JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

172.245.103.91

Recent Activity

Abuse confidence score ?

64% Elevated

27 reports

14 reporters · latest 45 minutes ago

ISP	HostPapa
Usage Type	Data Center/Web Hosting/Transit
ASN	AS36352
Hostname(s)	172-245-103-91-host.colocrossing.com
Domain Name	hostpapa.com
Country	🇺🇸 United States of America
City	Los Angeles, California

ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report Whois

Reports Activity

Example preview

Report Categories (Last 60 Days)

Example preview

Top Reporter Countries (Last 60 Days)

Example preview

Account required for the enhanced features Log in Sign up

IP Abuse Reports for 172.245.103.91

Export CSV

This IP address has been reported a total of 27 times from 14 distinct sources. 172.245.103.91 was first reported on September 19th 2026, and the most recent report was 45 minutes ago. In the last 60 days, the top reporter locations were: United States of America with 13 reports; Germany with 6 reports; Switzerland with 2 reports. The most common categories in these recent reports were: Web App Attack 23 times; Bad Web Bot 18 times; Brute-Force 14 times; Hacking 5 times; Port Scan 1 time; Other 1 time.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇩🇪 netclix.gr	2026-10-07 12:02:08 (45 minutes ago)	(c5_sensitive_scan) Custom6 Sensitive File Exploit Blocked 172.245.103.91 (US/United States/172-245- ... show more (c5_sensitive_scan) Custom6 Sensitive File Exploit Blocked 172.245.103.91 (US/United States/172-245-103-91-host.colocrossing.com) show less	Hacking
🇺🇸 TPI-Abuse	2026-10-07 09:25:36 (3 hours ago)	(mod_security) mod_security (id:210492) triggered by 172.245.103.91 (172-245-103-91-host.colocrossin ... show more (mod_security) mod_security (id:210492) triggered by 172.245.103.91 (172-245-103-91-host.colocrossing.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 07 05:25:18.133317 2026] [security2:error] [pid 19915:tid 19915] [client 172.245.103.91:39008] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.creertest.com.creartest.com"] [uri "/.git/HEAD"] [unique_id "asYP_vJe1JLd5WPXKJMGSgAAAAc"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-10-07 01:36:50 (11 hours ago)	(mod_security) mod_security (id:210492) triggered by 172.245.103.91 (172-245-103-91-host.colocrossin ... show more (mod_security) mod_security (id:210492) triggered by 172.245.103.91 (172-245-103-91-host.colocrossing.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 06 21:36:35.039694 2026] [security2:error] [pid 6585:tid 6639] [client 172.245.103.91:41781] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "notary.brucejoell.com"] [uri "/.git/HEAD"] [unique_id "asWiI-tqZxVttfvCVp6ikQAAAZU"] show less	Brute-Force Bad Web Bot Web App Attack
🇨🇦 internetworld	2026-10-03 17:40:34 (3 days ago)	172.245.103.91 - - [03/Oct/2026:17:40:32 +0000] "GET /.git/HEAD HTTP/1.1" 200 513 "-" "Python-urllib ... show more 172.245.103.91 - - [03/Oct/2026:17:40:32 +0000] "GET /.git/HEAD HTTP/1.1" 200 513 "-" "Python-urllib/3.10" ... show less	Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-10-03 13:06:30 (3 days ago)	(mod_security) mod_security (id:210492) triggered by 172.245.103.91 (172-245-103-91-host.colocrossin ... show more (mod_security) mod_security (id:210492) triggered by 172.245.103.91 (172-245-103-91-host.colocrossing.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 03 09:06:21.182735 2026] [security2:error] [pid 12922:tid 12922] [client 172.245.103.91:58546] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "nearbyxm.com.15cherryavenue.com"] [uri "/.git/HEAD"] [unique_id "asD9zc9Yq6W6_lmEHCdQ6AAAAAU"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-10-03 11:34:34 (4 days ago)	(mod_security) mod_security (id:210492) triggered by 172.245.103.91 (172-245-103-91-host.colocrossin ... show more (mod_security) mod_security (id:210492) triggered by 172.245.103.91 (172-245-103-91-host.colocrossing.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 03 07:34:21.196453 2026] [security2:error] [pid 2189:tid 2189] [client 172.245.103.91:48490] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.3beeze.bridgital.com"] [uri "/.git/HEAD"] [unique_id "asDoPb_VBE3IcnDSEYzNLQAAAA0"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-09-28 12:05:50 (1 week ago)	(mod_security) mod_security (id:210492) triggered by 172.245.103.91 (172-245-103-91-host.colocrossin ... show more (mod_security) mod_security (id:210492) triggered by 172.245.103.91 (172-245-103-91-host.colocrossing.