AbuseIPDB » 5.255.100.26

5.255.100.26 was found in our database!

This IP was reported 796 times. Confidence of Abuse is 71%: ?

71%

This address is a Tor exit node. Neither the owner nor the provider are directly behind the offending action.

ISP	The Infrastructure Group B.V.
Usage Type	Data Center/Web Hosting/Transit
ASN	AS60404
Hostname(s)	tor-exit-01.wurzel.io
Domain Name	theinfrastructure.group
Country	Netherlands
City	Dronten, Flevoland

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated biweekly.

Report 5.255.100.26

Whois 5.255.100.26

IP Abuse Reports for 5.255.100.26:

This IP address has been reported a total of 796 times from 173 distinct sources. 5.255.100.26 was first reported on December 25th 2021, and the most recent report was 1 day ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp in UTC	Comment	Categories
rtbh.com.tr	2025-04-14 20:06:05 (2 months ago)	list.rtbh.com.tr report: tcp/0	Brute-Force
TPI-Abuse	2025-04-13 12:12:09 (2 months ago)	(mod_security) mod_security (id:210492) triggered by 5.255.100.26 (tor-exit-01.wurzel.io): 1 in the ... show more(mod_security) mod_security (id:210492) triggered by 5.255.100.26 (tor-exit-01.wurzel.io): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Apr 13 08:12:06.234999 2025] [security2:error] [pid 3046953:tid 3046953] [client 5.255.100.26:56874] [client 5.255.100.26] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpanel.punctuminteractive.com"] [uri "/.git/config"] [unique_id "Z_uqFrVi61E9UM8G-TiRIQAAAAk"] show less	Brute-Force Bad Web Bot Web App Attack
TPI-Abuse	2025-04-13 08:10:52 (2 months ago)	(mod_security) mod_security (id:210492) triggered by 5.255.100.26 (tor-exit-01.wurzel.io): 1 in the ... show more(mod_security) mod_security (id:210492) triggered by 5.255.100.26 (tor-exit-01.wurzel.io): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Apr 13 04:10:46.161154 2025] [security2:error] [pid 24334:tid 24334] [client 5.255.100.26:43924] [client 5.255.100.26] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "tracytappan.net"] [uri "/wp-config.php.bak.a2"] [unique_id "Z_txht255ThWRUjpbWGvZAAAAAA"] show less	Brute-Force Bad Web Bot Web App Attack
Study Bitcoin 🤗	2025-04-13 03:59:26 (2 months ago)	4 port probes: 4x tcp/8333 [ros]	Port Scan
Anonymous	2025-04-12 06:35:15 (2 months ago)	Viewstate Trap	Web Spam
ipblock.com	2025-04-12 05:57:00 (2 months ago)	IPBlock protected site ID [4055-d][s=02]. Major crawler impostor. Mozilla/5.0 (compati ... show moreIPBlock protected site ID [4055-d][s=02]. Major crawler impostor. Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html) show less	Bad Web Bot
rtbh.com.tr	2025-04-11 20:06:03 (2 months ago)	list.rtbh.com.tr report: tcp/0	Brute-Force
Anonymous	2025-04-11 03:34:40 (2 months ago)	Ports: 80,443; Direction: 0; Trigger: LF_CUSTOMTRIGGER	Brute-Force SSH
ipblock.com	2025-04-11 00:45:00 (2 months ago)	IPBlock protected site ID [4055-d][s=02]. Major crawler impostor. Mozilla/5.0 (compati ... show moreIPBlock protected site ID [4055-d][s=02]. Major crawler impostor. Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html) show less	Bad Web Bot
MAGIC	2025-04-10 06:05:00 (2 months ago)	VM5 Bad user agents ignoring web crawling rules. Draing bandwidth	DDoS Attack Bad Web Bot
Anonymous	2025-04-08 04:11:15 (2 months ago)	Ports: 80,443; Direction: 0; Trigger: LF_CUSTOMTRIGGER	Brute-Force SSH
TPI-Abuse	2025-04-06 03:12:02 (2 months ago)	(mod_security) mod_security (id:210492) triggered by 5.255.100.26 (tor-exit-01.wurzel.io): 1 in the ... show more(mod_security) mod_security (id:210492) triggered by 5.255.100.26 (tor-exit-01.wurzel.io): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Apr 05 23:11:54.654262 2025] [security2:error] [pid 29674:tid 29674] [client 5.255.100.26:43032] [client 5.255.100.26] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "stoughtonpipeandwelding.net"] [uri "/wp-config.php.bak.a2"] [unique_id "Z_Hw-tiDMu0Ajx3iiosTpgAAAAs"] show less	Brute-Force Bad Web Bot Web App Attack
Anonymous	2025-04-04 08:40:12 (2 months ago)	Ports: 80,443; Direction: 0; Trigger: LF_CUSTOMTRIGGER	Brute-Force SSH
LRob.fr	2025-04-04 07:00:07 (2 months ago)	Repeated 403 errors, blocked by Fail2ban in custom-403 jail	Bad Web Bot
strzonnek	2025-04-04 06:42:01 (2 months ago)	attack on webform	Brute-Force Web App Attack

Is this your IP? You may request to takedown any associated reports. We will attempt to verify your ownership. Request Takedown 🚩