JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 82.153.138.184

82.153.138.184 was found in our database!

This IP was reported 90 times. Confidence of Abuse is 45%: ?

45%

This address is a Tor exit node. Neither the owner nor the provider are directly behind the offending action.

ISP	Internet Utilities Europe and Asia Limited
Usage Type	Data Center/Web Hosting/Transit
ASN	AS215659
Domain Name	netutils.io
Country	🇷🇴 Romania
City	Bucharest, Bucharest

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 82.153.138.184

Whois 82.153.138.184

IP Abuse Reports for 82.153.138.184:

This IP address has been reported a total of 90 times from 57 distinct sources. 82.153.138.184 was first reported on September 19th 2024, and the most recent report was 5 days ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
Anonymous	2026-06-02 00:04:39 (5 days ago)	Ports: 80,443; Direction: 0; Trigger: LF_CUSTOMTRIGGER	Brute-Force SSH
🇪🇸 SweetHoneyPress	2026-05-27 20:17:58 (1 week ago)	WordPress honeypot: POST to /xmlrpc.php \| event_id=688073 \| UA: Mozilla/5.0 (Windows NT 10.0; Win64; ... show more WordPress honeypot: POST to /xmlrpc.php \| event_id=688073 \| UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0 show less	Web App Attack Brute-Force
🇩🇪 LRob.fr	2026-05-27 12:00:36 (1 week ago)	Plesk panel login attempt with forbidden username (root/admin), blocked by Fail2Ban in custom-plesk- ... show more Plesk panel login attempt with forbidden username (root/admin), blocked by Fail2Ban in custom-plesk-login jail show less	Brute-Force Web App Attack
🇩🇪 LRob.fr	2026-05-26 11:30:04 (1 week ago)	Repeated requests on blocked xmlrpc.php, blocked by fail2ban in custom-503-xmlrpc jail	Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-05-25 07:58:46 (1 week ago)	(mod_security) mod_security (id:210492) triggered by 82.153.138.184 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210492) triggered by 82.153.138.184 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon May 25 03:58:39.149826 2026] [security2:error] [pid 14759:tid 14759] [client 82.153.138.184:42680] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpcalendars.garanta.co"] [uri "/.git/config"] [unique_id "ahQBL7Kar8As0RVtlLMizQAAAAU"] show less	Brute-Force Bad Web Bot Web App Attack
🇦🇺 oncord	2026-05-25 07:49:52 (1 week ago)	Form spam	Web Spam
🇺🇸 TPI-Abuse	2026-05-24 16:33:10 (1 week ago)	(mod_security) mod_security (id:210730) triggered by 82.153.138.184 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210730) triggered by 82.153.138.184 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun May 24 12:33:03.743088 2026] [security2:error] [pid 28142:tid 28142] [client 82.153.138.184:59854] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy\|\|michaelhick.com\|F\|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "michaelhick.com"] [uri "/dump.sql"] [unique_id "ahMoPzdFn85pRFC3PlVZ3wAAABo"], referer: michaelhick.com/dump.sql show less	Brute-Force Bad Web Bot Web App Attack
🇳🇱 Kotiacat_one	2026-05-24 05:51:21 (2 weeks ago)	2026-05-24T08:51:20.578851+03:00 kotiacat.nexus sshd-session[11274]: Invalid user 1 from 82.153.138. ... show more 2026-05-24T08:51:20.578851+03:00 kotiacat.nexus sshd-session[11274]: Invalid user 1 from 82.153.138.184 port 52810 ... show less	Brute-Force SSH
🇺🇸 TPI-Abuse	2026-05-23 19:23:55 (2 weeks ago)	(mod_security) mod_security (id:210730) triggered by 82.153.138.184 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210730) triggered by 82.153.138.184 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat May 23 15:23:51.713486 2026] [security2:error] [pid 4873:tid 4873] [client 82.153.138.184:33026] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy\|\|etoyfun.com\|F\|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "etoyfun.com"] [uri "/dump.sql"] [unique_id "ahH-x0CdM8BZFmOp8if3vwAAAAY"], referer: etoyfun.com/dump.sql show less	Brute-Force Bad Web Bot Web App Attack
🇩🇪 ger-stg-sifi1	2026-05-23 10:55:52 (2 weeks ago)	(wordpress) Failed wordpress login using wp-login.php or xmlrpc.php	Web App Attack
🇦🇺 oncord	2026-05-23 05:58:44 (2 weeks ago)	Form spam	Web Spam
🇳🇱 Kotiacat_one	2026-05-23 05:26:49 (2 weeks ago)	2026-05-23T08:26:49.104738+03:00 kotiacat.nexus sshd-session[4746]: Invalid user 1 from 82.153.138.1 ... show more 2026-05-23T08:26:49.104738+03:00 kotiacat.nexus sshd-session[4746]: Invalid user 1 from 82.153.138.184 port 53860 ... show less	Brute-Force SSH
🇳🇱 ByeByte API	2026-05-16 20:00:26 (3 weeks ago)	byebyte.space auth: Rate-limit escalation at 2026-05-16T20:00:25Z: 5 rejections in 300s. Firewall au ... show more byebyte.space auth: Rate-limit escalation at 2026-05-16T20:00:25Z: 5 rejections in 300s. Firewall auto-banned IP for 900s. UA: 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.99 Safari/537.36 Edg/97.0.1072.91'. Accept-Language: 'en-US,en;q=0.9'. Accept-Encoding: 'gzip, br'. Country (CF): T. TLS info: {"scheme":"https"}. show less	Web App Attack DDoS Attack
🇬🇧 oncord	2026-04-30 15:16:36 (1 month ago)	Form spam	Web Spam
🇧🇪 voormedia	2026-04-15 21:04:27 (1 month ago)	Accessed trap at '/.git/config'	Web App Attack

Showing 1 to 15 of 90 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇬🇧 188.29.111.4

🇧🇷 168.196.132.34

🇯🇵 150.109.198.102

🇮🇳 125.19.248.162

🇧🇬 79.124.62.126

🇲🇾 49.125.201.63

🇨🇳 47.95.209.49

🇫🇷 194.5.53.206

🇷🇺 185.94.111.1

🇹🇭 184.22.108.216

🇧🇷 181.233.135.220

🇷🇺 178.205.245.200

🇺🇸 162.216.149.244

🇺🇸 146.88.241.65

🇮🇳 122.187.229.201

🇫🇷 78.197.6.173

🇭🇰 43.242.203.160

🇺🇸 20.127.185.37

🇷🇴 2.57.122.177

🇳🇱 213.177.179.171