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Sep 28 08:05:45.542529 2026] [security2:error] [pid 22773:tid 22794] [client 172.245.103.91:54072] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.paylessformedicine.com"] [uri "/.git/HEAD"] [unique_id "arpYGVvsHe6GTGJjuqIH4wAAAA8"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-09-28 09:27:13 (1 week ago)	(mod_security) mod_security (id:210492) triggered by 172.245.103.91 (172-245-103-91-host.colocrossin ... show more (mod_security) mod_security (id:210492) triggered by 172.245.103.91 (172-245-103-91-host.colocrossing.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Sep 28 05:26:48.745997 2026] [security2:error] [pid 25724:tid 25724] [client 172.245.103.91:34791] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.calendarsprinted.com.piratecostumesonline.com"] [uri "/.git/HEAD"] [unique_id "aroy2IdZsBAekdvlb-CTcgAAAB0"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-09-28 01:18:45 (1 week ago)	(mod_security) mod_security (id:210492) triggered by 172.245.103.91 (172-245-103-91-host.colocrossin ... show more (mod_security) mod_security (id:210492) triggered by 172.245.103.91 (172-245-103-91-host.colocrossing.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Sep 27 21:18:42.235866 2026] [security2:error] [pid 11100:tid 11127] [client 172.245.103.91:54690] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "12am.com"] [uri "/.git/HEAD"] [unique_id "arnAcu8pDKTMCVW_FStDGwAAAJA"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇦 URAN Publishing Service	2026-09-24 02:18:37 (1 week ago)	[24/Sep/2026:05:18:37 +0300] -- 172.245.103.91 Ban reason: User-Agent Python-urllib	Bad Web Bot Web App Attack
🇭🇺 kranem	2026-09-23 18:00:28 (1 week ago)	Triggered Cloudflare WAF from US. Action taken: BLOCK ASN: 36352 (HostPapa) Protocol: HTTP/1.1 (GET ... show more Triggered Cloudflare WAF from US. Action taken: BLOCK ASN: 36352 (HostPapa) Protocol: HTTP/1.1 (GET method) Endpoint: / Timestamp: 2026-09-23T15:30:19Z User-Agent: Python-urllib/3.10 show less	Bad Web Bot
🇩🇪 LRob	2026-09-23 14:03:33 (1 week ago)	This address is looking for secret files on our sites: .git directories, .env files, credential and ... show more This address is looking for secret files on our sites: .git directories, .env files, credential and configuration files, database dumps, backups. This is a targeted search for credentials to break into the sites, blocked at the first request. Please check the machine behind it for an attack tool or malware. \| method: GET \| path: /.git/HEAD \| 2026-09-23 14:03 UTC show less	Hacking Web App Attack
🇺🇸 TPI-Abuse	2026-09-22 10:31:02 (2 weeks ago)	(mod_security) mod_security (id:210492) triggered by 172.245.103.91 (172-245-103-91-host.colocrossin ... show more (mod_security) mod_security (id:210492) triggered by 172.245.103.91 (172-245-103-91-host.colocrossing.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 22 06:30:58.498469 2026] [security2:error] [pid 11075:tid 11075] [client 172.245.103.91:35127] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rmhpolarracing.com.wolter-hausser.com"] [uri "/.git/HEAD"] [unique_id "arJY4jRZ5ltqYidtfGbY8gAAABg"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-09-22 07:40:21 (2 weeks ago)	(mod_security) mod_security (id:210492) triggered by 172.245.103.91 (172-245-103-91-host.colocrossin ... show more (mod_security) mod_security (id:210492) triggered by 172.245.103.91 (172-245-103-91-host.colocrossing.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 22 03:40:16.884774 2026] [security2:error] [pid 30018:tid 30018] [client 172.245.103.91:47487] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.penisbreath.com.whoore.com"] [uri "/.git/HEAD"] [unique_id "arIw4PDwQCPbZloFjK_GPgAAAA4"] show less	Brute-Force Bad Web Bot Web App Attack
🇿🇦 conure.sh	2026-09-22 06:13:21 (2 weeks ago)	csagent: score 20.5: secrets grab x2, 404 noise floor x2; 2 domain(s) in 0s	Web App Attack

Showing 1 to 15 of 27 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇺🇸 195.184.76.246

🇺🇸 195.184.76.37

🇳🇱 185.95.156.182

🇰🇷 183.109.124.136

🇲🇴 182.93.50.90

🇨🇦 178.128.225.26

🇮🇳 143.244.142.24

🇮🇳 115.242.55.148

🇮🇳 103.240.8.85

🇿🇦 102.64.41.152

🇳🇱 77.239.124.152

🇺🇸 70.184.72.161

🇸🇬 47.84.85.127

🇷🇴 2.57.121.25

🇳🇱 2400:cb00:996:1000:e4b4:ca98:99f:6377

🇺🇸 195.184.76.245

🇳🇱 195.178.110.232

🇩🇪 139.19.117.130

🇺🇸 45.156.129.90

🇷🇺 37.76.146.120