JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 198.58.107.53

198.58.107.53 was found in our database!

This IP was reported 524 times. Confidence of Abuse is 12%: ?

12%

This address is a Tor exit node. Neither the owner nor the provider are directly behind the offending action.

ISP	Linode
Usage Type	Data Center/Web Hosting/Transit
ASN	AS63949
Hostname(s)	tor.tyler.zone
Domain Name	linode.com
Country	🇺🇸 United States of America
City	Richardson, Texas

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 198.58.107.53

Whois 198.58.107.53

IP Abuse Reports for 198.58.107.53:

This IP address has been reported a total of 524 times from 251 distinct sources. 198.58.107.53 was first reported on December 5th 2020, and the most recent report was 4 weeks ago.

Old Reports: The most recent abuse report for this IP address is from 4 weeks ago . It is possible that this IP is no longer involved in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
Anonymous	2026-05-06 04:02:39 (4 weeks ago)	2026-05-05 19:00:27,987 fail2ban.actions [3625835]: NOTICE [tor] Ban 198.58.107.53 2026-05-0 ... show more 2026-05-05 19:00:27,987 fail2ban.actions [3625835]: NOTICE [tor] Ban 198.58.107.53 2026-05-05 22:00:25,526 fail2ban.actions [3625835]: NOTICE [tor] Ban 198.58.107.53 2026-05-06 01:00:25,042 fail2ban.actions [3625835]: NOTICE [tor] Ban 198.58.107.53 2026-05-06 04:00:33,506 fail2ban.actions [3625835]: NOTICE [tor] Ban 198.58.107.53 2026-05-06 07:02:38,891 fail2ban.actions [3625835]: NOTICE [tor] Ban 198.58.107.53 show less	Brute-Force
Anonymous	2026-04-24 21:02:48 (1 month ago)	2026-04-24 12:00:28,541 fail2ban.actions [7718]: NOTICE [tor] Ban 198.58.107.53 2026-04-24 1 ... show more 2026-04-24 12:00:28,541 fail2ban.actions [7718]: NOTICE [tor] Ban 198.58.107.53 2026-04-24 15:00:26,734 fail2ban.actions [7718]: NOTICE [tor] Ban 198.58.107.53 2026-04-24 18:00:28,380 fail2ban.actions [7718]: NOTICE [tor] Ban 198.58.107.53 2026-04-24 21:00:37,598 fail2ban.actions [7718]: NOTICE [tor] Ban 198.58.107.53 2026-04-25 00:02:47,274 fail2ban.actions [7718]: NOTICE [tor] Ban 198.58.107.53 show less	Brute-Force
Anonymous	2026-04-21 03:22:28 (1 month ago)	Automated bot traffic — residential proxy, fake browser fingerprint. UA="Mozilla/5.0 (Windows NT 10. ... show more Automated bot traffic — residential proxy, fake browser fingerprint. UA="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/84.0.4147.105 Safari/537.36" show less	Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-04-08 17:35:24 (1 month ago)	(mod_security) mod_security (id:211190) triggered by 198.58.107.53 (tor.tyler.zone): 1 in the last 3 ... show more (mod_security) mod_security (id:211190) triggered by 198.58.107.53 (tor.tyler.zone): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Apr 08 13:35:16.979462 2026] [security2:error] [pid 2492123:tid 2492123] [client 198.58.107.53:38130] ModSecurity: Access denied with code 403 (phase 2). Match of "contains cpanel" against "REQUEST_URI" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "55"] [id "211190"] [rev "9"] [msg "COMODO WAF: Remote File Access Attempt\|\|test.nationalccl.com\|F\|2"] [data "Matched Data: /etc/ found within REQUEST_URI: /cgi-bin/common/visiteurs/include/menus.inc.php?lvc_include_dir=/etc/passwd%00"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "test.nationalccl.com"] [uri "/cgi-bin/common/visiteurs/include/menus.inc.php"] [unique_id "adaR1CO9f5RB0pVaFZpvFAAAACM"] show less	Brute-Force Bad Web Bot Web App Attack
Anonymous	2026-03-17 20:00:39 (2 months ago)	2026-03-17 11:00:08,525 fail2ban.actions [3511917]: NOTICE [tor] Ban 198.58.107.53 2026-03-1 ... show more 2026-03-17 11:00:08,525 fail2ban.actions [3511917]: NOTICE [tor] Ban 198.58.107.53 2026-03-17 13:00:49,264 fail2ban.actions [3511917]: NOTICE [tor] Ban 198.58.107.53 2026-03-17 16:00:28,378 fail2ban.actions [3511917]: NOTICE [tor] Ban 198.58.107.53 2026-03-17 19:00:58,961 fail2ban.actions [3511917]: NOTICE [tor] Ban 198.58.107.53 2026-03-17 22:00:28,120 fail2ban.actions [3511917]: NOTICE [tor] Ban 198.58.107.53 show less	Brute-Force
