JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 172.245.214.51

172.245.214.51 was found in our database!

This IP was reported 115 times. Confidence of Abuse is 49%: ?

49%

ISP	HostPapa
Usage Type	Data Center/Web Hosting/Transit
ASN	AS36352
Hostname(s)	172-245-214-51-host.colocrossing.com
Domain Name	hostpapa.com
Country	🇺🇸 United States of America
City	Buffalo, New York

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 172.245.214.51

Whois 172.245.214.51

IP Abuse Reports for 172.245.214.51:

This IP address has been reported a total of 115 times from 80 distinct sources. 172.245.214.51 was first reported on April 24th 2026, and the most recent report was 1 month ago.

Old Reports: The most recent abuse report for this IP address is from 1 month ago . It is possible that this IP is no longer involved in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇩🇪 ghostwarriors	2026-05-12 09:52:30 (1 month ago)	Webpage scraping	Brute-Force Bad Web Bot Web App Attack
🇩🇪 ghostwarriors	2026-05-06 14:21:05 (1 month ago)	Webpage scraping	Brute-Force Bad Web Bot Web App Attack
🇬🇧 openstrike.co.uk	2026-05-03 05:13:24 (1 month ago)	10 attacks on password grabbing URLs, config grabbing URLs (type 2), VC URLs, env grabbing URLs: GET ... show more 10 attacks on password grabbing URLs, config grabbing URLs (type 2), VC URLs, env grabbing URLs: GET /.aws/credentials HTTP/1.1 GET /config.json HTTP/1.1 GET /.git/config HTTP/1.1 GET /api/.env HTTP/1.1 show less	Hacking
🇮🇩 Burayot	2026-05-02 06:54:36 (1 month ago)	LF_MODSEC: (mod_security) mod_security (id:1000001) triggered by 172.245.214.51 (US/United States/17 ... show more LF_MODSEC: (mod_security) mod_security (id:1000001) triggered by 172.245.214.51 (US/United States/172-245-214-51-host.colocrossing.com): 1 in the last 3600 secs show less	Web App Attack
Anonymous	2026-05-02 06:49:36 (1 month ago)	172.245.214.51 - - [02/May/2026:08:49:36 +0200] "GET /.env HTTP/1.1" 301 169 "-" "Mozilla/5.0 (Windo ... show more 172.245.214.51 - - [02/May/2026:08:49:36 +0200] "GET /.env HTTP/1.1" 301 169 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36 Edg/146.0.3856.109" show less	Web App Attack
🇨🇭 4server	2026-05-02 06:46:48 (1 month ago)	[SatMay0204:20:20.0834712026][security2:error][pid2366340:tid2366803][client172.245.214.51:0]ModSecu ... show more [SatMay0204:20:20.0834712026][security2:error][pid2366340:tid2366803][client172.245.214.51:0]ModSecurity:Accessdeniedwithcode403\(phase1\).Matchedphrase\".git\"atREQUEST_URI.[file\"/etc/apache2/conf.d/modsec_custom_rules.conf\"][line\"364\"][id\"960720\"][msg\"Forbiddenfileaccess\"][hostname\"aurumgioielleria.ch.81-17-25-250.cpanel.site\"][uri\"/.git/HEAD\"][unique_id\"afVfZJHXk6LcFhlq2jOWjgAAAQU\"] show less	Hacking Web App Attack
🇺🇸 TPI-Abuse	2026-05-02 06:18:56 (1 month ago)	(mod_security) mod_security (id:210492) triggered by 172.245.214.51 (172-245-214-51-host.colocrossin ... show more (mod_security) mod_security (id:210492) triggered by 172.245.214.51 (172-245-214-51-host.colocrossing.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat May 02 02:18:49.352125 2026] [security2:error] [pid 12710:tid 12710] [client 172.245.214.51:0] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "blog.nyemdr.com"] [uri "/.git/HEAD"] [unique_id "afWXSZ2bKLnr6VhmKd_fHgAAABs"] show less	Brute-Force Bad Web Bot Web App Attack
🇫🇷 dynamix	2026-05-02 04:45:00 (1 month ago)	Multiple WAF Violations	Web App Attack
🇳🇱 ParaBug	2026-05-02 03:59:27 (1 month ago)	172.245.214.51 - - [02/May/2026:05:59:27 +0200] "GET /.aws/credentials HTTP/1.1" 301 501 "-" "Mozill ... show more 172.245.214.51 - - [02/May/2026:05:59:27 +0200] "GET /.aws/credentials HTTP/1.1" 301 501 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:149.0) Gecko/20100101 Firefox/149.0" ... show less	Phishing Brute-Force Web App Attack
🇺🇸 antlac1	2026-05-01 23:55:00 (1 month ago)	crowdsecurity/http-sensitive-files	Brute-Force Web App Attack
🇩🇪 Zydzy	2026-05-01 23:04:05 (1 month ago)	Automated attack detected. Server: 95.140.154.181. Jail: nginx-exploit.	Web App Attack
🇺🇸 MPL	2026-05-01 22:50:03 (1 month ago)	tcp/443 (8 or more attempts)	Port Scan
🇳🇱 e.fierstra	2026-05-01 20:30:07 (1 month ago)	ModSecurity hits exceeded	Bad Web Bot Web App Attack
Anonymous	2026-05-01 19:35:37 (1 month ago)	[Fri May 01 21:35:34.114373 2026] [authz_core:error] [pid 24884] [client 172.245.214.51:40062] AH016 ... show more [Fri May 01 21:35:34.114373 2026] [authz_core:error] [pid 24884] [client 172.245.214.51:40062] AH01630: client denied by server configuration: /etc/httpd/htdocs [Fri May 01 21:35:35.195657 2026] [authz_core:error] [pid 24603] [client 172.245.214.51:41684] AH01630: client denied by server configuration: /etc/httpd/htdocs [Fri May 01 21:35:36.267913 2026] [authz_core:error] [pid 24603] [client 172.245.214.51:41684] AH01630: client denied by server configuration: /etc/httpd/htdocs ... show less	Web App Attack
🇳🇱 Site.eu	2026-05-01 15:50:10 (1 month ago)	Excessive multi-domain requests	Brute-Force

Showing 1 to 15 of 115 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇨🇦 209.50.187.236

🇺🇸 162.243.190.66

🇺🇸 142.93.115.218

🇩🇪 209.50.180.46

🇨🇦 209.50.176.48

🇹🇼 202.39.153.245

🇲🇦 196.117.162.137

🇺🇸 143.198.116.17

🇮🇩 128.14.232.254

🇺🇸 35.202.9.133

🇺🇸 209.50.174.184

🇧🇷 191.240.96.8

🇧🇴 190.129.122.185

🇫🇮 147.185.133.62

🇮🇳 115.246.52.219

🇳🇱 45.148.10.230

🇦🇺 45.132.224.80

🇬🇧 35.203.211.202

🇬🇧 35.203.210.174

🇧🇪 34.78.23.28