AbuseIPDB » 45.138.16.107

45.138.16.107 was found in our database!

This IP was reported 1,065 times. Confidence of Abuse is 100%: ?

100%

This address is a Tor exit node. Neither the owner nor the provider are directly behind the offending action.

ISP	1337 Services GmbH
Usage Type	Data Center/Web Hosting/Transit
ASN	AS210558
Domain Name	as210558.net
Country	Poland
City	Warsaw, Mazovia

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated biweekly.

Report 45.138.16.107

Whois 45.138.16.107

IP Abuse Reports for 45.138.16.107:

This IP address has been reported a total of 1,065 times from 244 distinct sources. 45.138.16.107 was first reported on June 2nd 2023, and the most recent report was 15 hours ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp in UTC	Comment	Categories
TPI-Abuse	2025-06-03 02:10:33 (2 weeks ago)	(mod_security) mod_security (id:210492) triggered by 45.138.16.107 (-): 1 in the last 300 secs; Port ... show more(mod_security) mod_security (id:210492) triggered by 45.138.16.107 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jun 02 22:10:28.168520 2025] [security2:error] [pid 513245:tid 513245] [client 45.138.16.107:14318] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cestcaryntravel.com"] [uri "/.git/config"] [unique_id "aD5ZlDJjNSWzyM0d8dbeFgAAAAs"] show less	Brute-Force Bad Web Bot Web App Attack
TPI-Abuse	2025-06-02 13:42:24 (2 weeks ago)	(mod_security) mod_security (id:210492) triggered by 45.138.16.107 (-): 1 in the last 300 secs; Port ... show more(mod_security) mod_security (id:210492) triggered by 45.138.16.107 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jun 02 09:42:21.554910 2025] [security2:error] [pid 3760445:tid 3760445] [client 45.138.16.107:62644] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "caregiversreprieve.com"] [uri "/.git/config"] [unique_id "aD2qPcJeGMssgNjVcheorQAAAAQ"] show less	Brute-Force Bad Web Bot Web App Attack
TPI-Abuse	2025-06-01 15:16:32 (2 weeks ago)	(mod_security) mod_security (id:210492) triggered by 45.138.16.107 (-): 1 in the last 300 secs; Port ... show more(mod_security) mod_security (id:210492) triggered by 45.138.16.107 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Jun 01 11:16:28.241991 2025] [security2:error] [pid 2675121:tid 2675121] [client 45.138.16.107:49724] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "consolidatedoperationsgroup.com"] [uri "/wp-config.php.save.2"] [unique_id "aDxuzIEGkmh8pTbtCWlK6AAAAAY"] show less	Brute-Force Bad Web Bot Web App Attack
oncord	2025-06-01 11:40:32 (2 weeks ago)	Form spam	Web Spam
Pingger Shikkoken	2025-05-28 23:57:38 (3 weeks ago)	2025-05-28T23:57:38+00:00 iskariot kernel: AbuseIPDB-Blacklist-Dropped: IN=ens3 OUT=ServerBridge MAC ... show more2025-05-28T23:57:38+00:00 iskariot kernel: AbuseIPDB-Blacklist-Dropped: IN=ens3 OUT=ServerBridge MAC=b6:ab:74:e6:2e:14:84:03:28:62:58:1a:08:00 SRC=45.138.16.107 DST=10.1.1.11 LEN=60 TOS=0x00 PREC=0x40 TTL=56 ID=35997 DF PROTO=TCP SPT=16944 DPT=8443 WINDOW=64240 RES=0x00 SYN URGP=0 2025-05-28T23:57:39+00:00 iskariot kernel: AbuseIPDB-Blacklist-Dropped: IN=ens3 OUT=ServerBridge MAC=b6:ab:74:e6:2e:14:84:03:28:62:58:1a:08:00 SRC=45.138.16.107 DST=10.1.1.11 LEN=60 TOS=0x00 PREC=0x40 TTL=56 ID=24518 DF PROTO=TCP SPT=16948 DPT=8443 WINDOW=64240 RES=0x00 SYN URGP=0 2025-05-28T23:57:39+00:00 iskariot kernel: AbuseIPDB-Blacklist-Dropped: IN=ens3 OUT=ServerBridge MAC=b6:ab:74:e6:2e:14:84:03:28:62:58:1a:08:00 SRC=45.138.16.107 DST=10.1.1.11 LEN=60 TOS=0x00 PREC=0x40 TTL=56 ID=35998 DF PROTO=TCP SPT=16944 DPT=8443 WINDOW=64240 RES=0x00 SYN URGP=0 ... show less	Hacking Bad Web Bot