🇪🇸 gnom4ik	2026-02-20 18:52:28 (3 months ago)	ban-reviewer auto report; ip=198.58.107.53; scenario=http:scan; verdict=valid_ban; confidence=0.85; ... show more ban-reviewer auto report; ip=198.58.107.53; scenario=http:scan; verdict=valid_ban; confidence=0.85; categories=14,15,18; active_decisions=2; lookback_decisions=2; nginx_requests=0; appsec_matches=0; auth_events=0; kernel_events=0; signals=IP flagged for 'http:scan' scenario; AbuseIPDB categories 14 (Port Scan) and 15 (Hacking) are relevant; IP has 2 active decisions in lookback window show less	Port Scan Hacking Brute-Force
🇺🇸 gu-alvareza	2026-02-14 07:05:15 (3 months ago)	Cross.Site.Scripting	Hacking Web App Attack
🇺🇸 TPI-Abuse	2025-12-11 15:34:27 (5 months ago)	(mod_security) mod_security (id:211190) triggered by 198.58.107.53 (tor.tyler.zone): 1 in the last 3 ... show more (mod_security) mod_security (id:211190) triggered by 198.58.107.53 (tor.tyler.zone): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Dec 11 10:34:23.085313 2025] [security2:error] [pid 9960:tid 9960] [client 198.58.107.53:46272] ModSecurity: Access denied with code 403 (phase 2). Match of "contains cpanel" against "REQUEST_URI" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "55"] [id "211190"] [rev "9"] [msg "COMODO WAF: Remote File Access Attempt\|\|test.nationalccl.com\|F\|2"] [data "Matched Data: /etc/ found within REQUEST_URI: /cgi-bin/ttawebtop.cgi/?action=start&pg=../../../../../../../../../../../etc/passwd"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "test.nationalccl.com"] [uri "/cgi-bin/ttawebtop.cgi/"] [unique_id "aTrkf7oP6s39phlItdmGmQAAAAE"] show less	Brute-Force Bad Web Bot Web App Attack
🇨🇭 backslash	2025-09-05 08:36:17 (8 months ago)		SQL Injection
🇺🇸 TPI-Abuse	2025-08-25 00:53:18 (9 months ago)	(mod_security) mod_security (id:210730) triggered by 198.58.107.53 (tor.tyler.zone): 1 in the last 3 ... show more (mod_security) mod_security (id:210730) triggered by 198.58.107.53 (tor.tyler.zone): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Aug 24 20:53:13.764775 2025] [security2:error] [pid 4545:tid 4545] [client 198.58.107.53:53494] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy\|\|chezlubacov.xyz\|F\|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "chezlubacov.xyz"] [uri "/chezlubacov.sql"] [unique_id "aKuz-X9801igSgHGn9AEDwAAAAI"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 COMPLEX	2025-08-11 19:17:50 (9 months ago)	SSH brute force attack detected by fail2ban - attempted unauthorized access	Brute-Force SSH
🇺🇸 ipblock.com	2025-08-09 10:33:00 (9 months ago)	IPBlock protected site ID [4055-d][s=01]. Major crawler impostor. Mozilla/5.0 (compatible; Googleb ... show more IPBlock protected site ID [4055-d][s=01]. Major crawler impostor. Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html) show less	Bad Web Bot
🇫🇷 Hydra-Shield.fr	2025-08-01 23:23:26 (10 months ago)	Automated DDoS behavior detected targeting production services. Multiple anomalous connections and p ... show more Automated DDoS behavior detected targeting production services. Multiple anomalous connections and packet floods recorded. show less	Brute-Force SSH
🇺🇸 TPI-Abuse	2025-07-04 19:01:26 (11 months ago)	(mod_security) mod_security (id:210492) triggered by 198.58.107.53 (tor.tyler.zone): 1 in the last 3 ... show more (mod_security) mod_security (id:210492) triggered by 198.58.107.53 (tor.tyler.zone): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jul 04 15:01:20.815003 2025] [security2:error] [pid 9464:tid 9464] [client 198.58.107.53:59794] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "dupagekanewildliferemoval.com"] [uri "/wp-config.php7"] [unique_id "aGglACUFLXqcXPrQIEucGQAAABY"] show less	Brute-Force Bad Web Bot Web App Attack
🇪🇸 el-brujo	2025-06-25 08:04:21 (11 months ago)	06/25/2025-10:03:14.261391 198.58.107.53 Protocol: 6 ET TOR Known Tor Exit Node Traffic group 64	Hacking

Showing 1 to 15 of 524 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇳🇱 45.148.10.240

🇻🇳 45.119.212.99

🇨🇳 218.8.184.137

🇨🇳 182.43.22.64

🇺🇸 172.217.22.142

🇨🇳 123.57.87.214

🇨🇳 111.19.19.127

🇮🇳 106.219.198.250

🇯🇵 66.245.218.54

🇧🇷 37.148.132.205

🇩🇪 213.209.159.56

🇺🇸 147.185.132.216

🇨🇳 124.117.195.105

🇨🇳 120.48.20.170

🇨🇳 114.246.161.24

🇨🇳 111.37.134.148

🇨🇳 110.177.182.43

🇺🇸 107.150.103.88

🇯🇵 103.125.146.118

🇸🇪 78.40.116.35