JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 152.53.32.167

152.53.32.167 was found in our database!

This IP was reported 24 times. Confidence of Abuse is 70%: ?

70%

This address is a Tor exit node. Neither the owner nor the provider are directly behind the offending action.

ISP	powered by ANX
Usage Type	Data Center/Web Hosting/Transit
ASN	AS197540
Hostname(s)	tor-exit.stinklink.net
Domain Name	anexia.com
Country	🇦🇹 Austria
City	Vienna, State of Vienna

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 152.53.32.167

Whois 152.53.32.167

IP Abuse Reports for 152.53.32.167:

This IP address has been reported a total of 24 times from 15 distinct sources. 152.53.32.167 was first reported on May 12th 2026, and the most recent report was 7 hours ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇳🇱 homeshowdomain.nl	2026-06-06 21:59:33 (7 hours ago)	Auto-ban: single probe for restricted files (.env / backups / admin endpoints). Likely mass-scan on ... show more Auto-ban: single probe for restricted files (.env / backups / admin endpoints). Likely mass-scan on 2026-06-05. show less	Web App Attack SSH Hacking
🇫🇷 dynamix	2026-06-06 14:42:08 (14 hours ago)	Multiple WAF Violations	Web App Attack
🇳🇱 homeshowdomain.nl	2026-06-04 22:00:13 (2 days ago)	Auto-ban: >3000 req/min op 2026-06-04	Web App Attack SSH Hacking
🇸🇬 securejdprop	2026-06-04 10:20:27 (2 days ago)	This IP was detected by CrowdSec triggering crowdsecurity/suricata-major-severity(ET TOR Known Tor E ... show more This IP was detected by CrowdSec triggering crowdsecurity/suricata-major-severity(ET TOR Known Tor Exit Node Traffic group 17). Ip 152.53.32.167 performed 'crowdsecurity/suricata-major-severity' (1 events over 0s) at 2026-06-04 10:20:25.777896688 +0000 UTC show less	Hacking Web App Attack
🇺🇸 TPI-Abuse	2026-06-02 04:05:53 (5 days ago)	(mod_security) mod_security (id:210492) triggered by 152.53.32.167 (tor-exit.stinklink.net): 1 in th ... show more (mod_security) mod_security (id:210492) triggered by 152.53.32.167 (tor-exit.stinklink.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jun 02 00:05:49.574796 2026] [security2:error] [pid 12039:tid 12039] [client 152.53.32.167:35154] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpcontacts.nutz-r-us.com"] [uri "/.git/config"] [unique_id "ah5WnZi4OUX43YQyx_UOCgAAAAE"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 xmission.com	2026-06-01 09:53:39 (5 days ago)	Blocked by UFW (TCP on 38670) Source port: 42530 TTL: 45 Packet length: 60 TOS: 0x08 This report (f ... show more Blocked by UFW (TCP on 38670) Source port: 42530 TTL: 45 Packet length: 60 TOS: 0x08 This report (for 152.53.32.167) was generated by: https://github.com/sefinek/UFW-AbuseIPDB-Reporter show less	Port Scan
🇩🇪 big-cloud.nl	2026-05-31 04:20:22 (1 week ago)	Try to access /xmlrpc.php?rsd	Web App Attack
🇺🇸 TPI-Abuse	2026-05-30 12:02:25 (1 week ago)	(mod_security) mod_security (id:210730) triggered by 152.53.32.167 (tor-exit.stinklink.net): 1 in th ... show more (mod_security) mod_security (id:210730) triggered by 152.53.32.167 (tor-exit.stinklink.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat May 30 08:02:19.624713 2026] [security2:error] [pid 8215:tid 8215] [client 152.53.32.167:41914] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy\|\|sailyourkayak.com\|F\|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "sailyourkayak.com"] [uri "/dump.sql"] [unique_id "ahrRy53PQXTXVlPiX8CuXAAAAAI"], referer: sailyourkayak.com/dump.sql show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 xmission.com	2026-05-30 10:43:19 (1 week ago)	Blocked by UFW (TCP on 38670) Source port: 59286 TTL: 44 Packet length: 60 TOS: 0x08 This report (f ... show more Blocked by UFW (TCP on 38670) Source port: 59286 TTL: 44 Packet length: 60 TOS: 0x08 This report (for 152.53.32.167) was generated by: https://github.com/sefinek/UFW-AbuseIPDB-Reporter show less	Port Scan
