JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 45.66.35.42

45.66.35.42 was found in our database!

This IP was reported 21 times. Confidence of Abuse is 90%: ?

90%

This address is a Tor exit node. Neither the owner nor the provider are directly behind the offending action.

ISP	SABOTAGE LLC
Usage Type	Data Center/Web Hosting/Transit
ASN	AS61125
Hostname(s)	ams22.torexit.nl
Domain Name	sabotage.net
Country	🇳🇱 Netherlands
City	Lijnden, North Holland

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 45.66.35.42

Whois 45.66.35.42

IP Abuse Reports for 45.66.35.42:

This IP address has been reported a total of 21 times from 16 distinct sources. 45.66.35.42 was first reported on July 14th 2026, and the most recent report was 8 hours ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇩🇪 ger-stg-sifi1	2026-07-19 05:10:05 (8 hours ago)	(wordpress) Failed wordpress login using wp-login.php or xmlrpc.php	Web App Attack
🇳🇱 Site.eu	2026-07-19 00:13:02 (13 hours ago)	Repeated wp-login/xmlrpc attempts	Brute-Force SSH
🇺🇸 TPI-Abuse	2026-07-18 13:54:35 (1 day ago)	(mod_security) mod_security (id:210831) triggered by 45.66.35.42 (ams22.torexit.nl): 1 in the last 3 ... show more (mod_security) mod_security (id:210831) triggered by 45.66.35.42 (ams22.torexit.nl): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Jul 18 09:54:27.761232 2026] [security2:error] [pid 16874:tid 16874] [client 45.66.35.42:54308] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url\|user-Agent\|www\\\\.weblogs\\\\.com\|(?:jakart\|vi)a\|(google\|i{0,1}explorer{0,1}\\\\.exe\|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)\|\\\\bdatacha0s\\\\b\|; widows\|\\\\\\\\r\|a(?: href=\|d(?:sarobot\|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler\|\|www.boatregistrationdelaware.com\|F\|4"] [data "panscient.com"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "www.boatregistrationdelaware.com"] [uri "/robots.txt"] [unique_id "aluFk6qMbxYSS855Aqpn0AAAAAE"] show less	Brute-Force Bad Web Bot Web App Attack
Anonymous	2026-07-18 12:24:56 (1 day ago)	Fail2Ban: ModSecurity detected a web application attack.	Bad Web Bot Web App Attack
🇺🇸 rsiddall	2026-07-18 08:32:50 (1 day ago)	45.66.35.42 - - [18/Jul/2026:04:32:49 -0400] "POST /xmlrpc.php HTTP/1.1" 404 - "-" "Mozilla/5.0 (X11 ... show more 45.66.35.42 - - [18/Jul/2026:04:32:49 -0400] "POST /xmlrpc.php HTTP/1.1" 404 - "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36" 45.66.35.42 - - [18/Jul/2026:04:32:50 -0400] "POST /xmlrpc.php HTTP/1.1" 404 - "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36" ... show less	Brute-Force
🇺🇸 TPI-Abuse	2026-07-17 17:08:58 (1 day ago)	(mod_security) mod_security (id:210492) triggered by 45.66.35.42 (ams22.torexit.nl): 1 in the last 3 ... show more (mod_security) mod_security (id:210492) triggered by 45.66.35.42 (ams22.torexit.nl): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jul 17 13:08:51.388593 2026] [security2:error] [pid 16560:tid 16588] [client 45.66.35.42:60700] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "autodiscover.citydentalclinic.com"] [uri "/.git/config"] [unique_id "alpho3bVJWGp_JcnR_VwwQAAAJY"] show less	Brute-Force Bad Web Bot Web App Attack
Anonymous	2026-07-17 10:42:56 (2 days ago)	Fail2Ban: ModSecurity detected a web application attack.	Bad Web Bot Web App Attack
