JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

107.152.98.5

Activity Trending Down

Abuse confidence score ?

34% Elevated

509 reports

138 reporters · latest 1 week ago

ISP	Performive LLC
Usage Type	Data Center/Web Hosting/Transit
ASN	AS46562
Domain Name	performive.com
Country	🇺🇸 United States of America
City	Los Angeles, California

ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report Whois

Reports Activity

Example preview

Report Categories (Last 60 Days)

Example preview

Top Reporter Countries (Last 60 Days)

Example preview

Account required for the enhanced features Log in Sign up

IP Abuse Reports for 107.152.98.5

Export CSV

This IP address has been reported a total of 509 times from 138 distinct sources. 107.152.98.5 was first reported on February 1st 2023, and the most recent report was 1 week ago. In the last 60 days, the top reporter locations were: Spain with 2 reports; Netherlands with 2 reports; United States of America with 2 reports. The most common categories in these recent reports were: Bad Web Bot 4 times; Brute-Force 4 times; Web App Attack 3 times; DDoS Attack 2 times; SSH 1 time; Other 3 times.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇪🇸 librebit	2026-10-17 10:02:25 (1 week ago)	Brute force	Brute-Force
🇺🇸 TPI-Abuse	2026-10-12 09:05:01 (1 week ago)	(mod_security) mod_security (id:210492) triggered by 107.152.98.5 (-): 1 in the last 300 secs; Ports ... show more (mod_security) mod_security (id:210492) triggered by 107.152.98.5 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Oct 12 05:04:53.255239 2026] [security2:error] [pid 4954:tid 4954] [client 107.152.98.5:43621] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.english.art.mavikalem.org"] [uri "/wp-config.php"] [unique_id "asyitWSfX20etRHw-Mi1_AAAABw"] show less	Brute-Force Bad Web Bot Web App Attack
🇵🇱 Budyn	2026-10-10 11:20:00 (2 weeks ago)	Budyn SOC Canary Trap: AWS Key Compromised! \| Memo: AWS_Token_11 \| Action: AWS API Call \| Token: 7lg ... show more Budyn SOC Canary Trap: AWS Key Compromised! \| Memo: AWS_Token_11 \| Action: AWS API Call \| Token: 7lggvodiip8vznhits5cv0986 \| Client Tool: [python-requests/2.33.1] show less	Hacking Bad Web Bot Web App Attack
🇳🇱 GES	2026-10-10 06:20:16 (2 weeks ago)	Credential scanning on player_api.php (5 distinct logins in 120s). Auto-blocked by XUI Shield.	DDoS Attack Port Scan
🇺🇦 URAN Publishing Service	2026-10-06 03:53:11 (2 weeks ago)	[06/Oct/2026:06:53:11 +0300] -- 107.152.98.5 Ban reason: Scanner [SENSITIVE_FILES] \| Request: GET /s ... show more [06/Oct/2026:06:53:11 +0300] -- 107.152.98.5 Ban reason: Scanner [SENSITIVE_FILES] \| Request: GET /sitemap.xml.gz HTTP/1.1 show less	Bad Web Bot Web App Attack
🇺🇸 SX Communications	2026-09-20 14:25:56 (1 month ago)	Blocked abusive HTTP application-layer DoS / botnet traffic from 107.152.98.5: traffic from this add ... show more Blocked abusive HTTP application-layer DoS / botnet traffic from 107.152.98.5: traffic from this address continues high-cost dynamic page and feed requests at abusive rates via TCP/HTTPS despite edge block responses. Likely compromised end-user host. show less	DDoS Attack Bad Web Bot Exploited Host
🇪🇸 librebit	2026-09-14 08:47:35 (1 month ago)	Brute force	Brute-Force
