JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 209.141.61.225

209.141.61.225 was found in our database!

This IP was reported 59 times. Confidence of Abuse is 60%: ?

60%

This address is a Tor exit node. Neither the owner nor the provider are directly behind the offending action.

ISP	FranTech Solutions
Usage Type	Data Center/Web Hosting/Transit
ASN	AS53667
Hostname(s)	tor.exit.us2.2cb.li
Domain Name	frantech.ca
Country	🇺🇸 United States of America
City	Las Vegas, Nevada

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 209.141.61.225

Whois 209.141.61.225

IP Abuse Reports for 209.141.61.225:

This IP address has been reported a total of 59 times from 35 distinct sources. 209.141.61.225 was first reported on March 7th 2026, and the most recent report was 1 day ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇮🇩 securejdprop	2026-07-09 07:16:03 (1 day ago)	This IP was detected by CrowdSec triggering crowdsecurity/suricata-major-severity(ET TOR Known Tor E ... show more This IP was detected by CrowdSec triggering crowdsecurity/suricata-major-severity(ET TOR Known Tor Exit Node Traffic group 82). Ip 209.141.61.225 performed 'crowdsecurity/suricata-major-severity' (1 events over 0s) at 2026-07-09 07:16:01.781564845 +0000 UTC show less	Hacking Web App Attack
🇦🇺 screwlooseit.com.au	2026-07-09 07:00:44 (1 day ago)	Blocked by CSF 13 firewall - Rule: XMLRPC US/United States/tor.exit.us2.2cb.li	Web App Attack
🇺🇸 TPI-Abuse	2026-07-09 01:51:17 (1 day ago)	(mod_security) mod_security (id:225170) triggered by 209.141.61.225 (tor.exit.us2.2cb.li): 1 in the ... show more (mod_security) mod_security (id:225170) triggered by 209.141.61.225 (tor.exit.us2.2cb.li): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jul 08 21:51:13.692420 2026] [security2:error] [pid 4546:tid 4546] [client 209.141.61.225:42044] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)\|\|nolaanime.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "nolaanime.com"] [uri "/wp-json/wp/v2/users"] [unique_id "ak7-kTTCJFErj2xbdPT7NQAAAAU"] show less	Brute-Force Bad Web Bot Web App Attack
🇩🇪 big-cloud.nl	2026-07-08 07:32:06 (2 days ago)	Try to access /xmlrpc.php	Web App Attack
🇺🇸 TPI-Abuse	2026-07-08 06:05:50 (2 days ago)	(mod_security) mod_security (id:210492) triggered by 209.141.61.225 (tor.exit.us2.2cb.li): 1 in the ... show more (mod_security) mod_security (id:210492) triggered by 209.141.61.225 (tor.exit.us2.2cb.li): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jul 08 02:05:45.230038 2026] [security2:error] [pid 9944:tid 9944] [client 209.141.61.225:36798] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "mail.groomattheinn.com"] [uri "/.git/config"] [unique_id "ak3ouc5zdGFee0i-fsUsFwAAAAk"] show less	Brute-Force Bad Web Bot Web App Attack
🇳🇱 knock	2026-07-04 19:23:21 (5 days ago)	Knock-Knock honeypot brute-force: proto8 (3 total hits)	Brute-Force
🇺🇸 TPI-Abuse	2026-07-02 05:37:29 (1 week ago)	(mod_security) mod_security (id:240335) triggered by 209.141.61.225 (tor.exit.us2.2cb.li): 1 in the ... show more (mod_security) mod_security (id:240335) triggered by 209.141.61.225 (tor.exit.us2.2cb.li): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jul 02 01:37:23.307589 2026] [security2:error] [pid 4289:tid 4299] [client 209.141.61.225:38990] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 209.141.61.225 (+1 hits since last alert)\|coloradomountain.homes\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "coloradomountain.homes"] [uri "/xmlrpc.php"] [unique_id "akX5ExYXZd8egqvnM8QBKAAAAEg"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 Bankbook8585	2026-06-26 21:34:41 (1 week ago)	T-Pot honeypot \| Cowrie SSH/Telnet honeypot: cowrie.login.success user=root	Brute-Force SSH
🇫🇷 DUBREUIL	2026-06-23 15:46:00 (2 weeks ago)	As always with frantech Tor exit node Fake registration /en/index.php?controller=registration	DDoS Attack Open Proxy Port Scan Brute-Force Web App Attack SSH Hacking SQL Injection
🇳🇱 homeshowdomain.nl	2026-06-17 22:00:12 (3 weeks ago)	Auto-ban: >3000 req/min op 2026-06-17	Web App Attack SSH Hacking
🇩🇪 LRob	2026-06-15 20:30:26 (3 weeks ago)	Repeated requests on blocked xmlrpc.php, blocked by fail2ban in custom-503-xmlrpc jail	Bad Web Bot Web App Attack
🇩🇪 big-cloud.nl	2026-06-14 09:13:17 (3 weeks ago)	Try to access /xmlrpc.php	Web App Attack
🇺🇸 TPI-Abuse	2026-06-12 03:10:26 (4 weeks ago)	(mod_security) mod_security (id:210492) triggered by 209.141.61.225 (tor.exit.us2.2cb.li): 1 in the ... show more (mod_security) mod_security (id:210492) triggered by 209.141.61.225 (tor.exit.us2.2cb.li): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jun 11 23:10:13.572315 2026] [security2:error] [pid 2822:tid 2822] [client 209.141.61.225:57730] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "autodiscover.camillascause.org"] [uri "/.git/config"] [unique_id "ait4lcM6sDGiX1Wqex-k8wAAAAg"] show less	Brute-Force Bad Web Bot Web App Attack
🇦🇺 screwlooseit.com.au	2026-06-11 10:22:05 (4 weeks ago)	Blocked by CSF 13 firewall - Rule: WPLOGIN US/United States/tor.exit.us2.2cb.li	Web App Attack
🇺🇸 TPI-Abuse	2026-06-08 10:07:47 (1 month ago)	(mod_security) mod_security (id:210492) triggered by 209.141.61.225 (tor.exit.us2.2cb.li): 1 in the ... show more (mod_security) mod_security (id:210492) triggered by 209.141.61.225 (tor.exit.us2.2cb.li): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jun 08 06:07:42.562090 2026] [security2:error] [pid 16972:tid 16972] [client 209.141.61.225:58468] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "webdisk.bearchristmascards.com"] [uri "/.git/config"] [unique_id "aiaUboN3oCI3rwCrkH3pxgAAAEs"] show less	Brute-Force Bad Web Bot Web App Attack

Showing 1 to 15 of 59 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇹🇭 202.29.242.115

🇵🇦 190.14.223.70

🇰🇷 110.93.150.35

🇺🇸 100.50.17.159

🇷🇴 92.118.39.71

🇧🇷 2804:16d8:f26a:100:c1a5:385d:8330:ceaf

🇧🇪 198.235.24.179

🇺🇸 147.185.132.188

🇰🇷 110.93.150.123

🇩🇪 69.5.169.174

🇬🇧 35.203.210.84

🇬🇧 5.83.214.6

🇺🇸 2607:f8b0:4001:c2b::120

🇺🇸 205.210.31.64

🇵🇭 203.160.161.14

🇺🇦 193.238.38.27

🇬🇧 165.227.229.113

🇺🇸 162.0.230.235

🇫🇮 147.185.133.147

🇭🇰 118.193.39.103