JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 198.12.66.102

198.12.66.102 was found in our database!

This IP was reported 1,255 times. Confidence of Abuse is 0%: ?

ISP	HostPapa
Usage Type	Data Center/Web Hosting/Transit
ASN	AS36352
Hostname(s)	198-12-66-102-host.colocrossing.com
Domain Name	colocrossing.com
Country	🇺🇸 United States of America
City	Buffalo, New York

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 198.12.66.102

Whois 198.12.66.102

IP Abuse Reports for 198.12.66.102:

This IP address has been reported a total of 1,255 times from 375 distinct sources. 198.12.66.102 was first reported on June 30th 2021, and the most recent report was 1 year ago.

Old Reports: The most recent abuse report for this IP address is from 1 year ago . It is possible that this IP is no longer involved in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇦🇺 MAGIC	2025-05-21 07:08:56 (1 year ago)	VM1 Bad user agents ignoring web crawling rules. Draing bandwidth	DDoS Attack Bad Web Bot
🇺🇦 URAN Publishing Service	2025-05-08 04:48:02 (1 year ago)	198.12.66.102 - - [08/May/2025:07:48:01 +0300] "GET /.env HTTP/1.1" 404 494 "-" "Mozilla/5.0 (Window ... show more 198.12.66.102 - - [08/May/2025:07:48:01 +0300] "GET /.env HTTP/1.1" 404 494 "-" "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36" ... show less	Web App Attack
🇺🇸 TPI-Abuse	2025-05-08 04:32:11 (1 year ago)	(mod_security) mod_security (id:210492) triggered by 198.12.66.102 (198-12-66-102-host.colocrossing. ... show more (mod_security) mod_security (id:210492) triggered by 198.12.66.102 (198-12-66-102-host.colocrossing.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu May 08 00:32:07.930681 2025] [security2:error] [pid 3241076:tid 3241101] [client 198.12.66.102:55585] [client 198.12.66.102] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "192.64.150.21"] [uri "/.env"] [unique_id "aBwzxw5Cl3bBGEgjJDUl9QAAABc"] show less	Brute-Force Bad Web Bot Web App Attack
🇯🇵 VXG-NET	2025-05-08 03:23:55 (1 year ago)	port=80, indicator_type=code-execution	Hacking
🇺🇸 TPI-Abuse	2025-05-08 03:20:26 (1 year ago)	(mod_security) mod_security (id:210492) triggered by 198.12.66.102 (198-12-66-102-host.colocrossing. ... show more (mod_security) mod_security (id:210492) triggered by 198.12.66.102 (198-12-66-102-host.colocrossing.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed May 07 23:20:22.230988 2025] [security2:error] [pid 391330:tid 391354] [client 198.12.66.102:54388] [client 198.12.66.102] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "192.64.150.123"] [uri "/.env"] [unique_id "aBwi9tV80wBNseQ8F57daQAAARU"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 kosada.com	2025-05-08 02:45:24 (1 year ago)	Web vulnerability probing	Web App Attack
🇷🇺 cybertailor	2025-05-08 02:39:57 (1 year ago)	198.12.66.102 - - [08/May/2025:07:39:53 +0500] "GET /.env HTTP/1.1" 404 178 "-" "Mozilla/5.0 (Window ... show more 198.12.66.102 - - [08/May/2025:07:39:53 +0500] "GET /.env HTTP/1.1" 404 178 "-" "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36" 198.12.66.102 - - [08/May/2025:07:39:53 +0500] "GET /conf/.env HTTP/1.1" 404 178 "-" "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36" 198.12.66.102 - - [08/May/2025:07:39:54 +0500] "GET /wp-content/.env HTTP/1.1" 404 178 "-" "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36" 198.12.66.102 - - [08/May/2025:07:39:55 +0500] "GET /wp-admin/.env HTTP/1.1" 404 178 "-" "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36" 198.12.66.102 - - [08/May/2025:07:39:55 +0500] "GET /library/.env HTTP/1.1" 404 178 "-" "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36" ... show less	Port Scan
🇺🇦 URAN Publishing Service	2025-05-08 02:18:09 (1 year ago)	198.12.66.102 - - [08/May/2025:05:18:08 +0300] "GET /.env HTTP/1.1" 404 494 "-" "Mozilla/5.0 (Window ... show more 198.12.66.102 - - [08/May/2025:05:18:08 +0300] "GET /.env HTTP/1.1" 404 494 "-" "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36" 198.12.66.102 - - [08/May/2025:05:18:09 +0300] "GET /conf/.env HTTP/1.1" 404 494 "-" "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36" ... show less	Web App Attack
Anonymous	2025-05-08 02:17:29 (1 year ago)	(mod_security) mod_security triggered on hostname [redacted] 198.12.66.102 (US/United States/198-12- ... show more (mod_security) mod_security triggered on hostname [redacted] 198.12.66.102 (US/United States/198-12-66-102-host.colocrossing.com) show less	SQL Injection
🇺🇸 masterguru	2025-05-07 23:59:06 (1 year ago)	. Matched phrase "/.env" at REQUEST_URI. (210492-124)	Web App Attack
