JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 82.153.138.184

82.153.138.184 was found in our database!

This IP was reported 109 times. Confidence of Abuse is 67%: ?

67%

This address is a Tor exit node. Neither the owner nor the provider are directly behind the offending action.

ISP	Internet Utilities Europe and Asia Limited
Usage Type	Data Center/Web Hosting/Transit
ASN	AS215659
Domain Name	netutils.io
Country	🇷🇴 Romania
City	Popesti-Leordeni, Ilfov

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 82.153.138.184

Whois 82.153.138.184

IP Abuse Reports for 82.153.138.184:

This IP address has been reported a total of 109 times from 67 distinct sources. 82.153.138.184 was first reported on September 19th 2024, and the most recent report was 2 days ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇩🇪 MusicLibrary	2026-07-05 18:51:36 (2 days ago)	Probing foreign-stack admin panels / known exploit paths (Joomla, phpMyAdmin, phpunit, OWA, etc.)	Bad Web Bot Web App Attack
🇷🇴 eddy.ro	2026-07-05 18:41:12 (2 days ago)	[Sun Jul 05 21:41:09.649507 2026] [php:error] [pid 2285750] [client 82.153.138.184:56088] script '/v ... show more [Sun Jul 05 21:41:09.649507 2026] [php:error] [pid 2285750] [client 82.153.138.184:56088] script '/var/www/html/index.php' not found or unable to stat [Sun Jul 05 21:41:09.898622 2026] [php:error] [pid 2285750] [client 82.153.138.184:56088] script '/var/www/html/index.php' not found or unable to stat [Sun Jul 05 21:41:10.305047 2026] [php:error] [pid 2285750] [client 82.153.138.184:56088] script '/var/www/html/index.php' not found or unable to stat [Sun Jul 05 21:41:10.531977 2026] [php:error] [pid 2285750] [client 82.153.138.184:56088] script '/var/www/html/index.php' not found or unable to stat [Sun Jul 05 21:41:11.176017 2026] [php:error] [pid 2285750] [client 82.153.138.184:56088] script '/var/www/html/index.php' not found or unable to stat [Sun Jul 05 21:41:11.660638 2026] [php:error] [pid 2285750] [client 82.153.138.184:56088] script '/var/www/html/index.php' not found or unable to stat ... show less	DDoS Attack Web App Attack
🇺🇸 factor1	2026-07-02 20:20:47 (5 days ago)	Fail2ban at saturn Reports Abuse.	Brute-Force Web App Attack
🇫🇷 dynamix	2026-06-30 16:32:02 (1 week ago)	Multiple WAF Violations	Web App Attack
🇩🇪 raph	2026-06-25 19:05:32 (1 week ago)	[SQL UNION SELECT] f2b match %{+Q}r for ^.haproxy\[[0-9]+\]: <HOST>:. (GET \|POST ).\?.(UNION%20\| ... show more [SQL UNION SELECT] f2b match %{+Q}r for ^.haproxy\[[0-9]+\]: <HOST>:. (GET \|POST ).\?.(UNION%20\|union%20\|SELECT%20\|select%20).* HTTP/1.1$ show less	SQL Injection
🇺🇸 TPI-Abuse	2026-06-23 20:22:26 (2 weeks ago)	(mod_security) mod_security (id:225170) triggered by 82.153.138.184 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:225170) triggered by 82.153.138.184 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jun 23 16:22:19.187767 2026] [security2:error] [pid 8458:tid 8458] [client 82.153.138.184:39272] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)\|\|taekwondoit.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "taekwondoit.com"] [uri "/wp-json/wp/v2/users"] [unique_id "ajrq-_wFGuAfuB9VzBGFRwAAAAs"] show less	Brute-Force Bad Web Bot Web App Attack
Anonymous	2026-06-22 22:51:59 (2 weeks ago)		Web App Attack SSH
🇧🇷 ICS Labs	2026-06-22 15:45:34 (2 weeks ago)	ICS Labs identified 82.153.138.184 as a malicious indicator from threat intelligence.	DDoS Attack Port Scan Hacking Brute-Force Exploited Host
🇪🇸 gnom4ik	2026-06-22 05:26:33 (2 weeks ago)	ban-reviewer auto report; ip=82.153.138.184; scenario=ssh:bruteforce; scenario_context=ssh:bruteforc ... show more ban-reviewer auto report; ip=82.153.138.184; scenario=ssh:bruteforce; scenario_context=ssh:bruteforce,tor-exit-nodes; verdict=valid_ban; confidence=0.92; categories=18,22; active_decisions=2; lookback_decisions=2; nginx_requests=0; appsec_matches=0; auth_events=0; kernel_events=0; signals=ip_decision_count_high show less	Brute-Force SSH
🇩🇪 big-cloud.nl	2026-06-21 21:39:58 (2 weeks ago)	Try to access /xmlrpc.php?rsd	Web App Attack
🇺🇸 TPI-Abuse	2026-06-21 11:52:20 (2 weeks ago)	(mod_security) mod_security (id:210492) triggered by 82.153.138.184 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210492) triggered by 82.153.138.184 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Jun 21 07:52:13.243995 2026] [security2:error] [pid 24978:tid 24978] [client 82.153.138.184:35250] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "webdisk.camasmarket.com"] [uri "/.git/config"] [unique_id "ajfQbWw3wKLwzx8LuGRE7QAAAAY"] show less	Brute-Force Bad Web Bot Web App Attack
🇩🇪 LRob	2026-06-18 15:30:05 (2 weeks ago)	Repeated requests on blocked xmlrpc.php, blocked by fail2ban in custom-503-xmlrpc jail	Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-06-17 23:44:04 (2 weeks ago)	(mod_security) mod_security (id:225170) triggered by 82.153.138.184 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:225170) triggered by 82.153.138.184 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jun 17 19:43:55.634742 2026] [security2:error] [pid 19299:tid 19299] [client 82.153.138.184:36740] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)\|\|earthtwoworkshop.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "earthtwoworkshop.com"] [uri "/wp-json/wp/v2/users"] [unique_id "ajMxOzY0GEc9LkhKRQPC2wAAAAE"] show less	Brute-Force Bad Web Bot Web App Attack
🇦🇺 oncord	2026-06-17 00:52:54 (2 weeks ago)	Form spam	Web Spam
🇩🇪 LRob	2026-06-15 22:45:05 (3 weeks ago)	Repeated requests on blocked xmlrpc.php, blocked by fail2ban in custom-503-xmlrpc jail	Bad Web Bot Web App Attack

Showing 1 to 15 of 109 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇺🇸 2a04:4e40:e010:0:514:e490:8f89:4510

🇧🇷 179.176.210.17

🇬🇧 172.187.176.79

🇺🇸 172.174.166.199

🇩🇪 91.192.10.213

🇱🇹 62.60.130.219

🇳🇱 31.76.78.140

🇷🇴 2.57.122.168

🇧🇪 198.235.24.167

🇧🇷 177.188.163.168

🇻🇳 171.225.248.177

🇮🇳 171.61.167.26

🇫🇮 147.185.133.135

🇮🇳 103.248.120.6

🇫🇷 85.217.140.9

🇰🇷 58.65.73.22

🇺🇸 20.106.17.55

🇩🇪 2a04:4e40:e000:0:810:39ca:bd35:c5cc

🇫🇷 212.47.78.27

🇧🇷 205.210.31.206