JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 87.118.122.51

87.118.122.51 was found in our database!

This IP was reported 920 times. Confidence of Abuse is 42%: ?

42%

This address is a Tor exit node. Neither the owner nor the provider are directly behind the offending action.

ISP	Keyweb AG IP Network
Usage Type	Data Center/Web Hosting/Transit
ASN	AS31103
Hostname(s)	this-is-a-tor-exit-node---keywebtor3.artikel5ev.de
Domain Name	keyweb.de
Country	🇩🇪 Germany
City	Erfurt, Thuringia

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 87.118.122.51

Whois 87.118.122.51

IP Abuse Reports for 87.118.122.51:

This IP address has been reported a total of 920 times from 206 distinct sources. 87.118.122.51 was first reported on November 23rd 2020, and the most recent report was 4 hours ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇺🇸 TPI-Abuse	2026-06-21 23:36:43 (4 hours ago)	(mod_security) mod_security (id:210492) triggered by 87.118.122.51 (this-is-a-tor-exit-node---keyweb ... show more (mod_security) mod_security (id:210492) triggered by 87.118.122.51 (this-is-a-tor-exit-node---keywebtor3.artikel5ev.de): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Jun 21 19:36:36.731935 2026] [security2:error] [pid 26487:tid 26487] [client 87.118.122.51:56540] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "autodiscover.kozyramodularhomebuilder.com"] [uri "/.git/config"] [unique_id "ajh1hKClY7HgGZXI_YqRiAAAAAM"] show less	Brute-Force Bad Web Bot Web App Attack
🇩🇪 LRob.fr	2026-06-16 10:45:12 (5 days ago)	Repeated requests on blocked xmlrpc.php, blocked by fail2ban in custom-503-xmlrpc jail	Bad Web Bot Web App Attack
🇩🇪 big-cloud.nl	2026-06-14 20:13:30 (1 week ago)	Try to access /xmlrpc.php	Web App Attack
🇺🇸 mnsf	2026-06-10 00:10:04 (1 week ago)	Scanning/Probing (15)	Brute-Force Web App Attack
🇧🇷 ICS Labs	2026-06-05 19:43:36 (2 weeks ago)	ICS Labs identified 87.118.122.51 as a malicious indicator from threat intelligence.	DDoS Attack Hacking Brute-Force Exploited Host
🇺🇸 TPI-Abuse	2026-06-05 08:26:36 (2 weeks ago)	(mod_security) mod_security (id:210492) triggered by 87.118.122.51 (this-is-a-tor-exit-node---keyweb ... show more (mod_security) mod_security (id:210492) triggered by 87.118.122.51 (this-is-a-tor-exit-node---keywebtor3.artikel5ev.de): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jun 05 04:26:30.791551 2026] [security2:error] [pid 20765:tid 20765] [client 87.118.122.51:44160] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.kinaffanchufoods.com"] [uri "/.git/config"] [unique_id "aiKINgoA2aADO6BWgvIrpAAAAA0"] show less	Brute-Force Bad Web Bot Web App Attack
🇦🇺 oncord	2026-06-04 14:28:45 (2 weeks ago)	Form spam	Web Spam
🇺🇸 TPI-Abuse	2026-05-28 23:22:27 (3 weeks ago)	(mod_security) mod_security (id:210730) triggered by 87.118.122.51 (this-is-a-tor-exit-node---keyweb ... show more (mod_security) mod_security (id:210730) triggered by 87.118.122.51 (this-is-a-tor-exit-node---keywebtor3.artikel5ev.de): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu May 28 19:22:21.132910 2026] [security2:error] [pid 24499:tid 24507] [client 87.118.122.51:52606] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy\|\|colinarchibald.com\|F\|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "colinarchibald.com"] [uri "/dump.sql"] [unique_id "ahjOLfb9IMIpFCuI-iNbBgAAAMU"], referer: colinarchibald.com/dump.sql show less	Brute-Force Bad Web Bot Web App Attack
🇩🇪 LRob.fr	2026-05-27 14:15:09 (3 weeks ago)	Plesk panel login attempt with forbidden username (root/admin), blocked by Fail2Ban in custom-plesk- ... show more Plesk panel login attempt with forbidden username (root/admin), blocked by Fail2Ban in custom-plesk-login jail show less	Brute-Force Web App Attack
🇩🇪 big-cloud.nl	2026-05-24 22:27:37 (4 weeks ago)	Try to access /xmlrpc.php	Web App Attack
🇦🇺 oncord	2026-05-15 15:48:45 (1 month ago)	Form spam	Web Spam
🇦🇺 oncord	2026-05-14 02:13:31 (1 month ago)	Form spam	Web Spam
🇩🇪 IVski	2026-05-03 04:23:50 (1 month ago)	IVski WAF \| Suspicious activity detected - generic bot or scanner pattern	Port Scan Brute-Force Web App Attack
🇦🇺 oncord	2026-04-26 22:43:04 (1 month ago)	Form spam	Web Spam
🇺🇸 TPI-Abuse	2026-04-26 15:31:48 (1 month ago)	(mod_security) mod_security (id:210492) triggered by 87.118.122.51 (this-is-a-tor-exit-node---keyweb ... show more (mod_security) mod_security (id:210492) triggered by 87.118.122.51 (this-is-a-tor-exit-node---keywebtor3.artikel5ev.de): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Apr 26 11:31:41.569779 2026] [security2:error] [pid 20259:tid 20276] [client 87.118.122.51:41856] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "webdisk.adprospb.com"] [uri "/.git/config"] [unique_id "ae4v3ZcFTk_E24BxF21QRAAAAMs"] show less	Brute-Force Bad Web Bot Web App Attack

Showing 1 to 15 of 920 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇺🇸 64.62.197.42

🇺🇸 2607:f8b0:4002:c03::122

🇨🇳 220.194.168.247

🇰🇷 211.62.96.42

🇨🇳 175.30.48.129

🇨🇳 121.196.157.119

🇨🇳 101.126.147.62

🇩🇪 69.72.244.59

🇺🇸 66.132.195.83

🇧🇪 35.187.44.3

🇺🇸 216.180.246.84

🇺🇸 195.184.76.183

🇳🇱 185.242.226.33

🇮🇪 162.158.230.137

🇪🇸 162.158.122.86

🇭🇰 103.100.211.71

🇧🇬 79.124.58.102

🇺🇸 64.188.169.184

🇹🇭 45.150.130.97

🇺🇸 45.3.36.108