TPI-Abuse	2025-05-28 00:26:27 (3 weeks ago)	(mod_security) mod_security (id:210492) triggered by 45.138.16.107 (-): 1 in the last 300 secs; Port ... show more(mod_security) mod_security (id:210492) triggered by 45.138.16.107 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue May 27 20:26:22.562204 2025] [security2:error] [pid 789520:tid 789520] [client 45.138.16.107:58260] [client 45.138.16.107] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "artbytracyjane.com"] [uri "/.git/config"] [unique_id "aDZYLslj_e8RPLlMHvgLRgAAAA8"] show less	Brute-Force Bad Web Bot Web App Attack
ThreatBook.io	2025-05-26 23:08:38 (3 weeks ago)	ThreatBook Intelligence: tor_proxy,Zombie more details on https://threatbook.io/ip/45.138.16.107<br ... show moreThreatBook Intelligence: tor_proxy,Zombie more details on https://threatbook.io/ip/45.138.16.107 2025-05-26 16:40:51 / 2025-05-26 16:40:40 / 2025-05-26 16:41:04 https://d3ivqzdymldr3c.cloudfront.net/ 2025-05-26 16:41:18 http://d3ivqzdymldr3c.cloudfront.net/ show less	Web App Attack
Pingger Shikkoken	2025-05-26 21:57:25 (3 weeks ago)	2025-05-26T21:57:25+00:00 iskariot kernel: AbuseIPDB-Blacklist-Dropped: IN=ens3 OUT=ServerBridge MAC ... show more2025-05-26T21:57:25+00:00 iskariot kernel: AbuseIPDB-Blacklist-Dropped: IN=ens3 OUT=ServerBridge MAC=b6:ab:74:e6:2e:14:84:03:28:62:58:1a:08:00 SRC=45.138.16.107 DST=10.1.1.11 LEN=60 TOS=0x00 PREC=0x40 TTL=56 ID=46239 DF PROTO=TCP SPT=55640 DPT=8443 WINDOW=64240 RES=0x00 SYN URGP=0 2025-05-26T21:57:25+00:00 iskariot kernel: AbuseIPDB-Blacklist-Dropped: IN=ens3 OUT=ServerBridge MAC=b6:ab:74:e6:2e:14:84:03:28:62:58:1a:08:00 SRC=45.138.16.107 DST=10.1.1.11 LEN=60 TOS=0x00 PREC=0x40 TTL=56 ID=4911 DF PROTO=TCP SPT=55634 DPT=8443 WINDOW=64240 RES=0x00 SYN URGP=0 2025-05-26T21:57:26+00:00 iskariot kernel: AbuseIPDB-Blacklist-Dropped: IN=ens3 OUT=ServerBridge MAC=b6:ab:74:e6:2e:14:84:03:28:62:58:1a:08:00 SRC=45.138.16.107 DST=10.1.1.11 LEN=60 TOS=0x00 PREC=0x40 TTL=56 ID=46240 DF PROTO=TCP SPT=55640 DPT=8443 WINDOW=64240 RES=0x00 SYN URGP=0 ... show less	Hacking Bad Web Bot
oncord	2025-05-24 05:12:09 (3 weeks ago)	Form spam	Web Spam
Anonymous	2025-05-19 17:54:51 (1 month ago)	[20/May/2025:03:54:50 +1000] "GET /wp-admin/ HTTP/1.1" 301 250 "https://[X].[X]/wp-login.php" "Mozil ... show more[20/May/2025:03:54:50 +1000] "GET /wp-admin/ HTTP/1.1" 301 250 "https://[X].[X]/wp-login.php" "Mozilla/5.0 (Linux; Android 12; SM-S9160 Build/UP1A.231001.007; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/132.0.6834.122 Mobile Safari/537.36 [FB_IAB/FB4A;FBAV/492.0.0.59.109;]" show less	Hacking Web App Attack
rtbh.com.tr	2025-05-17 20:08:11 (1 month ago)	list.rtbh.com.tr report: tcp/0	Brute-Force
Study Bitcoin 🤗	2025-05-16 23:01:00 (1 month ago)	4 port probes: 4x tcp/8333 [ros]	Port Scan
rtbh.com.tr	2025-05-16 20:08:11 (1 month ago)	list.rtbh.com.tr report: tcp/0	Brute-Force
lp	2025-05-10 21:21:27 (1 month ago)	Unauthorized VPN login attempts: 1 attempts were recorded from 45.138.16.107 2025-05-10T23:12: ... show moreUnauthorized VPN login attempts: 1 attempts were recorded from 45.138.16.107 2025-05-10T23:12:48+02:00 vpn Access-Reject 'operator' station: 45.138.16.107 auth-type: - realm: vse.cz nas: <redacted> called: <redacted> => address-pool: - msg: '<redacted>' show less	Brute-Force Web App Attack
COMPLEX	2025-05-07 03:30:49 (1 month ago)	Triggered Cloudflare WAF (l7ddos) from T1. Action taken: BLOCK ASN: 210558 (SERVICES-133 ... show moreTriggered Cloudflare WAF (l7ddos) from T1. Action taken: BLOCK ASN: 210558 (SERVICES-1337-GMBH 1337-SERVICES-GMBH-NETWORK) Protocol: HTTP/2 (GET method) Timestamp: 2025-05-07T03:21:38Z show less	Bad Web Bot

Is this your IP? You may request to takedown any associated reports. We will attempt to verify your ownership. Request Takedown 🚩