JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 172.104.186.73

172.104.186.73 was found in our database!

This IP was reported 341 times. Confidence of Abuse is 25%: ?

25%

This address is a Tor exit node. Neither the owner nor the provider are directly behind the offending action.

ISP	Linode
Usage Type	Data Center/Web Hosting/Transit
ASN	AS63949
Hostname(s)	tor-exit.sg.localenby.is
Domain Name	linode.com
Country	🇸🇬 Singapore
City	Singapore

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 172.104.186.73

Whois 172.104.186.73

IP Abuse Reports for 172.104.186.73:

This IP address has been reported a total of 341 times from 46 distinct sources. 172.104.186.73 was first reported on November 25th 2021, and the most recent report was 1 week ago.

Old Reports: The most recent abuse report for this IP address is from 1 week ago . It is possible that this IP is no longer involved in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇳🇱 homeshowdomain.nl	2026-06-10 21:59:17 (1 week ago)	Auto-ban: >3000 req/min op 2026-06-10	Web App Attack SSH Hacking
🇳🇱 homeshowdomain.nl	2026-06-03 21:59:35 (2 weeks ago)	Auto-ban: single probe for restricted files (.env / backups / admin endpoints). Likely mass-scan on ... show more Auto-ban: single probe for restricted files (.env / backups / admin endpoints). Likely mass-scan on 2026-06-02. show less	Web App Attack SSH Hacking
🇧🇪 cmbplf	2026-06-02 07:41:30 (2 weeks ago)	689 limiting connections by zone (3h15m59s)	DDoS Attack
🇸🇬 securejdprop	2026-05-24 05:45:45 (3 weeks ago)	This IP was detected by CrowdSec triggering crowdsecurity/suricata-major-severity(ET TOR Known Tor E ... show more This IP was detected by CrowdSec triggering crowdsecurity/suricata-major-severity(ET TOR Known Tor Exit Node Traffic group 20). Ip 172.104.186.73 performed 'crowdsecurity/suricata-major-severity' (1 events over 0s) at 2026-05-24 05:45:43.27954434 +0000 UTC show less	Hacking Web App Attack
🇦🇺 oncord	2026-05-15 04:46:38 (1 month ago)	Form spam	Web Spam
Anonymous	2026-05-06 04:00:40 (1 month ago)	2026-05-05 19:00:11,750 fail2ban.actions [3625835]: NOTICE [tor] Ban 172.104.186.73 2026-05- ... show more 2026-05-05 19:00:11,750 fail2ban.actions [3625835]: NOTICE [tor] Ban 172.104.186.73 2026-05-05 22:00:09,723 fail2ban.actions [3625835]: NOTICE [tor] Ban 172.104.186.73 2026-05-06 01:00:09,296 fail2ban.actions [3625835]: NOTICE [tor] Ban 172.104.186.73 2026-05-06 04:00:15,806 fail2ban.actions [3625835]: NOTICE [tor] Ban 172.104.186.73 2026-05-06 07:00:39,225 fail2ban.actions [3625835]: NOTICE [tor] Ban 172.104.186.73 show less	Brute-Force
Anonymous	2026-04-24 21:00:54 (1 month ago)	2026-04-24 12:00:11,278 fail2ban.actions [7718]: NOTICE [tor] Ban 172.104.186.73 2026-04-24 ... show more 2026-04-24 12:00:11,278 fail2ban.actions [7718]: NOTICE [tor] Ban 172.104.186.73 2026-04-24 15:00:09,517 fail2ban.actions [7718]: NOTICE [tor] Ban 172.104.186.73 2026-04-24 18:00:09,496 fail2ban.actions [7718]: NOTICE [tor] Ban 172.104.186.73 2026-04-24 21:00:20,376 fail2ban.actions [7718]: NOTICE [tor] Ban 172.104.186.73 2026-04-25 00:00:50,539 fail2ban.actions [7718]: NOTICE [tor] Ban 172.104.186.73 show less	Brute-Force
