AbuseIPDB » 5.255.101.10

5.255.101.10 was found in our database!

This IP was reported 1,084 times. Confidence of Abuse is 76%: ?

76%

This address is a Tor exit node. Neither the owner nor the provider are directly behind the offending action.

ISP	The Infrastructure Group B.V.
Usage Type	Data Center/Web Hosting/Transit
ASN	AS60404
Hostname(s)	tor-exit-3.allium.dev
Domain Name	theinfrastructure.group
Country	Netherlands
City	Amsterdam, North Holland

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated biweekly.

Report 5.255.101.10

Whois 5.255.101.10

IP Abuse Reports for 5.255.101.10:

This IP address has been reported a total of 1,084 times from 216 distinct sources. 5.255.101.10 was first reported on July 12th 2022, and the most recent report was 1 day ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp in UTC	Comment	Categories
chronos	2025-01-13 06:32:23 (1 day ago)	[AUTORAVALT][[13/01/2025 - 03:32:22 -03:00 UTC] Attack from [5.255.101.10]-[RANGE:5.255.101.0 ... show more[AUTORAVALT][[13/01/2025 - 03:32:22 -03:00 UTC] Attack from [5.255.101.10]-[RANGE:5.255.101.0 - 5.255.101.255] [tor-exit-3.allium.dev] Action: BLocKed Phishing -> Phishing websites and/or email. Email Spam -> Spam email content, infected attachments, and phishing emails. Hacking... Unauthorized attempts to access the server. Spoofing -> Email sender spoofing.] ... show less	Phishing Email Spam Hacking Spoofing Brute-Force
TPI-Abuse	2025-01-12 10:24:36 (2 days ago)	(mod_security) mod_security (id:210730) triggered by 5.255.101.10 (tor-exit-3.allium.dev): 1 in the ... show more(mod_security) mod_security (id:210730) triggered by 5.255.101.10 (tor-exit-3.allium.dev): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Jan 12 05:24:29.574987 2025] [security2:error] [pid 28000:tid 28000] [client 5.255.101.10:34834] [client 5.255.101.10] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy\|\|targetbinario.com\|F\|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "targetbinario.com"] [uri "/targetbinario.sql"] [unique_id "Z4OYXYN68F6rmvglyFYprwAAABU"] show less	Brute-Force Bad Web Bot Web App Attack
TPI-Abuse	2025-01-12 07:38:02 (2 days ago)	(mod_security) mod_security (id:210492) triggered by 5.255.101.10 (tor-exit-3.allium.dev): 1 in the ... show more(mod_security) mod_security (id:210492) triggered by 5.255.101.10 (tor-exit-3.allium.dev): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Jan 12 02:37:56.128163 2025] [security2:error] [pid 836910:tid 836910] [client 5.255.101.10:46092] [client 5.255.101.10] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "major33.com"] [uri "/wp-config.php.CloudTech_bak"] [unique_id "Z4NxVBz4cAgpXTbD3EP_kAAAAAo"] show less	Brute-Force Bad Web Bot Web App Attack
TPI-Abuse	2025-01-12 06:52:46 (2 days ago)	(mod_security) mod_security (id:210730) triggered by 5.255.101.10 (tor-exit-3.allium.dev): 1 in the ... show more(mod_security) mod_security (id:210730) triggered by 5.255.101.10 (tor-exit-3.allium.dev): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Jan 12 01:52:42.822003 2025] [security2:error] [pid 20028:tid 20028] [client 5.255.101.10:37782] [client 5.255.101.10] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy\|\|dpcfab.com\|F\|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "dpcfab.com"] [uri "/cfab.sql"] [unique_id "Z4NmuqmPbEnFBakh4f6LgwAAABE"] show less	Brute-Force Bad Web Bot Web App Attack
strzonnek	2025-01-11 21:32:15 (3 days ago)	attack on webform	Brute-Force Web App Attack
chronos	2025-01-11 09:25:16 (3 days ago)	[AUTORAVALT][[11/01/2025 - 06:25:15 -03:00 UTC] Attack from [5.255.101.10]-[RANGE:5.255.101.0 ... show more[AUTORAVALT][[11/01/2025 - 06:25:15 -03:00 UTC] Attack from [5.255.101.10]-[RANGE:5.255.101.0 - 5.255.101.255] [tor-exit-3.allium.dev] Action: BLocKed Phishing -> Phishing websites and/or email. Email Spam -> Spam email content, infected attachments, and phishing emails. Hacking... Unauthorized attempts to access the server. Spoofing -> Email sender spoofing.] ... show less	Phishing Email Spam Hacking Spoofing Brute-Force
strzonnek	2025-01-10 16:47:43 (4 days ago)	attack on webform	Brute-Force Web App Attack
strzonnek	2025-01-09 07:29:51 (5 days ago)	attack on webform	Brute-Force Web App Attack
Buster	2025-01-08 21:59:00 (6 days ago)	Repeated script kiddie mass attack attempts from Perm Blocked ASN, country, and continent	DDoS Attack Open Proxy Hacking Web App Attack
Study Bitcoin 🤗	2025-01-08 18:32:19 (6 days ago)	Port probe to tcp/8 (unassigned) [srv127]	Port Scan
Study Bitcoin 🤗	2025-01-08 18:00:18 (6 days ago)	2 port probes: 2x tcp/8 (unassigned) [srv127]	Port Scan
TPI-Abuse	2025-01-08 17:20:28 (6 days ago)	(mod_security) mod_security (id:210730) triggered by 5.255.101.10 (tor-exit-3.allium.dev): 1 in the ... show more(mod_security) mod_security (id:210730) triggered by 5.255.101.10 (tor-exit-3.allium.dev): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jan 08 12:20:23.154067 2025] [security2:error] [pid 459900:tid 459900] [client 5.255.101.10:54768] [client 5.255.101.10] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "4"] [msg "COMODO WAF: URL file extension is restricted by policy\|\|apesetx.com\|F\|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "apesetx.com"] [uri "/tx.sql"] [unique_id "Z36z18lR3xA7Ii8-2_wnvAAAAAc"] show less	Brute-Force Bad Web Bot Web App Attack
strzonnek	2025-01-08 02:44:47 (1 week ago)	attack on webform	Brute-Force Web App Attack
paissangroup	2025-01-07 05:20:18 (1 week ago)	Multiple WAF Violations	Web App Attack
strzonnek	2025-01-07 00:30:38 (1 week ago)	attack on webform	Brute-Force Web App Attack