JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 209.141.56.103

209.141.56.103 was found in our database!

This IP was reported 46 times. Confidence of Abuse is 97%: ?

97%

This address is a Tor exit node. Neither the owner nor the provider are directly behind the offending action.

ISP	FranTech Solutions
Usage Type	Data Center/Web Hosting/Transit
ASN	AS53667
Hostname(s)	us.linkanator-exit.c.dn.ua
Domain Name	frantech.ca
Country	🇺🇸 United States of America
City	Las Vegas, Nevada

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 209.141.56.103

Whois 209.141.56.103

IP Abuse Reports for 209.141.56.103:

This IP address has been reported a total of 46 times from 22 distinct sources. 209.141.56.103 was first reported on June 8th 2026, and the most recent report was 2 hours ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
Anonymous	2026-07-25 08:03:04 (2 hours ago)	Bot / scanning and/or hacking attempts: GET /xmlrpc.php?rsd HTTP/2.0, [1/1] done	Hacking Web App Attack
🇩🇪 anycast_ac	2026-07-23 22:43:55 (1 day ago)	[DDoS Attacker] This IP was attacking website anycast.ac and sent 64 requests on port 443	DDoS Attack Web App Attack
🇩🇪 Lino Project	2026-07-23 11:22:01 (1 day ago)	CrowdSec abuse IP report (host SRV-2) Scenario: LePresidente/http-generic-403-bf	Hacking
🇮🇩 securejdprop	2026-07-23 04:08:22 (2 days ago)	This IP was detected by CrowdSec triggering crowdsecurity/suricata-major-severity(ET TOR Known Tor E ... show more This IP was detected by CrowdSec triggering crowdsecurity/suricata-major-severity(ET TOR Known Tor Exit Node Traffic group 80). show less	Hacking Web App Attack
Anonymous	2026-07-22 18:09:52 (2 days ago)	PSCDE WEBFORM SPAM 209.141.56.103 (us.linkanator-exit.c.dn.ua)	Web Spam
🇺🇸 TPI-Abuse	2026-07-20 13:38:19 (4 days ago)	(mod_security) mod_security (id:210492) triggered by 209.141.56.103 (us.linkanator-exit.c.dn.ua): 1 ... show more (mod_security) mod_security (id:210492) triggered by 209.141.56.103 (us.linkanator-exit.c.dn.ua): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jul 20 09:38:15.557528 2026] [security2:error] [pid 23636:tid 23636] [client 209.141.56.103:61830] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "test.nationalccl.com"] [uri "/blog/about/.git/HEAD"] [unique_id "al4kxxUozeZRMbvNjQmS1QAAAA0"] show less	Brute-Force Bad Web Bot Web App Attack
Anonymous	2026-07-20 08:48:53 (5 days ago)	Detected Hacking, SQL Injection or general Web App Attack	Web App Attack
🇺🇸 oncord	2026-07-19 14:08:27 (5 days ago)	Form spam	Web Spam
🇺🇸 nowyouknow	2026-07-19 11:13:24 (5 days ago)	(From [email protected]) FQzyPvjhvBePwxbGsqRHa	Phishing Web Spam
🇫🇮 as211431.net	2026-07-19 11:02:10 (5 days ago)	Triggered Cloudflare WAF (firewallCustom) from T1. Action taken: BLOCK Protocol: HTTP/1.1 (GET metho ... show more Triggered Cloudflare WAF (firewallCustom) from T1. Action taken: BLOCK Protocol: HTTP/1.1 (GET method) Endpoint: /geofeed.csv UA: Go-http-client/1.1 This report was generated by: https://github.com/sefinek/Cloudflare-WAF-To-AbuseIPDB show less	Bad Web Bot
🇩🇪 raph	2026-07-18 14:18:15 (6 days ago)	[SQL INJECTION] f2b match %{+Q}r for ^.haproxy\[[0-9]+\]: <HOST>:. (GET \|POST ).\?.(%20AND%20\|%2 ... show more [SQL INJECTION] f2b match %{+Q}r for ^.haproxy\[[0-9]+\]: <HOST>:. (GET \|POST ).\?.(%20AND%20\|%20and%20\|%20OR%20\|%20or%20).* HTTP/1.1$ show less	SQL Injection
🇺🇸 TPI-Abuse	2026-07-18 03:16:27 (1 week ago)	(mod_security) mod_security (id:211220) triggered by 209.141.56.103 (us.linkanator-exit.c.dn.ua): 1 ... show more (mod_security) mod_security (id:211220) triggered by 209.141.56.103 (us.linkanator-exit.c.dn.ua): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jul 17 23:16:18.400527 2026] [security2:error] [pid 2542895:tid 2542895] [client 209.141.56.103:32768] ModSecurity: Access denied with code 403 (phase 2). Pattern match "<\\\\?(?!xml\\\\s)" at ARGS:vars[0]. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "70"] [id "211220"] [rev "4"] [msg "COMODO WAF: PHP Injection Attack\|\|hppagewideprinting.computersraleigh.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "hppagewideprinting.computersraleigh.com"] [uri "/index.php"] [unique_id "alrwAlOwscgUpIw_at9kFgAAAAA"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-07-17 09:18:12 (1 week ago)	(mod_security) mod_security (id:210831) triggered by 209.141.56.103 (us.linkanator-exit.c.dn.ua): 1 ... show more (mod_security) mod_security (id:210831) triggered by 209.141.56.103 (us.linkanator-exit.c.dn.ua): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jul 17 05:18:03.753708 2026] [security2:error] [pid 32539:tid 32539] [client 209.141.56.103:44376] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url\|user-Agent\|www\\\\.weblogs\\\\.com\|(?:jakart\|vi)a\|(google\|i{0,1}explorer{0,1}\\\\.exe\|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)\|\\\\bdatacha0s\\\\b\|; widows\|\\\\\\\\r\|a(?: href=\|d(?:sarobot\|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler\|\|www.spontaneouscombustibles.com\|F\|4"] [data "panscient.com"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "www.spontaneouscombustibles.com"] [uri "/"] [unique_id "alnzS9S2cojPCN05etARmAAAABM"] show less	Brute-Force Bad Web Bot Web App Attack
🇩🇪 anycast_ac	2026-07-15 22:21:33 (1 week ago)	[DDoS Attacker] This IP was attacking website anycast.ac and sent 663 requests on port 443	DDoS Attack Web App Attack
🇺🇸 xmission.com	2026-07-15 15:22:38 (1 week ago)	Blocked by UFW (TCP on 28341) Source port: 17352 TTL: 53 Packet length: 60 TOS: 0x08 This report (f ... show more Blocked by UFW (TCP on 28341) Source port: 17352 TTL: 53 Packet length: 60 TOS: 0x08 This report (for 209.141.56.103) was generated by: https://github.com/sefinek/UFW-AbuseIPDB-Reporter show less	Port Scan

Showing 1 to 15 of 46 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇳🇱 195.178.110.30

🇷🇴 193.32.162.15

🇳🇱 176.65.148.158

🇮🇳 103.110.21.167

🇫🇷 91.134.23.125

🇭🇰 199.45.154.190

🇷🇺 178.187.248.243

🇺🇸 172.253.244.156

🇵🇭 165.154.59.118

🇺🇸 147.185.132.149

🇳🇱 89.21.67.163

🇷🇴 80.94.95.211

🇺🇸 216.25.89.143

🇺🇸 195.184.76.104

🇺🇸 185.202.220.50

🇺🇸 173.194.103.22

🇧🇷 170.247.241.47

🇫🇮 147.185.133.152

🇺🇸 144.225.187.68

🇺🇸 129.121.114.225