JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

128.199.140.213

Neutral Activity

Abuse confidence score ?

0% Low Risk

31 reports

25 reporters · latest 3 years ago

ISP	DigitalOcean, LLC
Usage Type	Data Center/Web Hosting/Transit
ASN	AS14061
Domain Name	digitalocean.com
Country	🇸🇬 Singapore
City	Singapore

ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report Whois

No reports in the last 60 days

128.199.140.213 has been reported 31 times. The most recent report is from 3 years ago.

The full history is preserved below and remains searchable. A 0% score reflects the absence of recent activity, but this is not a guarantee that earlier reports were invalid. Abuse confidence score decays, naturally, over time, when the abusive activity stops.

IP Abuse Reports for 128.199.140.213

Export CSV

This IP address has been reported a total of 31 times from 25 distinct sources. 128.199.140.213 was first reported on July 15th 2022, and the most recent report was 3 years ago.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇮🇪 RoboSOC	2023-01-23 16:37:10 (3 years ago)	ZGrab Application Layer Scanner Detection , PTR: PTR record not found	Hacking
Anonymous	2023-01-23 16:31:41 (3 years ago)	No user agent	Bad Web Bot
🇮🇩 hermawan	2023-01-11 00:54:32 (3 years ago)	[Wed Jan 11 07:50:27.690169 2023] [security2:error] [pid 385586:tid 140510299137600] [client 128.199 ... show more [Wed Jan 11 07:50:27.690169 2023] [security2:error] [pid 385586:tid 140510299137600] [client 128.199.140.213:55936] [client 128.199.140.213] ModSecurity: Access denied with code 403 (phase 1). Match of "pm karangploso.jatim.bmkg.go.id staklim-jatim.bmkg.go.id staklim-malang.info matomo.staklim-malang.info" against "REQUEST_HEADERS:Host" required. [file "/etc/modsecurity/coreruleset-3.3.4/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "10"] [id "440217"] [msg "Not Current Hostname"] [data "Matched Data: found within REQUEST_HEADERS:Host: 103.166.156.58 request_line = GET / HTTP/1.1"] [severity "NOTICE"] [hostname "103.166.156.58"] [uri "/"] [unique_id "Y74H0_wc1yBEUwq-eT6JWwAAAh4"] [103.166.156.58] [karangploso.jatim.bmkg.go.id] top=[385720] [0d/tYhrJGHQ] [Y74H0_wc1yBEUwq-eT6JWwAAAh4] keep_alive=[0] [2023-01-11 07:50:27.690173] [R:Y74H0_wc1yBEUwq-eT6JWwAAAh4] UA:'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4240.193 Safari/537.36' H ... show less	Hacking Web App Attack
🇮🇩 hermawan	2023-01-10 08:45:02 (3 years ago)	[Tue Jan 10 15:29:06.081149 2023] [security2:error] [pid 228777:tid 140094387930688] [client 128.199 ... show more [Tue Jan 10 15:29:06.081149 2023] [security2:error] [pid 228777:tid 140094387930688] [client 128.199.140.213:60614] [client 128.199.140.213] ModSecurity: Access denied with code 403 (phase 1). Match of "pm karangploso.jatim.bmkg.go.id staklim-jatim.bmkg.go.id staklim-malang.info matomo.staklim-malang.info" against "REQUEST_HEADERS:Host" required. [file "/etc/modsecurity/coreruleset-3.3.4/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "10"] [id "440217"] [msg "Not Current Hostname"] [data "Matched Data: found within REQUEST_HEADERS:Host: 103.166.156.58 request_line = GET / HTTP/1.1"] [severity "NOTICE"] [hostname "103.166.156.58"] [uri "/"] [unique_id "Y70h0uheSOofSjQAfXRZIwAAASw"] [103.166.156.58] [karangploso.jatim.bmkg.go.id] top=[228869] [VdJPrXxDdYU] [Y70h0uheSOofSjQAfXRZIwAAASw] keep_alive=[0] [2023-01-10 15:29:06.081153] [R:Y70h0uheSOofSjQAfXRZIwAAASw] UA:'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4240.193 Safari/537.36' H ... show less	Hacking Web App Attack
🇹🇭 Sawasdee	2023-01-03 23:26:37 (3 years ago)	Unwanted checking 80 or 443 port ...	Bad Web Bot