Anonymous	2026-09-12 18:19:42 (1 month ago)	Sep 12 20:17:32 dragon sshd[496005]: Invalid user ec2-user from 107.152.98.5 port 52682 Sep 12 20:19 ... show more Sep 12 20:17:32 dragon sshd[496005]: Invalid user ec2-user from 107.152.98.5 port 52682 Sep 12 20:19:39 dragon sshd[496094]: Invalid user git from 107.152.98.5 port 60428 Sep 12 20:19:41 dragon sshd[496126]: Invalid user git from 107.152.98.5 port 44904 ... show less	Brute-Force SSH
🇺🇸 xmission.com	2026-08-18 00:27:18 (2 months ago)	Blocked by UFW (TCP on 9101) Source port: 50448 TTL: 50 Packet length: 60 TOS: 0x08 This report (fo ... show more Blocked by UFW (TCP on 9101) Source port: 50448 TTL: 50 Packet length: 60 TOS: 0x08 This report (for 107.152.98.5) was generated by: https://github.com/sefinek/UFW-AbuseIPDB-Reporter show less	Port Scan
🇺🇸 oncord	2026-08-13 07:09:37 (2 months ago)	Form spam	Web Spam
🇺🇸 SX Communications	2026-08-07 02:18:19 (2 months ago)	Blocked abusive HTTP application-layer DoS / botnet traffic from 107.152.98.5: traffic from this add ... show more Blocked abusive HTTP application-layer DoS / botnet traffic from 107.152.98.5: traffic from this address continues high-cost dynamic page and feed requests at abusive rates via TCP/HTTPS despite edge block responses. Likely compromised end-user host. show less	DDoS Attack Bad Web Bot Exploited Host
🇺🇸 TPI-Abuse	2026-08-05 05:01:30 (2 months ago)	(mod_security) mod_security (id:225170) triggered by 107.152.98.5 (-): 1 in the last 300 secs; Ports ... show more (mod_security) mod_security (id:225170) triggered by 107.152.98.5 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Aug 05 01:01:22.480988 2026] [security2:error] [pid 2845994:tid 2845994] [client 107.152.98.5:42101] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)\|\|wurkroom.biz\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "wurkroom.biz"] [uri "/wp-json/wp/v2/users"] [unique_id "anLDogsRCR_bO0-AUL9NJgAAABk"] show less	Brute-Force Bad Web Bot Web App Attack
🇵🇱 stareradia.pl	2026-08-03 21:34:45 (2 months ago)	[Mon Aug 03 23:33:13.000297 2026] [php:error] [pid 1102328:tid 1102328] [client 107.152.98.5:0] scri ... show more [Mon Aug 03 23:33:13.000297 2026] [php:error] [pid 1102328:tid 1102328] [client 107.152.98.5:0] script '/var/www/html/profile.php' not found or unable to stat, referer: https://forum-trioda.pl/ [Mon Aug 03 23:33:25.662731 2026] [php:error] [pid 1101100:tid 1101100] [client 107.152.98.5:0] script '/var/www/html/profile.php' not found or unable to stat, referer: https://forum-trioda.pl/ [Mon Aug 03 23:33:27.531092 2026] [php:error] [pid 1102692:tid 1102692] [client 107.152.98.5:0] script '/var/www/html/profile.php' not found or unable to stat, referer: https://forum-trioda.pl/ucp.php?mode=register&agreed=true&iscanyesno=yeswecan&step=2&coppa=0 [Mon Aug 03 23:34:44.695544 2026] [php:error] [pid 1106347:tid 1106347] [client 107.152.98.5:0] script '/var/www/html/profile.php' not found or unable to stat, referer: https://forum-trioda.pl/ ... show less	Web App Attack
🇧🇷 ICS Labs	2026-08-01 18:02:44 (2 months ago)	ICS Labs identified 107.152.98.5 as a malicious indicator from threat intelligence.	Hacking
🇪🇸 librebit	2026-07-28 12:40:50 (2 months ago)	Brute force	Brute-Force

Showing 1 to 15 of 509 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇳🇱 178.16.55.120

🇧🇷 164.163.12.254

🇪🇨 157.100.138.99

🇲🇾 103.71.176.234

🇬🇧 86.38.187.30

🇬🇧 64.205.72.157

🇰🇷 61.76.38.54

🇺🇸 23.234.83.225

🇪🇸 5.182.83.231

🇬🇧 217.146.80.105

🇨🇭 209.99.190.186

🇬🇧 200.138.46.215

🇵🇱 194.180.49.216

🇫🇮 193.187.110.159

🇨🇦 187.13.243.41

🇧🇷 186.225.14.231

🇬🇧 185.216.145.166

🇫🇷 92.154.10.165

🇦🇪 91.73.127.28

🇲🇾 59.153.151.173