AbuseIPDB » 166.70.207.2

166.70.207.2 was found in our database!

This IP was reported 6,675 times. Confidence of Abuse is 61%: ?

61%

This address is a Tor exit node. Neither the owner nor the provider are directly behind the offending action.

ISP	XMission L.C.
Usage Type	Data Center/Web Hosting/Transit
Hostname(s)	this.is.a.tor.node.xmission.com
Domain Name	xmission.com
Country	United States of America
City	Salt Lake City, Utah

IP info including ISP, Usage Type, and Location provided by IP2Location. Updated monthly.

Report 166.70.207.2

Whois 166.70.207.2

IP Abuse Reports for 166.70.207.2:

This IP address has been reported a total of 6,675 times from 875 distinct sources. 166.70.207.2 was first reported on November 23rd 2020, and the most recent report was 2 days ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp in UTC	Comment	Categories
JPPO	2024-10-01 22:18:51 (2 days ago)	Multiport scan 12 ports : 111 135 445 3817 4592 4786 5019 5701 8850 9042(x2) 10443 13500	Port Scan
Anonymous	2024-10-01 13:21:44 (2 days ago)	Action: Block, Reason: DDOS attack detected	DDoS Attack
JPPO	2024-09-29 23:14:49 (4 days ago)	Multiport scan 14 ports : 102 111 135 445 3817 4592 4786 5019 5701 7180 8850 9042(x2) 10443 13500	Port Scan
botreporter	2024-09-29 13:29:03 (4 days ago)	botnet ignoring robots.txt	Bad Web Bot
JPPO	2024-09-28 22:40:28 (5 days ago)	Multiport scan 8 ports : 102 135 445 4592 5019 5701 7180 8850	Port Scan
TPI-Abuse	2024-09-27 05:21:05 (1 week ago)	(mod_security) mod_security (id:210730) triggered by 166.70.207.2 (this.is.a.tor.node.xmission.com): ... show more(mod_security) mod_security (id:210730) triggered by 166.70.207.2 (this.is.a.tor.node.xmission.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Sep 27 01:20:57.431134 2024] [security2:error] [pid 30218:tid 30218] [client 166.70.207.2:60896] [client 166.70.207.2] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy\|\|caribef.com\|F\|2"] [data ".backup"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "caribef.com"] [uri "/wp-config.backup"] [unique_id "ZvZAuWL2G_alx7MO5mJOGAAAAAg"] show less	Brute-Force Bad Web Bot Web App Attack
nNordic	2024-09-26 15:59:25 (1 week ago)	Connection attempt blocked by IDS/IPS from IP 166.70.207.2/32	Hacking
DutchMasterServer	2024-09-20 14:34:03 (1 week ago)	Incoming Layer 7 Flood Detected	DDoS Attack
VHosting	2024-09-19 00:16:59 (2 weeks ago)	Attempt from 166.70.207.2	Brute-Force SSH
TPI-Abuse	2024-09-12 05:31:30 (3 weeks ago)	(mod_security) mod_security (id:210492) triggered by 166.70.207.2 (this.is.a.tor.node.xmission.com): ... show more(mod_security) mod_security (id:210492) triggered by 166.70.207.2 (this.is.a.tor.node.xmission.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Sep 12 01:31:25.079149 2024] [security2:error] [pid 15875:tid 15875] [client 166.70.207.2:52130] [client 166.70.207.2] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "investorsfundingusa.com"] [uri "/wp-config.php~"] [unique_id "ZuJ8rUbdRc9JzZKtxCnEYgAAAA8"] show less	Brute-Force Bad Web Bot Web App Attack
rtbh.com.tr	2024-09-11 20:54:45 (3 weeks ago)	list.rtbh.com.tr report: tcp/0	Brute-Force
Anonymous	2024-09-10 21:28:32 (3 weeks ago)	Action: Block, Reason: DDOS attack detected	DDoS Attack
rtbh.com.tr	2024-09-10 20:54:47 (3 weeks ago)	list.rtbh.com.tr report: tcp/0	Brute-Force
quicksand	2024-09-09 13:20:45 (3 weeks ago)	Malicious URI path [GET /.DS_Store] [Go-http-client/1.1] Reported from WAF sampled requests	Bad Web Bot Web App Attack
seoxan.es	2024-09-08 22:34:28 (3 weeks ago)	SQL Injection attempt detected	SQL Injection