🇺🇸 TPI-Abuse	2026-04-22 16:02:02 (1 month ago)	(mod_security) mod_security (id:210831) triggered by 172.104.186.73 (tor-exit.sg.localenby.is): 1 in ... show more (mod_security) mod_security (id:210831) triggered by 172.104.186.73 (tor-exit.sg.localenby.is): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Apr 22 12:01:58.040959 2026] [security2:error] [pid 31658:tid 31658] [client 172.104.186.73:36532] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url\|user-Agent\|www\\\\.weblogs\\\\.com\|(?:jakart\|vi)a\|(google\|i{0,1}explorer{0,1}\\\\.exe\|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)\|\\\\bdatacha0s\\\\b\|; widows\|\\\\\\\\r\|a(?: href=\|d(?:sarobot\|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler\|\|www.demberdatabase.com\|F\|4"] [data "panscient.com"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "www.demberdatabase.com"] [uri "/robots.txt"] [unique_id "aejw9oe9gCwvNuA8ynBo2AAAAAw"] show less	Brute-Force Bad Web Bot Web App Attack
Anonymous	2026-04-16 23:51:07 (2 months ago)	Automated bot traffic — residential proxy, fake browser fingerprint. UA="Mozilla/5.0 (Windows NT 10. ... show more Automated bot traffic — residential proxy, fake browser fingerprint. UA="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/84.0.4147.105 Safari/537.36" show less	Bad Web Bot Web App Attack
🇮🇩 securejdprop	2026-04-07 14:22:50 (2 months ago)	This IP was detected by CrowdSec triggering crowdsecurity/suricata-major-severity(ET TOR Known Tor E ... show more This IP was detected by CrowdSec triggering crowdsecurity/suricata-major-severity(ET TOR Known Tor Exit Node Traffic group 19). Ip 172.104.186.73 performed 'crowdsecurity/suricata-major-severity' (1 events over 0s) at 2026-04-07 14:22:49.175288039 +0000 UTC show less	Hacking Web App Attack
Anonymous	2026-03-17 19:01:21 (3 months ago)	2026-03-17 10:00:12,199 fail2ban.actions [3511917]: NOTICE [tor] Ban 172.104.186.73 2026-03- ... show more 2026-03-17 10:00:12,199 fail2ban.actions [3511917]: NOTICE [tor] Ban 172.104.186.73 2026-03-17 13:00:11,536 fail2ban.actions [3511917]: NOTICE [tor] Ban 172.104.186.73 2026-03-17 16:00:04,439 fail2ban.actions [3511917]: NOTICE [tor] Ban 172.104.186.73 2026-03-17 18:00:29,025 fail2ban.actions [3511917]: NOTICE [tor] Ban 172.104.186.73 2026-03-17 21:00:52,730 fail2ban.actions [3511917]: NOTICE [tor] Ban 172.104.186.73 show less	Brute-Force
🇩🇪 LRob.fr	2026-03-10 13:00:32 (3 months ago)	Repeated requests on blocked xmlrpc.php, blocked by fail2ban in custom-503-xmlrpc jail	Bad Web Bot Web App Attack
🇵🇾 armandosaucedo.me	2026-03-01 07:04:26 (3 months ago)	172.104.186.73 - - [01/Mar/2026:07:04:21 +0000] "GET / HTTP/1.1" 403 5760 "-" "Mozilla/4.0 (compatib ... show more 172.104.186.73 - - [01/Mar/2026:07:04:21 +0000] "GET / HTTP/1.1" 403 5760 "-" "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0)" show less	Web App Attack
🇪🇸 gnom4ik	2026-02-24 09:05:31 (3 months ago)	ban-reviewer auto report; ip=172.104.186.73; scenario=http:scan; verdict=valid_ban; confidence=0.92; ... show more ban-reviewer auto report; ip=172.104.186.73; scenario=http:scan; verdict=valid_ban; confidence=0.92; categories=14,15,18,22; active_decisions=2; lookback_decisions=2; nginx_requests=0; appsec_matches=0; auth_events=0; kernel_events=0; signals=ip_decision_count_high show less	Port Scan Hacking Brute-Force SSH
🇮🇳 liveaspankaj	2026-02-15 13:02:25 (4 months ago)	DDoS attack: 167 requests in 5m (GET / or repair.php).	DDoS Attack

Showing 1 to 15 of 341 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇧🇪 198.235.24.235

🇷🇺 193.228.164.236

🇺🇸 185.180.141.33

🇮🇳 182.95.185.158

🇫🇷 172.71.135.30

🇯🇵 157.7.200.152

🇧🇷 136.248.121.226

🇵🇰 125.209.97.230

🇨🇳 123.116.141.82

🇩🇪 69.5.169.158

🇨🇳 39.173.16.197

🇧🇪 34.140.85.72

🇧🇪 34.62.119.26

🇺🇸 216.194.173.75

🇩🇪 213.209.159.56

🇺🇸 195.184.76.243

🇺🇸 162.216.150.95

🇸🇪 155.4.31.215

🇭🇰 118.26.153.102

🇨🇳 116.1.179.117