🇺🇸 HamSammich	2026-07-17 02:56:05 (2 days ago)	Automated sensor: 1 HTTPS connection/probe attempts over the last 24h (latest 2026-07-17T02:56Z).	Brute-Force Web App Attack
🇫🇷 dynamix	2026-07-16 20:24:45 (2 days ago)	Multiple WAF Violations	Web App Attack
🇺🇸 TPI-Abuse	2026-07-16 17:09:04 (2 days ago)	(mod_security) mod_security (id:210831) triggered by 45.66.35.42 (ams22.torexit.nl): 1 in the last 3 ... show more (mod_security) mod_security (id:210831) triggered by 45.66.35.42 (ams22.torexit.nl): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jul 16 13:06:43.886696 2026] [security2:error] [pid 1114:tid 1114] [client 45.66.35.42:55234] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url\|user-Agent\|www\\\\.weblogs\\\\.com\|(?:jakart\|vi)a\|(google\|i{0,1}explorer{0,1}\\\\.exe\|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)\|\\\\bdatacha0s\\\\b\|; widows\|\\\\\\\\r\|a(?: href=\|d(?:sarobot\|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler\|\|www.pinballhistory.com\|F\|4"] [data "panscient.com"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "www.pinballhistory.com"] [uri "/robots.txt"] [unique_id "alkPow0TNhH3ukeurrdwAwAAAC8"] show less	Brute-Force Bad Web Bot Web App Attack
🇩🇪 stinpriza	2026-07-16 15:55:43 (2 days ago)	Web App Attack	Web App Attack
🇺🇸 TPI-Abuse	2026-07-16 15:09:59 (2 days ago)	(mod_security) mod_security (id:225170) triggered by 45.66.35.42 (ams22.torexit.nl): 1 in the last 3 ... show more (mod_security) mod_security (id:225170) triggered by 45.66.35.42 (ams22.torexit.nl): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jul 16 11:09:54.521350 2026] [security2:error] [pid 5623:tid 5623] [client 45.66.35.42:38354] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)\|\|thenewplantation.org\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "thenewplantation.org"] [uri "/wp-json/wp/v2/users/1"] [unique_id "alj0Qlh4I0jADqgbmXW4XAAAAAc"] show less	Brute-Force Bad Web Bot Web App Attack
🇮🇩 securejdprop	2026-07-16 14:57:19 (2 days ago)	This IP was detected by CrowdSec triggering crowdsecurity/suricata-major-severity(ET TOR Known Tor E ... show more This IP was detected by CrowdSec triggering crowdsecurity/suricata-major-severity(ET TOR Known Tor Exit Node Traffic group 116). show less	Hacking Web App Attack
🇩🇪 raph	2026-07-16 11:54:59 (3 days ago)	[SQL INJECTION] f2b match %{+Q}r for ^.haproxy\[[0-9]+\]: <HOST>:. (GET \|POST ).\?.(%20AND%20\|%2 ... show more [SQL INJECTION] f2b match %{+Q}r for ^.haproxy\[[0-9]+\]: <HOST>:. (GET \|POST ).\?.(%20AND%20\|%20and%20\|%20OR%20\|%20or%20).* HTTP/1.1$ show less	SQL Injection
🇩🇪 LRob	2026-07-16 10:43:59 (3 days ago)	CrowdSec: lrob/wp-xmlrpc-bf \| req: /xmlrpc.php \| UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) Apple ... show more CrowdSec: lrob/wp-xmlrpc-bf \| req: /xmlrpc.php \| UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 Edg/124.0.2478.80 show less	Brute-Force Web App Attack

Showing 1 to 15 of 21 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇺🇸 2001:500:123::30

🇩🇪 213.209.159.113

🇩🇪 213.209.159.26

🇺🇸 207.90.244.12

🇬🇷 195.251.38.34

🇧🇷 187.125.176.130

🇵🇾 186.158.200.133

🇵🇱 176.53.159.196

🇺🇸 162.217.100.41

🇳🇱 161.35.90.48

🇮🇹 152.89.168.29

🇪🇸 139.28.79.213

🇺🇸 136.107.173.79

🇨🇳 118.122.91.59

🇻🇳 112.197.2.116

🇨🇳 111.61.177.188

🇮🇩 103.188.177.46

🇹🇷 94.154.43.140

🇧🇬 91.92.47.53

🇫🇷 85.69.240.210