AbuseIPDB » 104.168.133.58

104.168.133.58 was found in our database!

This IP was reported 10 times. Confidence of Abuse is 24%: ?

24%

ISP	Hostwinds Seattle
Usage Type	Data Center/Web Hosting/Transit
Hostname(s)	hwsrv-1251681.hostwindsdns.com
Domain Name	hostwinds.com
Country	United States of America
City	Seattle, Washington

Report 104.168.133.58

Whois 104.168.133.58

IP Abuse Reports for 104.168.133.58:

This IP address has been reported a total of 10 times from 9 distinct sources. 104.168.133.58 was first reported on October 28th 2024, and the most recent report was 1 month ago.

Old Reports: The most recent abuse report for this IP address is from 1 month ago. It is possible that this IP is no longer involved in abusive activities.

Reporter	IoA Timestamp in UTC	Comment	Categories
TPI-Abuse	2024-10-29 10:04:06 (1 month ago)	(mod_security) mod_security (id:217280) triggered by 104.168.133.58 (client-104-168-133-58.hostwinds ... show more(mod_security) mod_security (id:217280) triggered by 104.168.133.58 (client-104-168-133-58.hostwindsdns.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 29 06:04:01.416872 2024] [security2:error] [pid 22154:tid 22154] [client 104.168.133.58:53774] [client 104.168.133.58] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?:\\\\n\|\\\\r)+(?:get\|post\|head\|options\|connect\|put\|delete\|trace\|propfind\|propatch\|mkcol\|copy\|move\|lock\|unlock)\\\\s+" at MATCHED_VAR. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "137"] [id "217280"] [rev "6"] [msg "COMODO WAF: HTTP Request Smuggling Attack\|\|nypdkids.org\|F\|2"] [data "Matched Data: get found within MATCHED_VAR"] [severity "CRITICAL"] [tag "CWAF"] [tag "Protocol"] [hostname "nypdkids.org"] [uri "/php/send_email.php"] [unique_id "ZyCzERjOZrOw6FLIbNgjBAAAAAg"], referer: http://nypdkids.org/contact-donate-nypd-kids.html show less	Brute-Force Bad Web Bot Web App Attack
el-brujo	2024-10-29 08:05:39 (1 month ago)	29/Oct/2024:09:05:38.935578 +0100Apache-Error: [file "apache2_util.c"] [line 271] [level 3] [client ... show more29/Oct/2024:09:05:38.935578 +0100Apache-Error: [file "apache2_util.c"] [line 271] [level 3] [client 104.168.133.58] ModSecurity: Rule 55aca597daa0 [id "932140"][file "/etc/httpd/modsecurity.d/activated_rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"][line "413"] - Execution error - PCRE limits exceeded (-8): (null). [hostname "www.hostench.eu"] [uri "/wp-json/contact-form-7/v1/contact-forms/296/feedback"] [unique_id "ZyCXUqu7GQnE1Q96Yj01-AABth8"] ... show less	Hacking Web App Attack
LRob.fr	2024-10-29 07:30:07 (1 month ago)	WAF repeated trigger detected by Fail2Ban in plesk-modsecurity jail	Web App Attack
Anonymous	2024-10-29 06:32:05 (1 month ago)	SPROVFR WEBFORM SPAM 104.168.133.58 (client-104-168-133-58.hostwindsdns.com)	Web Spam
TPI-Abuse	2024-10-29 06:02:01 (1 month ago)	(mod_security) mod_security (id:217280) triggered by 104.168.133.58 (client-104-168-133-58.hostwinds ... show more(mod_security) mod_security (id:217280) triggered by 104.168.133.58 (client-104-168-133-58.hostwindsdns.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 29 02:01:57.053592 2024] [security2:error] [pid 31329:tid 31329] [client 104.168.133.58:59163] [client 104.168.133.58] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?:\\\\n\|\\\\r)+(?:get\|post\|head\|options\|connect\|put\|delete\|trace\|propfind\|propatch\|mkcol\|copy\|move\|lock\|unlock)\\\\s+" at MATCHED_VAR. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "137"] [id "217280"] [rev "6"] [msg "COMODO WAF: HTTP Request Smuggling Attack\|\|www.cajunpicasso.com\|F\|2"] [data "Matched Data: get found within MATCHED_VAR"] [severity "CRITICAL"] [tag "CWAF"] [tag "Protocol"] [hostname "www.cajunpicasso.com"] [uri "/wp-admin/admin-ajax.php"] [unique_id "ZyB6Ve7l4LcBcnXFQVVzaQAAAAU"], referer: http://www.cajunpicasso.com/contact/ show less	Brute-Force Bad Web Bot Web App Attack
ereznet.co.il	2024-10-29 05:45:18 (1 month ago)	SPAM	Brute-Force
Peter Chargen	2024-10-29 02:56:05 (1 month ago)	PHP email form abuse/SPAM attempt	Email Spam
backslash	2024-10-28 21:50:05 (1 month ago)		Web Spam
getaccessibleapps.com	2024-10-28 20:36:49 (1 month ago)		Web Spam
oncord	2024-10-28 11:51:46 (1 month ago)	Form spam	Web Spam