JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 104.167.242.118

104.167.242.118 was found in our database!

This IP was reported 236 times. Confidence of Abuse is 43%: ?

43%

This address is a Tor exit node. Neither the owner nor the provider are directly behind the offending action.

ISP	MysticDev LLC
Usage Type	Data Center/Web Hosting/Transit
ASN	AS26286
Domain Name	mysticdev.io
Country	🇺🇸 United States of America
City	Spring, Texas

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 104.167.242.118

Whois 104.167.242.118

IP Abuse Reports for 104.167.242.118:

This IP address has been reported a total of 236 times from 90 distinct sources. 104.167.242.118 was first reported on February 1st 2024, and the most recent report was 22 hours ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇩🇪 MusicLibrary	2026-06-05 13:43:05 (22 hours ago)	Attempted access to non existent wordpress urls	Bad Web Bot
Anonymous	2026-06-01 23:52:30 (4 days ago)	(wordpress) Failed wordpress login from 104.167.242.118 (US/United States/-)	Brute-Force
🇩🇪 LRob.fr	2026-05-27 12:15:41 (1 week ago)	Plesk panel login attempt with forbidden username (root/admin), blocked by Fail2Ban in custom-plesk- ... show more Plesk panel login attempt with forbidden username (root/admin), blocked by Fail2Ban in custom-plesk-login jail show less	Brute-Force Web App Attack
🇺🇸 TPI-Abuse	2026-05-26 07:12:59 (1 week ago)	(mod_security) mod_security (id:210730) triggered by 104.167.242.118 (-): 1 in the last 300 secs; Po ... show more (mod_security) mod_security (id:210730) triggered by 104.167.242.118 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue May 26 03:12:55.940852 2026] [security2:error] [pid 21648:tid 21648] [client 104.167.242.118:37722] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy\|\|carbonless.net\|F\|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "carbonless.net"] [uri "/dump.sql"] [unique_id "ahVH9_RKy3JFk9viyVOTpQAAAAk"], referer: carbonless.net/dump.sql show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-05-19 15:03:25 (2 weeks ago)	(mod_security) mod_security (id:210492) triggered by 104.167.242.118 (-): 1 in the last 300 secs; Po ... show more (mod_security) mod_security (id:210492) triggered by 104.167.242.118 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue May 19 11:03:19.608402 2026] [security2:error] [pid 23555:tid 23555] [client 104.167.242.118:39406] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpcontacts.noviasaltovacio.com.mx"] [uri "/.git/config"] [unique_id "agx7t32OxIb0vTqmoY4XhQAAAAI"] show less	Brute-Force Bad Web Bot Web App Attack
🇳🇱 homeshowdomain.nl	2026-05-08 22:03:29 (4 weeks ago)	Auto-ban: >3000 req/min op 2026-05-08	Web App Attack SSH Hacking
Anonymous	2026-05-06 01:01:01 (1 month ago)	2026-05-05 19:00:02,220 fail2ban.actions [3625835]: NOTICE [tor] Ban 104.167.242.118 2026-05 ... show more 2026-05-05 19:00:02,220 fail2ban.actions [3625835]: NOTICE [tor] Ban 104.167.242.118 2026-05-05 21:00:05,555 fail2ban.actions [3625835]: NOTICE [tor] Ban 104.167.242.118 2026-05-06 00:00:03,556 fail2ban.actions [3625835]: NOTICE [tor] Ban 104.167.242.118 2026-05-06 02:00:14,234 fail2ban.actions [3625835]: NOTICE [tor] Ban 104.167.242.118 2026-05-06 04:01:00,730 fail2ban.actions [3625835]: NOTICE [tor] Ban 104.167.242.118 show less	Brute-Force
🇺🇸 oncord	2026-05-05 22:47:15 (1 month ago)	Form spam	Web Spam
🇦🇺 oncord	2026-05-04 17:16:44 (1 month ago)	Form spam	Web Spam
🇦🇺 oncord	2026-05-03 07:08:16 (1 month ago)	Form spam	Web Spam
🇺🇸 TPI-Abuse	2026-04-27 00:22:33 (1 month ago)	(mod_security) mod_security (id:210492) triggered by 104.167.242.118 (-): 1 in the last 300 secs; Po ... show more (mod_security) mod_security (id:210492) triggered by 104.167.242.118 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Apr 26 20:22:28.357108 2026] [security2:error] [pid 12381:tid 12381] [client 104.167.242.118:60396] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpcontacts.representacionesthompson.com"] [uri "/.git/config"] [unique_id "ae6sREp4tvyDPzz4ufrpHAAAAAA"] show less	Brute-Force Bad Web Bot Web App Attack
Anonymous	2026-04-24 18:00:11 (1 month ago)	2026-04-24 12:00:01,810 fail2ban.actions [7718]: NOTICE [tor] Ban 104.167.242.118 2026-04-24 ... show more 2026-04-24 12:00:01,810 fail2ban.actions [7718]: NOTICE [tor] Ban 104.167.242.118 2026-04-24 14:00:07,000 fail2ban.actions [7718]: NOTICE [tor] Ban 104.167.242.118 2026-04-24 16:00:24,584 fail2ban.actions [7718]: NOTICE [tor] Ban 104.167.242.118 2026-04-24 18:01:02,558 fail2ban.actions [7718]: NOTICE [tor] Ban 104.167.242.118 2026-04-24 21:00:06,920 fail2ban.actions [7718]: NOTICE [tor] Ban 104.167.242.118 show less	Brute-Force
🇩🇪 AS213449.net	2026-04-22 06:37:00 (1 month ago)	04/22/2026-08:35:54.471048 104.167.242.118 Protocol: 6 ET TOR Known Tor Exit Node Traffic group 2	Hacking
🇸🇬 securejdprop	2026-04-18 14:26:26 (1 month ago)	This IP was detected by CrowdSec triggering crowdsecurity/suricata-major-severity(ET TOR Known Tor E ... show more This IP was detected by CrowdSec triggering crowdsecurity/suricata-major-severity(ET TOR Known Tor Exit Node Traffic group 2). Ip 104.167.242.118 performed 'crowdsecurity/suricata-major-severity' (1 events over 0s) at 2026-04-18 14:26:25.130900624 +0000 UTC show less	Hacking Web App Attack
Anonymous	2026-04-17 05:21:05 (1 month ago)	Automated bot traffic — residential proxy, fake browser fingerprint. UA="Mozilla/5.0 (Windows NT 10. ... show more Automated bot traffic — residential proxy, fake browser fingerprint. UA="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/84.0.4147.105 Safari/537.36" show less	Bad Web Bot Web App Attack

Showing 1 to 15 of 236 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇨🇳 219.151.190.165

🇨🇳 202.85.222.190

🇨🇭 179.43.146.227

🇩🇪 164.92.161.148

🇳🇱 45.148.10.147

🇯🇵 150.230.103.115

🇺🇸 128.24.160.245

🇺🇸 20.163.2.80

🇰🇷 14.63.196.175

🇩🇪 162.158.111.159

🇺🇸 143.42.0.97

🇨🇳 119.96.223.148

🇨🇦 72.251.5.60

🇬🇧 35.203.211.147

🇨🇳 221.219.183.67

🇳🇱 193.176.31.215

🇦🇷 149.50.145.69

🇮🇹 83.224.168.48

🇸🇬 45.78.204.246

🇰🇷 8.220.207.202