JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 170.101.96.59

170.101.96.59 was found in our database!

This IP was reported 22 times. Confidence of Abuse is 100%: ?

100%

ISP	GTHost
Usage Type	Data Center/Web Hosting/Transit
ASN	AS63023
Domain Name	gthost.com
Country	🇺🇸 United States of America
City	Chicago, Illinois

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 170.101.96.59

Whois 170.101.96.59

IP Abuse Reports for 170.101.96.59:

This IP address has been reported a total of 22 times from 18 distinct sources. 170.101.96.59 was first reported on August 25th 2026, and the most recent report was 6 hours ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇹🇷 eryilmaz	2026-08-27 02:00:22 (6 hours ago)	Automated attack blocked by eryilmaz WAF/fail2ban: 1 event(s) [waf.block] in the last 1 days, e.g. / ... show more Automated attack blocked by eryilmaz WAF/fail2ban: 1 event(s) [waf.block] in the last 1 days, e.g. /sftp-config.json show less	Web App Attack Hacking
🇩🇪 grassau.com	2026-08-26 23:16:47 (9 hours ago)	Port Scan detected from 170.101.96.59 (US/United States/Illinois/Chicago/-).	Port Scan
🇮🇹 CoreTech srl	2026-08-26 22:38:56 (10 hours ago)	cloudlinux2 fail2ban: 2026-08-27 00:33:51,450 fail2ban.filter [1775]: INFO [plesk-wordpre ... show more cloudlinux2 fail2ban: 2026-08-27 00:33:51,450 fail2ban.filter [1775]: INFO [plesk-wordpress] Found 66.228.62.166 - 2026-08-27 00:33:51cloudlinux2 fail2ban: 2026-08-27 00:34:10,905 fail2ban.filter [1775]: INFO [plesk-modsecurity] Found 170.101.96.59 - 2026-08-27 00:34:10cloudlinux2 fail2ban: 2026-08-27 00:35:25,321 fail2ban.filter [1775]: INFO [plesk-modsecurity] Found 35.229.194.54 - 2026-08-27 00:35:25cloudlinux2 fail2ban: 2026-08-27 00:35:25,304 fail2ban.filter [1775]: INFO [plesk-modsecurity] Found 35.229.194.54 - 2026-08-27 00:35:25cloudlinux2 fail2ban: 2026-08-27 00:35:25,350 fail2ban.filter [1775]: INFO [plesk-modsecurity] Found 35.229.194.54 - 2026-08-27 00:35:25cloudlinux2 fail2ban: 2026-08-27 00:35:25,330 fail2ban.filter [1775]: INFO [plesk-modsecurity] Found 35.229.194.54 - 2026-08-27 00:35:25cloudlinux2 fail2ban: 2026-08-27 00:35:25,313 fail2ban.filter [1775]: INFO [plesk-modsecurity] Found 35.229.194.54 - 2026-08-27 00:35 show less	Web App Attack
Anonymous	2026-08-26 18:28:29 (14 hours ago)	170.101.96.59 - - [26/Aug/2026:18:28:29 +0000] "GET /.vscode/sftp.json HTTP/2.0" 404 1005 "-" "Mozi ... show more 170.101.96.59 - - [26/Aug/2026:18:28:29 +0000] "GET /.vscode/sftp.json HTTP/2.0" 404 1005 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36" "170.101.96.59" "-" ... show less	Web App Attack
🇳🇱 MyGlobalFlowers	2026-08-26 18:00:43 (14 hours ago)	Multiple WAF Violations	Web App Attack
🇺🇸 Epimetheus	2026-08-26 16:28:33 (16 hours ago)	Unauthorized access attempts: [GET] /sftp-config.json UA: Mozilla/5.0 (X11; Linux x86_64) AppleWeb ... show more Unauthorized access attempts: [GET] /sftp-config.json UA: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36 show less	Web App Attack
