago)	2026-08-17T20:19:35.192979+00:00 boron.billy.wales sshd-session[3817118]: Invalid user admin from 82 ... show more 2026-08-17T20:19:35.192979+00:00 boron.billy.wales sshd-session[3817118]: Invalid user admin from 82.152.211.71 port 45826 2026-08-17T20:20:06.066207+00:00 boron.billy.wales sshd-session[3817305]: Invalid user orangepi from 82.152.211.71 port 52212 2026-08-17T20:23:44.460950+00:00 boron.billy.wales sshd-session[3818061]: Invalid user test from 82.152.211.71 port 59662 2026-08-17T20:24:16.391595+00:00 boron.billy.wales sshd-session[3818235]: Invalid user user from 82.152.211.71 port 53118 2026-08-17T20:25:19.265464+00:00 boron.billy.wales sshd-session[3818832]: Invalid user admin from 82.152.211.71 port 54834 ... show less	Brute-Force SSH
🇳🇱 ArtVitU	2026-08-17 19:44:51 (1 week ago)	2026-08-17T19:39:06.704299+00:00 vultr sshd[1446185]: Invalid user admin from 82.152.211.71 port 416 ... show more 2026-08-17T19:39:06.704299+00:00 vultr sshd[1446185]: Invalid user admin from 82.152.211.71 port 41610 2026-08-17T19:39:38.622415+00:00 vultr sshd[1446625]: Invalid user orangepi from 82.152.211.71 port 42040 2026-08-17T19:43:17.604853+00:00 vultr sshd[1449922]: Invalid user test from 82.152.211.71 port 50108 2026-08-17T19:43:49.105738+00:00 vultr sshd[1450362]: Invalid user user from 82.152.211.71 port 56952 2026-08-17T19:44:50.471785+00:00 vultr sshd[1451298]: Invalid user admin from 82.152.211.71 port 51452 ... show less	Brute-Force SSH
🇲🇳 Public CSIRT/CC of Mongolia	2026-08-17 19:40:35 (1 week ago)	Honeypot hit: Brute-force attack detected on 23/TELNET • Credentials used: admin:admin, orangepi:ora ... show more Honeypot hit: Brute-force attack detected on 23/TELNET • Credentials used: admin:admin, orangepi:orangepi, root:P, root:password, root:root • Number of login attempts: 5 • 16 command(s) were executed during the session show less	Hacking Brute-Force IoT Targeted Exploited Host
🇬🇧 djboddington	2026-08-17 18:54:08 (1 week ago)	This IP was detected by CrowdSec triggering crowdsecurity/ssh-slow-bf	SSH Brute-Force
🇧🇾 lns.bz	2026-08-17 18:25:04 (1 week ago)	Too many 404 requests [BY]	Web App Attack
🇭🇺 KaroX	2026-08-17 18:24:34 (1 week ago)	2026-08-17T20:22:32.606630+02:00 karoxnet.hu sshd[149007]: Invalid user admin from 82.152.211.71 por ... show more 2026-08-17T20:22:32.606630+02:00 karoxnet.hu sshd[149007]: Invalid user admin from 82.152.211.71 port 38738 2026-08-17T20:23:02.883881+02:00 karoxnet.hu sshd[149010]: Invalid user orangepi from 82.152.211.71 port 42784 2026-08-17T20:23:33.147260+02:00 karoxnet.hu sshd[149012]: User root from 82.152.211.71 not allowed because not listed in AllowUsers 2026-08-17T20:24:03.397290+02:00 karoxnet.hu sshd[149014]: User root from 82.152.211.71 not allowed because not listed in AllowUsers 2026-08-17T20:24:33.702671+02:00 karoxnet.hu sshd[149016]: User root from 82.152.211.71 not allowed because not listed in AllowUsers ... show less	SSH
🇺🇸 TPI-Abuse	2026-08-17 17:57:58 (1 week ago)	(mod_security) mod_security (id:218420) triggered by 82.152.211.71 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:218420) triggered by 82.152.211.71 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Aug 17 13:57:52.725251 2026] [security2:error] [pid 30694:tid 30910] [client 82.152.211.71:33198] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i)php://(std(in\|out\|err)\|(in\|out)put\|fd\|memory\|temp\|filter)" at ARGS_NAMES:\\xadd allow_url_include=1 \\xadd auto_prepend_file=php://input. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/21_PHP_PHPGen.conf"] [line "22"] [id "218420"] [rev "2"] [msg "COMODO WAF: PHP Injection Attack: I/O Stream Found\|\|192.64.150.201:443\|F\|2"] [data "Matched Data: php://input found within ARGS_NAMES:\\x5cxadd allow_url_include=1 \\x5cxadd auto_prepend_file=php://input: \\xadd allow_url_include=1 \\xadd auto_prepend_file=php://input"] [severity "CRITICAL"] [tag "CWAF"] [tag "PHPGen"] [hostname "192.64.150.201"] [uri "/hello.world"] [unique_id "aoNLoMULDaCXKWrl15xuWQAAAM8"] show less	Brute-Force Bad Web Bot Web App Attack

Showing 1 to 15 of 33 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇨🇳 220.163.252.244

🇨🇳 218.22.0.200

🇱🇹 213.176.26.82

🇮🇹 213.149.216.10

🇮🇳 203.192.232.180

🇧🇷 201.28.176.31

🇭🇰 199.45.155.49

🇬🇧 195.96.139.62

🇫🇷 172.71.232.83

🇮🇩 103.41.206.83

🇹🇼 60.199.224.2

🇺🇸 20.184.175.2

🇺🇸 195.184.76.193

🇹🇷 188.59.178.27

🇧🇷 186.194.83.221

🇮🇳 182.95.226.138

🇮🇳 182.78.65.154

🇺🇸 152.32.182.41

🇨🇳 115.190.117.228

🇨🇳 58.50.204.96