JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 172.245.12.59

172.245.12.59 was found in our database!

This IP was reported 10 times. Confidence of Abuse is 0%: ?

ISP	HostPapa
Usage Type	Data Center/Web Hosting/Transit
ASN	AS36352
Hostname(s)	172-245-12-59-host.colocrossing.com
Domain Name	hostpapa.com
Country	🇺🇸 United States of America
City	Buffalo, New York

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 172.245.12.59

Whois 172.245.12.59

IP Abuse Reports for 172.245.12.59:

This IP address has been reported a total of 10 times from 7 distinct sources. 172.245.12.59 was first reported on June 27th 2024, and the most recent report was 1 year ago.

Old Reports: The most recent abuse report for this IP address is from 1 year ago . It is possible that this IP is no longer involved in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇳🇱 Linuxmalwarehuntingnl	2024-06-30 09:53:38 (1 year ago)	Unauthorized connection attempt	Brute-Force
Anonymous	2024-06-28 21:44:37 (1 year ago)	Ports: 80,443; Direction: 0; Trigger: LF_CUSTOMTRIGGER	Brute-Force SSH
🇬🇧 Steve	2024-06-28 12:47:34 (1 year ago)	Excessive crawling - not obeying robots.txt	Bad Web Bot
🇺🇸 TPI-Abuse	2024-06-28 05:35:07 (1 year ago)	(mod_security) mod_security (id:240335) triggered by 172.245.12.59 (172-245-12-59-host.colocrossing. ... show more (mod_security) mod_security (id:240335) triggered by 172.245.12.59 (172-245-12-59-host.colocrossing.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jun 28 01:34:59.032338 2024] [security2:error] [pid 1609:tid 47206680872704] [client 172.245.12.59:48592] [client 172.245.12.59] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 172.245.12.59 (+1 hits since last alert)\|cliffwheeler.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "cliffwheeler.com"] [uri "/xmlrpc.php"] [unique_id "Zn5Lg6RXtk94dvIt9ASfdQAAAMg"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2024-06-28 04:05:26 (1 year ago)	(mod_security) mod_security (id:240335) triggered by 172.245.12.59 (172-245-12-59-host.colocrossing. ... show more (mod_security) mod_security (id:240335) triggered by 172.245.12.59 (172-245-12-59-host.colocrossing.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jun 28 00:05:22.301507 2024] [security2:error] [pid 17882] [client 172.245.12.59:50280] [client 172.245.12.59] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5965"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 172.245.12.59 (+1 hits since last alert)\|www.aholsniffsglue.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "www.aholsniffsglue.com"] [uri "/xmlrpc.php"] [unique_id "Zn42gsHJ5PVUw8swVAjtpAAAAA4"] show less	Brute-Force Bad Web Bot Web App Attack
🇪🇸 10dencehispahard SL	2024-06-27 22:04:51 (1 year ago)	Unauthorized login attempts [ wordpress-xmlrpc, wordpress]	Brute-Force Web App Attack
🇺🇸 TPI-Abuse	2024-06-27 22:03:00 (1 year ago)	(mod_security) mod_security (id:240335) triggered by 172.245.12.59 (172-245-12-59-host.colocrossing. ... show more (mod_security) mod_security (id:240335) triggered by 172.245.12.59 (172-245-12-59-host.colocrossing.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jun 27 18:02:52.946537 2024] [security2:error] [pid 5860] [client 172.245.12.59:59312] [client 172.245.12.59] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 172.245.12.59 (+1 hits since last alert)\|tttns.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "tttns.com"] [uri "/xmlrpc.php"] [unique_id "Zn3hjNB4xoS1sI6lDQD48AAAAA0"] show less	Brute-Force Bad Web Bot Web App Attack
Anonymous	2024-06-27 20:27:54 (1 year ago)	Ports: 80,443; Direction: 0; Trigger: LF_CUSTOMTRIGGER	Brute-Force SSH
🇲🇹 Malta	2024-06-27 19:58:55 (1 year ago)	172.245.12.59 - - [27/Jun/2024:21:58:55 +0200] "POST /xmlrpc.php HTTP/1.1" "Mozilla/5.0 (Macintosh; ... show more 172.245.12.59 - - [27/Jun/2024:21:58:55 +0200] "POST /xmlrpc.php HTTP/1.1" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.6422.60 Safari/537.36" Brute-force password attempt show less	Hacking Brute-Force Web App Attack
🇧🇪 cmbplf	2024-06-27 19:28:22 (1 year ago)	535 requests to */xmlrpc.php	Brute-Force Bad Web Bot

Showing 1 to 10 of 10 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇺🇸 181.214.48.205

🇺🇸 172.203.134.70

🇺🇸 147.185.132.111

🇻🇳 118.70.182.193

🇭🇰 112.119.21.245

🇭🇰 101.36.111.86

🇮🇳 182.95.103.150

🇵🇪 161.132.38.234

🇮🇩 143.20.49.38

🇨🇳 122.96.28.131

🇩🇪 46.224.160.234

🇳🇱 45.198.224.7

🇸🇬 148.66.142.9

🇭🇰 123.58.213.128

🇯🇵 118.193.61.170

🇨🇳 222.212.83.51

🇩🇪 207.241.172.57

🇧🇷 205.210.31.222

🇺🇸 205.210.31.45

🇲🇽 187.212.10.12