🇺🇸 bigscoots.com	2024-12-27 21:24:54 (1 year ago)	(smtpauth) Failed SMTP AUTH login from 198.12.66.102 (US/United States/198-12-66-102-host.colocrossi ... show more (smtpauth) Failed SMTP AUTH login from 198.12.66.102 (US/United States/198-12-66-102-host.colocrossing.com): 5 in the last 3600 secs; Ports: 25,465,587; Direction: 0; Trigger: LF_SMTPAUTH; Logs: 2024-12-27 16:24:03 dovecot_login authenticator failed for (ylmf-pc) [198.12.66.102]:49724: 535 Incorrect authentication data ([email protected]) 2024-12-27 16:24:10 dovecot_login authenticator failed for (ylmf-pc) [198.12.66.102]:59838: 535 Incorrect authentication data ([email protected]) 2024-12-27 16:24:21 dovecot_login authenticator failed for (ylmf-pc) [198.12.66.102]:49673: 535 Incorrect authentication data ([email protected]) 2024-12-27 16:24:39 dovecot_login authenticator failed for (ylmf-pc) [198.12.66.102]:59377: 535 Incorrect authentication data 2024-12-27 16:24:49 dovecot_login authenticator failed for (ylmf-pc) [198.12.66.102]:59431: 535 Incorrect authentication data show less	Brute-Force SSH
Anonymous	2024-12-18 13:17:23 (1 year ago)	SMTP brute force - auth failed	Brute-Force Exploited Host
🇵🇹 rncbc	2022-09-29 15:13:58 (3 years ago)	2022-09-29T19:36:50.991549+01:00beta postfix/smtpd[18761]: NOQUEUE: reject: RCPT from unknown[198.12 ... show more 2022-09-29T19:36:50.991549+01:00beta postfix/smtpd[18761]: NOQUEUE: reject: RCPT from unknown[198.12.66.102]: 450 4.7.25 Client host rejected: cannot find your hostname, [198.12.66.102]; from=<[email protected]> to=<[email protected]> proto=ESMTP helo=<dahuagroup.com.cn> 2022-09-29T19:52:36.632254+01:00beta postfix/smtpd[18849]: NOQUEUE: reject: RCPT from unknown[198.12.66.102]: 450 4.7.25 Client host rejected: cannot find your hostname, [198.12.66.102]; from=<[email protected]> to=<[email protected]> proto=ESMTP helo=<dahuagroup.com.cn> 2022-09-29T20:13:58.050072+01:00beta postfix/smtpd[19015]: NOQUEUE: reject: RCPT from unknown[198.12.66.102]: 450 4.7.25 Client host rejected: cannot find your hostname, [198.12.66.102]; from=<[email protected]> to=<[email protected]> proto=ESMTP helo=<dahuagroup.com.cn> ... show less	Brute-Force
🇵🇹 rncbc	2022-09-29 10:14:20 (3 years ago)	2022-09-29T14:57:18.293045+01:00beta postfix/smtpd[14226]: NOQUEUE: reject: RCPT from unknown[198.12 ... show more 2022-09-29T14:57:18.293045+01:00beta postfix/smtpd[14226]: NOQUEUE: reject: RCPT from unknown[198.12.66.102]: 450 4.7.25 Client host rejected: cannot find your hostname, [198.12.66.102]; from=<[email protected]> to=<[email protected]> proto=ESMTP helo=<dahuagroup.com.cn> 2022-09-29T15:12:44.962279+01:00beta postfix/smtpd[14355]: NOQUEUE: reject: RCPT from unknown[198.12.66.102]: 450 4.7.25 Client host rejected: cannot find your hostname, [198.12.66.102]; from=<[email protected]> to=<[email protected]> proto=ESMTP helo=<dahuagroup.com.cn> 2022-09-29T15:14:19.258786+01:00beta postfix/smtpd[14355]: NOQUEUE: reject: RCPT from unknown[198.12.66.102]: 450 4.7.25 Client host rejected: cannot find your hostname, [198.12.66.102]; from=<[email protected]> to=<[email protected]> proto=ESMTP helo=<dahuagroup.com.cn> ... show less	Brute-Force
🇵🇹 rncbc	2022-09-29 05:32:45 (3 years ago)	2022-09-29T10:16:50.756463+01:00beta postfix/smtpd[2267]: NOQUEUE: reject: RCPT from unknown[198.12. ... show more 2022-09-29T10:16:50.756463+01:00beta postfix/smtpd[2267]: NOQUEUE: reject: RCPT from unknown[198.12.66.102]: 450 4.7.25 Client host rejected: cannot find your hostname, [198.12.66.102]; from=<[email protected]> to=<[email protected]> proto=ESMTP helo=<dahuagroup.com.cn> 2022-09-29T10:32:37.158028+01:00beta postfix/smtpd[5135]: NOQUEUE: reject: RCPT from unknown[198.12.66.102]: 450 4.7.25 Client host rejected: cannot find your hostname, [198.12.66.102]; from=<[email protected]> to=<[email protected]> proto=ESMTP helo=<dahuagroup.com.cn> 2022-09-29T10:32:44.484132+01:00beta postfix/smtpd[5150]: NOQUEUE: reject: RCPT from unknown[198.12.66.102]: 450 4.7.25 Client host rejected: cannot find your hostname, [198.12.66.102]; from=<[email protected]> to=<[email protected]> proto=ESMTP helo=<dahuagroup.com.cn> ... show less	Brute-Force

Showing 1 to 15 of 1255 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇺🇸 172.253.221.156

🇺🇸 165.22.1.254

🇦🇷 131.161.184.46

🇺🇸 100.29.192.109

🇳🇱 45.148.10.151

🇨🇦 4.239.240.98

🇧🇬 78.128.114.166

🇧🇬 78.128.112.146

🇺🇦 5.57.67.181

🇦🇷 190.109.126.57

🇺🇸 74.7.241.6

🇨🇴 69.6.234.27

🇱🇹 62.60.130.219

🇨🇳 14.21.160.85

🇸🇬 165.154.236.29

🇨🇳 115.190.185.14

🇳🇱 93.123.109.102

🇨🇳 39.81.35.64

🇨🇳 36.135.100.48

🇺🇸 34.45.227.132