🇬🇧 Mendip_Defender	2026-08-26 16:02:04 (16 hours ago)	170.101.96.59 - - [26/Aug/2026:17:02:11 +0100] "GET /.vscode/sftp.json HTTP/1.1" 301 162 "-" "Mozill ... show more 170.101.96.59 - - [26/Aug/2026:17:02:11 +0100] "GET /.vscode/sftp.json HTTP/1.1" 301 162 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36" 170.101.96.59 - - [26/Aug/2026:17:02:12 +0100] "GET /.vscode/sftp.json HTTP/1.1" 301 5679 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36" 170.101.96.59 - - [26/Aug/2026:17:02:13 +0100] "GET /.vscode/sftp.json HTTP/1.1" 404 53853 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36" ... show less	Hacking Web App Attack
Anonymous	2026-08-26 14:33:34 (18 hours ago)	Automated report (2026-08-26T10:33:34-04:00). Caught probing for exposed FTP credentials.	Hacking
🇺🇸 TPI-Abuse	2026-08-26 09:04:33 (23 hours ago)	(mod_security) mod_security (id:210492) triggered by 170.101.96.59 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:210492) triggered by 170.101.96.59 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Aug 26 05:04:26.208734 2026] [security2:error] [pid 30619:tid 30619] [client 170.101.96.59:58218] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "vitess.com"] [uri "/sftp-config.json"] [unique_id "ao6sGoAGmCDh5lG_e024bQAAAAI"] show less	Brute-Force Bad Web Bot Web App Attack
🇩🇪 big-cloud.nl	2026-08-26 08:07:29 (1 day ago)	Try to access /.vscode/sftp.json	Web App Attack
🇩🇪 BlueWire Hosting	2026-08-26 05:59:44 (1 day ago)	High-confidence malicious configuration/VCS probe	Web App Attack
🇬🇧 noise.agency	2026-08-26 05:09:16 (1 day ago)	(CT) IP 170.101.96.59 (US/United States/-) found to have 196 connections	DDoS Attack
🇮🇹 mediarama.com	2026-08-26 04:49:04 (1 day ago)	Banned by Fail2Ban	Web App Attack
🇺🇸 TPI-Abuse	2026-08-26 04:10:56 (1 day ago)	(mod_security) mod_security (id:210492) triggered by 170.101.96.59 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:210492) triggered by 170.101.96.59 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Aug 26 00:10:48.567056 2026] [security2:error] [pid 13430:tid 13430] [client 170.101.96.59:51282] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "noviasaltovacio.com"] [uri "/sftp-config.json"] [unique_id "ao5nSOK-G9H3s1BljXG3igAAAAY"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-08-26 03:07:38 (1 day ago)	(mod_security) mod_security (id:210492) triggered by 170.101.96.59 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:210492) triggered by 170.101.96.59 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Aug 25 23:07:28.512594 2026] [security2:error] [pid 23764:tid 23764] [client 170.101.96.59:64661] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "yaseminelhan.com"] [uri "/sftp-config.json"] [unique_id "ao5YcISRY9KSUDBUdWzxyQAAADM"] show less	Brute-Force Bad Web Bot Web App Attack

Showing 1 to 15 of 22 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇳🇱 37.74.94.197

🇮🇩 36.92.246.14

🇸🇪 188.150.142.1

🇮🇩 34.101.180.37

🇺🇸 3.83.245.221

🇳🇱 212.114.110.34

🇧🇷 205.210.31.130

🇧🇪 198.235.24.136

🇹🇼 198.235.24.10

🇳🇱 195.178.110.26

🇨🇱 190.164.228.174

🇪🇸 185.130.155.143

🇩🇪 162.55.72.148

🇫🇮 147.185.133.217

🇮🇹 80.17.246.236

🇫🇮 65.108.104.114

🇵🇱 51.75.58.24

🇻🇳 42.118.63.6

🇫🇷 37.187.88.10

🇬🇧 35.203.210.162