JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 170.239.205.225

170.239.205.225 was found in our database!

This IP was reported 50 times. Confidence of Abuse is 27%: ?

27%

ISP	FiberComm SAS
Usage Type	Fixed Line ISP
ASN	AS265629
Domain Name	fibercomm-it.com
Country	🇨🇴 Colombia
City	Bogota, Bogota D.C.

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 170.239.205.225

Whois 170.239.205.225

IP Abuse Reports for 170.239.205.225:

This IP address has been reported a total of 50 times from 29 distinct sources. 170.239.205.225 was first reported on August 27th 2025, and the most recent report was 1 hour ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇩🇪 Vegascosmetics	2026-06-21 16:55:56 (1 hour ago)	(Kingcopy.org-AI-IDS-Report):IP automatically blocked after obfuscated redirect. Vegas Security	DDoS Attack Hacking Exploited Host
Anonymous	2026-06-04 15:50:05 (2 weeks ago)	Web App Attack, Hacking	Hacking Web App Attack
🇺🇸 TPI-Abuse	2026-05-31 21:22:17 (2 weeks ago)	(mod_security) mod_security (id:210730) triggered by 170.239.205.225 (-): 1 in the last 300 secs; Po ... show more (mod_security) mod_security (id:210730) triggered by 170.239.205.225 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun May 31 17:22:13.810545 2026] [security2:error] [pid 8649:tid 8649] [client 170.239.205.225:40418] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy\|\|www.franzexpress.com\|F\|2"] [data ".com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.franzexpress.com"] [uri "/franzexpress.com"] [unique_id "ahymhdVW_RlxsGgeGa-trwAAABE"], referer: http://www.franzexpress.com/ show less	Brute-Force Bad Web Bot Web App Attack
🇩🇪 SMARTNET	2026-05-27 06:03:53 (3 weeks ago)	Aisuru(Mirai variant) DDoS \| Incident ID: f33ea243-b344-42fe-b994-8adedb9f85ca	DDoS Attack
Anonymous	2026-05-22 00:44:51 (4 weeks ago)	Unauthorized connection attempt	Port Scan Hacking Exploited Host
🇺🇸 TPI-Abuse	2026-05-01 22:27:21 (1 month ago)	(mod_security) mod_security (id:217210) triggered by 170.239.205.225 (-): 1 in the last 300 secs; Po ... show more (mod_security) mod_security (id:217210) triggered by 170.239.205.225 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri May 01 18:27:14.078319 2026] [security2:error] [pid 16801:tid 16801] [client 170.239.205.225:41794] ModSecurity: Access denied with code 403 (phase 2). Match of "rx ^(?i:(?:[a-z]{3,10}\\\\s+(?:\\\\w{3,7}?://[\\\\w\\\\-\\\\./](?::\\\\d+)?)?/[^?#](?:\\\\?[^#\\\\s])?(?:#[\\\\S])?\|connect (?:\\\\d{1,3}\\\\.){3}\\\\d{1,3}\\\\.?(?::\\\\d+)?\|options \\\\)\\\\s+[\\\\w\\\\./]+\|get /[^?#](?:\\\\?[^#\\\\s])?(?:#[\\\\S]*)?)$" against "REQUEST_LINE" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "114"] [id "217210"] [rev "1"] [msg "COMODO WAF: Invalid HTTP Request Line\|\|moon61workers.top\|F\|4"] [data "GET http://moon61workers.top HTTP/1.1"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "moon61workers.top"] [uri "/"] [unique_id "afUowq83heVQrPkLul4vMQAAABA"] show less	Brute-Force Bad Web Bot Web App Attack
🇩🇪 FeG Deutschland	2026-04-08 23:26:19 (2 months ago)	Mail: - login with unknown user - bruteforce	Brute-Force
🇫🇷 Sklurk	2026-03-29 03:19:02 (2 months ago)	Web App Attack	Web App Attack
🇺🇸 kosada.com	2026-03-26 04:38:33 (2 months ago)	Web bot: DDoS	DDoS Attack Bad Web Bot
🇺🇸 stechusa	2026-03-24 17:21:40 (2 months ago)	[Askari] \| country=CO \| Behavior: Targeting specific pages, HTTP/1.1 over TLS, Outdated browser, Con ... show more [Askari] \| country=CO \| Behavior: Targeting specific pages, HTTP/1.1 over TLS, Outdated browser, Concurrent page load during attack show less	Bad Web Bot DDoS Attack
🇺🇸 stechusa	2026-03-24 17:21:40 (2 months ago)	ELEVATED_THREAT \| country=CO \| ASN=FIBERNET \| AbuseIPDB=34% \| form_key sdHIxWyw... shared by 2 IPs: ... show more ELEVATED_THREAT \| country=CO \| ASN=FIBERNET \| AbuseIPDB=34% \| form_key sdHIxWyw... shared by 2 IPs: 170.239.205.225, 45.186.193.124 \| 28 IPs targeting /brand.html \| Facet request during elevated threat (facet_ratio=0.80, unique_ips=246) show less	Bad Web Bot DDoS Attack
🇺🇸 gui-ying233	2026-03-22 08:37:03 (2 months ago)	Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Sa ... show more Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36 show less	Bad Web Bot
🇫🇷 Sklurk	2026-03-16 05:11:51 (3 months ago)	Web App Attack	Web App Attack
🇫🇷 HerrWolf	2026-03-13 02:30:19 (3 months ago)	CrowdSec Detection: crowdsecurity/http-bad-user-agent	Bad Web Bot
🇺🇸 gui-ying233	2026-02-24 00:29:10 (3 months ago)	Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Sa ... show more Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36 show less	Bad Web Bot

Showing 1 to 15 of 50 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇭🇰 199.45.154.155

🇵🇰 182.190.216.141

🇧🇷 179.51.151.188

🇳🇱 176.65.139.248

🇺🇸 137.184.112.192

🇮🇳 117.241.75.221

🇰🇷 115.140.161.61

🇳🇱 45.148.10.244

🇷🇴 2.57.121.112

🇮🇳 182.95.233.86

🇻🇳 180.93.245.203

🇧🇷 45.205.1.5

🇧🇷 45.164.251.106

🇺🇸 216.180.246.95

🇺🇸 216.180.246.77

🇺🇸 205.210.31.23

🇩🇪 193.124.20.251

🇨🇳 180.125.231.80

🇺🇸 166.239.184.117

🇻🇳 165.154.137.186