JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 172.245.24.168

172.245.24.168 was found in our database!

This IP was reported 48 times. Confidence of Abuse is 100%: ?

100%

ISP	HostPapa
Usage Type	Data Center/Web Hosting/Transit
ASN	AS36352
Hostname(s)	172-245-24-168-host.colocrossing.com
Domain Name	colocrossing.com
Country	🇺🇸 United States of America
City	Buffalo, New York

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 172.245.24.168

Whois 172.245.24.168

IP Abuse Reports for 172.245.24.168:

This IP address has been reported a total of 48 times from 30 distinct sources. 172.245.24.168 was first reported on February 21st 2026, and the most recent report was 8 hours ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇩🇪 JLKnoch.com	2026-07-19 01:25:50 (8 hours ago)	CrowdSec crowdsecurity/CVE-2017-9841	Brute-Force Web App Attack
🇩🇪 Gwyneth Llewelyn	2026-07-19 00:53:55 (8 hours ago)	172.245.24.168 - - [19/Jul/2026:01:53:52 +0100] "GET /.env HTTP/1.1" 301 162 "-" "Mozilla/5.0 (Linux ... show more 172.245.24.168 - - [19/Jul/2026:01:53:52 +0100] "GET /.env HTTP/1.1" 301 162 "-" "Mozilla/5.0 (Linux; U; Android 4.4.2; en-US; HM NOTE 1W Build/KOT49H) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 UCBrowser/11.0.5.850 U3/0.8.0 Mobile Safari/534.30" 2026/07/19 01:53:53 [error] 2374#2374: *77102 access forbidden by rule, client: 172.245.24.168, server: [redacted], request: "GET /.env HTTP/1.1", host: "[redacted]" 172.245.24.168 - - [19/Jul/2026:01:53:53 +0100] "GET /.env HTTP/1.1" 403 1178 "-" "Mozilla/5.0 (Linux; U; Android 4.4.2; en-US; HM NOTE 1W Build/KOT49H) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 UCBrowser/11.0.5.850 U3/0.8.0 Mobile Safari/534.30" show less	Brute-Force Web App Attack
🇮🇪 RoboSOC	2026-07-19 00:42:31 (8 hours ago)	phpunit Remote Code Execution Vulnerability, PTR: 172-245-24-168-host.colocrossing.com.	Hacking
🇮🇳 nadnitin	2026-07-19 00:26:12 (9 hours ago)	Automated trigger via Nginx Police. Reason: PATH-PROBER. Trigger Log: 172.245.24.168 - - [19/Jul/202 ... show more Automated trigger via Nginx Police. Reason: PATH-PROBER. Trigger Log: 172.245.24.168 - - [19/Jul/2026:05:56:11 +0530] "GET /.env HTTP/1.1" 444 0 "-" "Mozilla/5.0 (Linux; U; Android 4.4.2; en-US; HM NOTE 1W Build/KOT49H) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 UCBrowser/11.0.5.850 U3/0.8.0 Mobile Safari/534.30" show less	Web App Attack
🇳🇱 WeCloudit-Anti-Abuse	2026-07-18 23:31:53 (10 hours ago)	This IP was detected by CrowdSec triggering crowdsecurity/CVE-2017-9841	Web App Attack
🇩🇪 Ba-Yu	2026-07-18 20:59:09 (12 hours ago)	General hacking/exploits/scanning	Web Spam Hacking Brute-Force Exploited Host Web App Attack
🇩🇪 big-cloud.nl	2026-07-18 19:56:44 (13 hours ago)	Try to access /.env	Web App Attack
🇧🇪 voormedia	2026-07-18 16:24:05 (17 hours ago)	Accessed trap at '/.env'	Web App Attack
🇩🇪 pigro	2026-07-18 13:18:52 (20 hours ago)	172.245.24.168 - - [18/Jul/2026:15:18:41 +0200] "GET /.env HTTP/1.1" 404 125 "-" "Mozilla/5.0 (Linux ... show more 172.245.24.168 - - [18/Jul/2026:15:18:41 +0200] "GET /.env HTTP/1.1" 404 125 "-" "Mozilla/5.0 (Linux; U; Android 4.4.2; en-US; HM NOTE 1W Build/KOT49H) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 UCBrowser/11.0.5.850 U3/0.8.0 Mobile Safari/534.30" 172.245.24.168 - - [18/Jul/2026:15:18:51 +0200] "GET /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1" 404 125 "-" "python-requests/2.25.1" ... show less	Web App Attack
🇩🇪 s@ch@	2026-07-18 09:15:02 (1 day ago)	Jail: plesk-modsecurity \| Web application attack (Plesk ModSecurity)	Web App Attack
🇺🇸 donarev419	2026-07-18 07:11:36 (1 day ago)	Connection to port 80 with data transfer. Data preview: GET /.env HTTP/1.1 Host: 67.215.244.172 Us ... show more Connection to port 80 with data transfer. Data preview: GET /.env HTTP/1.1 Host: 67.215.244.172 User-agent: Mozilla/5.0 (Linux; U; Android 4.4.2; en-US; H show less	Port Scan Hacking
🇸🇬 anotherwatcher	2026-07-18 05:12:38 (1 day ago)	bad bot	Bad Web Bot
🇳🇱 GabrielJST	2026-07-18 05:11:39 (1 day ago)	(apache-useragents) Failed apache-useragents trigger with match [redacted] from 172.245.24.168 (US/U ... show more (apache-useragents) Failed apache-useragents trigger with match [redacted] from 172.245.24.168 (US/United States/172-245-24-168-host.colocrossing.com) show less	Bad Web Bot
🇺🇸 itsnixk	2026-07-18 04:58:20 (1 day ago)	(mod_security) mod_security (id:920350) triggered by 172.245.24.168 (US/United States/172-245-24-168 ... show more (mod_security) mod_security (id:920350) triggered by 172.245.24.168 (US/United States/172-245-24-168-host.colocrossing.com): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: [Sat Jul 18 00:58:17.867435 2026] [security2:error] [pid 373163:tid 373648] [client 172.245.24.168:54698] ModSecurity: Access denied with code 406 (phase 1). Pattern match "(?:^([\\\\d.]+\|\\\\[[\\\\da-f:]+\\\\]\|[\\\\da-f:]+)(:[\\\\d]+)?$)" at REQUEST_HEADERS:Host. [file "/etc/modsecurity.d/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "773"] [id "920350"] [msg "Host header is a numeric IP address"] [redacted] [severity "WARNING"] [ver "OWASP_CRS/4.27.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [redacted] [uri "/.env"] [unique_id "alsH6acydim7_xj4FsAKJwAAAJg"] show less	Port Scan
🇺🇸 MPL	2026-07-15 01:19:04 (4 days ago)	tcp/80 (7 or more attempts)	Port Scan

Showing 1 to 15 of 48 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇺🇸 2607:f8b0:400c:c1a::12b

🇺🇸 195.184.76.88

🇮🇳 122.179.163.27

🇻🇳 113.160.215.213

🇵🇰 110.36.12.40

🇳🇱 89.105.220.248

🇦🇪 86.96.22.39

🇩🇪 69.5.169.166

🇺🇸 47.251.91.152

🇺🇸 44.216.177.139

🇺🇸 4.150.191.6

🇨🇳 220.167.232.155

🇩🇪 213.209.159.242

🇺🇸 195.184.76.95

🇷🇺 194.28.241.253

🇺🇸 162.216.150.108

🇺🇸 162.142.125.30

🇺🇸 147.185.132.203

🇩🇪 144.31.70.102

🇨🇳 123.233.234.87