🇺🇸 TPI-Abuse	2026-05-29 20:25:58 (1 week ago)	(mod_security) mod_security (id:210730) triggered by 152.53.32.167 (tor-exit.stinklink.net): 1 in th ... show more (mod_security) mod_security (id:210730) triggered by 152.53.32.167 (tor-exit.stinklink.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri May 29 16:25:54.744839 2026] [security2:error] [pid 25228:tid 25228] [client 152.53.32.167:56996] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy\|\|nwarchitect.com\|F\|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "nwarchitect.com"] [uri "/dump.sql"] [unique_id "ahn2UhfgTwTOZoZbgobCQwAAAAI"], referer: nwarchitect.com/dump.sql show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 xmission.com	2026-05-29 06:24:19 (1 week ago)	Blocked by UFW (TCP on 32460) Source port: 50080 TTL: 44 Packet length: 60 TOS: 0x08 This report (f ... show more Blocked by UFW (TCP on 32460) Source port: 50080 TTL: 44 Packet length: 60 TOS: 0x08 This report (for 152.53.32.167) was generated by: https://github.com/sefinek/UFW-AbuseIPDB-Reporter show less	Port Scan
🇺🇸 TPI-Abuse	2026-05-28 23:59:15 (1 week ago)	(mod_security) mod_security (id:210730) triggered by 152.53.32.167 (tor-exit.stinklink.net): 1 in th ... show more (mod_security) mod_security (id:210730) triggered by 152.53.32.167 (tor-exit.stinklink.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu May 28 19:59:10.060628 2026] [security2:error] [pid 13140:tid 13140] [client 152.53.32.167:40252] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy\|\|needtoorderprinting.com\|F\|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "needtoorderprinting.com"] [uri "/dump.sql"] [unique_id "ahjWzhCtjPn0yDXTdvN6jAAAAIg"], referer: needtoorderprinting.com/dump.sql show less	Brute-Force Bad Web Bot Web App Attack
🇩🇪 Vegascosmetics	2026-05-28 21:54:45 (1 week ago)	Kingcopy(AI-IDS): IP is wandering around the site and acting suspiciously.	Bad Web Bot
🇩🇪 grassau.com	2026-05-27 18:55:29 (1 week ago)	(plesk-panel) Failed plesk-panel login with username [redacted] from 152.53.32.167 (DE/Germany/Bavar ... show more (plesk-panel) Failed plesk-panel login with username [redacted] from 152.53.32.167 (DE/Germany/Bavaria/Nuremberg/tor-exit.stinklink.net) show less	Brute-Force
🇺🇸 xmission.com	2026-05-25 19:53:39 (1 week ago)	Blocked by UFW (TCP on 55756) Source port: 56064 TTL: 45 Packet length: 60 TOS: 0x08 This report (f ... show more Blocked by UFW (TCP on 55756) Source port: 56064 TTL: 45 Packet length: 60 TOS: 0x08 This report (for 152.53.32.167) was generated by: https://github.com/sefinek/UFW-AbuseIPDB-Reporter show less	Port Scan

Showing 1 to 15 of 24 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇺🇸 208.84.100.229

🇸🇬 47.79.51.38

🇺🇸 208.84.100.220

🇧🇷 200.108.174.4

🇬🇧 195.206.182.207

🇨🇴 191.156.123.161

🇧🇷 177.72.86.105

🇺🇸 147.185.132.89

🇸🇬 47.82.8.217

🇸🇬 43.156.127.60

🇺🇸 35.254.244.123

🇷🇺 178.176.224.83

🇭🇰 152.32.239.90

🇻🇳 113.172.13.140

🇩🇪 109.250.168.41

🇳🇱 91.92.243.20

🇺🇸 20.168.124.0

🇨🇳 14.22.79.82

🇨🇭 209.99.188.148

🇮🇳 182.95.233.154