JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 45.66.35.44

45.66.35.44 was found in our database!

This IP was reported 20 times. Confidence of Abuse is 87%: ?

87%

This address is a Tor exit node. Neither the owner nor the provider are directly behind the offending action.

ISP	SABOTAGE LLC
Usage Type	Data Center/Web Hosting/Transit
ASN	AS61125
Hostname(s)	ams24.torexit.nl
Domain Name	sabotage.net
Country	🇳🇱 Netherlands
City	Lijnden, North Holland

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 45.66.35.44

Whois 45.66.35.44

IP Abuse Reports for 45.66.35.44:

This IP address has been reported a total of 20 times from 16 distinct sources. 45.66.35.44 was first reported on July 14th 2026, and the most recent report was 14 hours ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇺🇸 cwytech	2026-07-21 03:03:48 (14 hours ago)	Fleet-wide ban from the Ghostfleet 👻. Triggered by scenario: cwy/wp-us-login-only-high.	Bad Web Bot Web App Attack
🇩🇪 MusicLibrary	2026-07-20 20:58:53 (20 hours ago)	Probing foreign-stack admin panels / known exploit paths (Joomla, phpMyAdmin, phpunit, OWA, etc.)	Bad Web Bot Web App Attack
🇸🇪 vaia.cloud	2026-07-20 20:35:02 (20 hours ago)	crowdsecurity/http-probing	Brute-Force Web App Attack
🇩🇪 big-cloud.nl	2026-07-20 19:40:59 (21 hours ago)	Try to access /xmlrpc.php	Web App Attack
🇳🇱 sernate	2026-07-19 03:18:43 (2 days ago)	(XMLRPC) WP XMLPRC Attack 45.66.35.44 (ams24.torexit.nl): 5 in the last 3600 secs; Ports: ; Directi ... show more (XMLRPC) WP XMLPRC Attack 45.66.35.44 (ams24.torexit.nl): 5 in the last 3600 secs; Ports: ; Direction: inout; Trigger: LF_CUSTOMTRIGGER show less	Brute-Force
Anonymous	2026-07-19 02:04:22 (2 days ago)	Fail2Ban: ModSecurity detected a web application attack.	Bad Web Bot Web App Attack
Anonymous	2026-07-18 12:08:54 (3 days ago)	SQL injection, multiple attempts.	SQL Injection
🇺🇸 TPI-Abuse	2026-07-18 09:38:08 (3 days ago)	(mod_security) mod_security (id:240335) triggered by 45.66.35.44 (ams24.torexit.nl): 1 in the last 3 ... show more (mod_security) mod_security (id:240335) triggered by 45.66.35.44 (ams24.torexit.nl): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Jul 18 05:38:03.204512 2026] [security2:error] [pid 31632:tid 31773] [client 45.66.35.44:54508] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 45.66.35.44 (+1 hits since last alert)\|dasperformance.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "dasperformance.com"] [uri "/xmlrpc.php"] [unique_id "altJe2nespRWFmzMN49tdAAAAFU"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-07-18 09:13:35 (3 days ago)	(mod_security) mod_security (id:210831) triggered by 45.66.35.44 (ams24.torexit.nl): 1 in the last 3 ... show more (mod_security) mod_security (id:210831) triggered by 45.66.35.44 (ams24.torexit.nl): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Jul 18 05:13:31.948181 2026] [security2:error] [pid 25545:tid 25545] [client 45.66.35.44:50452] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url\|user-Agent\|www\\\\.weblogs\\\\.com\|(?:jakart\|vi)a\|(google\|i{0,1}explorer{0,1}\\\\.exe\|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)\|\\\\bdatacha0s\\\\b\|; widows\|\\\\\\\\r\|a(?: href=\|d(?:sarobot\|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler\|\|www.summithost.com\|F\|4"] [data "panscient.com"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "www.summithost.com"] [uri "/"] [unique_id "altDu5NqpqLZO7k8YxBF3gAAAA0"] show less	Brute-Force Bad Web Bot Web App Attack
🇫🇷 SpaceHost-Server	2026-07-17 22:34:36 (3 days ago)		Brute-Force Web App Attack
🇬🇧 gbzret4d	2026-07-17 16:09:18 (4 days ago)	Honeypot [uk-production01]: Incoming HTTP traffic on port 81	Hacking Bad Web Bot
🇫🇷 SpaceHost-Server	2026-07-16 22:30:32 (4 days ago)		Brute-Force Web App Attack
🇺🇸 TPI-Abuse	2026-07-16 21:49:32 (4 days ago)	(mod_security) mod_security (id:210831) triggered by 45.66.35.44 (ams24.torexit.nl): 1 in the last 3 ... show more (mod_security) mod_security (id:210831) triggered by 45.66.35.44 (ams24.torexit.nl): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jul 16 17:49:27.458818 2026] [security2:error] [pid 883:tid 883] [client 45.66.35.44:57280] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url\|user-Agent\|www\\\\.weblogs\\\\.com\|(?:jakart\|vi)a\|(google\|i{0,1}explorer{0,1}\\\\.exe\|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)\|\\\\bdatacha0s\\\\b\|; widows\|\\\\\\\\r\|a(?: href=\|d(?:sarobot\|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler\|\|www.pocosfarm.com\|F\|4"] [data "panscient.com"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "www.pocosfarm.com"] [uri "/robots.txt"] [unique_id "allR51hT37DiGz3-arCa0wAAAAE"] show less	Brute-Force Bad Web Bot Web App Attack
🇩🇪 FeG Deutschland	2026-07-16 16:22:53 (5 days ago)	Looking for CMS/PHP/SQL vulnerablilities/excessive crawling - 2	Exploited Host Web App Attack
🇸🇪 konseptit	2026-07-16 13:42:13 (5 days ago)	(wordpress) Failed wordpress login from 45.66.35.44 (ams24.torexit.nl)	Brute-Force

Showing 1 to 15 of 20 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇪🇨 177.234.234.211

🇵🇱 176.53.159.198

🇺🇸 162.216.150.60

🇺🇸 98.159.37.110

🇩🇪 93.152.221.13

🇺🇸 23.226.211.72

🇬🇧 2a06:4880::1f

🇨🇳 119.96.158.238

🇧🇬 91.148.190.7

🇳🇱 91.92.42.34

🇺🇿 82.215.111.235

🇱🇺 64.89.161.91

🇺🇸 54.226.135.115

🇸🇬 212.73.148.18

🇧🇪 198.235.24.222

🇺🇸 195.184.76.105

🇦🇷 181.28.101.14

🇺🇿 176.101.56.126

🇩🇪 162.158.111.65

🇺🇸 152.32.208.56