🇫🇷 dbip	2023-01-03 18:34:55 (3 years ago)	128.199.140.213 - - [04/Jan/2023:00:34:51 +0100] "POST /wp-login.php HTTP/1.1" 200 7827 "http://entr ... show more 128.199.140.213 - - [04/Jan/2023:00:34:51 +0100] "POST /wp-login.php HTTP/1.1" 200 7827 "http://entreprendre.univ-lyon3.fr/wp-login.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4240.193 Safari/537.36" 128.199.140.213 - - [04/Jan/2023:00:34:51 +0100] "POST /wp-login.php HTTP/1.1" 200 7827 "http://entreprendre.univ-lyon3.fr/wp-login.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4240.193 Safari/537.36" 128.199.140.213 - - [04/Jan/2023:00:34:52 +0100] "POST /wp-login.php HTTP/1.1" 200 7827 "http://entreprendre.univ-lyon3.fr/wp-login.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4240.193 Safari/537.36" 128.199.140.213 - - [04/Jan/2023:00:34:53 +0100] "POST /wp-login.php HTTP/1.1" 200 7827 "http://entreprendre.univ-lyon3.fr/wp-login.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4240 ... show less	Brute-Force Web App Attack
🇫🇷 dbip	2023-01-03 18:04:46 (3 years ago)	128.199.140.213 - - [04/Jan/2023:00:04:42 +0100] "POST /wp-login.php HTTP/1.1" 200 7826 "http://entr ... show more 128.199.140.213 - - [04/Jan/2023:00:04:42 +0100] "POST /wp-login.php HTTP/1.1" 200 7826 "http://entreprendre.univ-lyon3.fr/wp-login.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4240.193 Safari/537.36" 128.199.140.213 - - [04/Jan/2023:00:04:42 +0100] "POST /wp-login.php HTTP/1.1" 200 7826 "http://entreprendre.univ-lyon3.fr/wp-login.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4240.193 Safari/537.36" 128.199.140.213 - - [04/Jan/2023:00:04:43 +0100] "POST /wp-login.php HTTP/1.1" 200 7827 "http://entreprendre.univ-lyon3.fr/wp-login.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4240.193 Safari/537.36" 128.199.140.213 - - [04/Jan/2023:00:04:44 +0100] "POST /wp-login.php HTTP/1.1" 200 7827 "http://entreprendre.univ-lyon3.fr/wp-login.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4240 ... show less	Brute-Force Web App Attack
🇺🇸 TheMadBeaker	2023-01-03 17:40:12 (3 years ago)	Fail2Ban Ban Triggered Wordpress Attack Attempt	Brute-Force Web App Attack
🇺🇸 SiliSoftware	2023-01-03 17:36:29 (3 years ago)	/wp-includes/wlwmanifest.xml	Web App Attack
🇬🇧 Delta Whiskey	2023-01-03 17:02:57 (3 years ago)	Multiple failed WordPress authentication attempts	Brute-Force Web App Attack
🇩🇪 bodixite.net	2022-08-29 08:54:07 (4 years ago)	(mod_security) mod_security triggered on hostname [redacted] 128.199.140.213 (SG/Singapore/-)	SQL Injection
🇺🇸 xyz.rip	2022-08-29 06:03:57 (4 years ago)	WAF Violation...	Web App Attack
Anonymous	2022-08-28 21:00:22 (4 years ago)	T: f2b 404 5x	Web App Attack
🇹🇷 baku.hosting	2022-08-28 13:56:39 (4 years ago)	(mod_security) mod_security (id:949110) triggered by 128.199.140.213 (SG/Singapore/-): 8 in the last ... show more (mod_security) mod_security (id:949110) triggered by 128.199.140.213 (SG/Singapore/-): 8 in the last 3600 secs show less	Brute-Force
🇺🇸 vestibtech	2022-08-27 18:37:18 (4 years ago)	128.199.140.213 - - [27/Aug/2022:16:37:16 -0600] "GET /new/.env HTTP/1.1" 404 8336 "-" "Mozilla/5.0 ... show more 128.199.140.213 - - [27/Aug/2022:16:37:16 -0600] "GET /new/.env HTTP/1.1" 404 8336 "-" "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36" ... show less	Web App Attack

Showing 1 to 15 of 31 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇹🇼 198.235.24.16

🇻🇪 190.114.243.85

🇺🇸 172.208.48.177

🇩🇪 172.70.243.185

🇨🇳 171.120.38.156

🇮🇳 152.58.186.234

🇳🇱 146.190.229.220

🇳🇱 109.160.32.136

🇰🇷 52.141.3.247

🇷🇺 46.160.165.239

🇧🇷 45.180.16.0

🇺🇸 18.119.209.50

🇧🇪 207.175.218.16

🇳🇱 176.65.132.39

🇺🇸 172.171.233.230

🇮🇩 163.7.3.154

🇫🇷 141.94.245.19

🇺🇸 129.121.142.45

🇨🇳 125.85.83.65

🇨🇳 118.145.131.27