JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 137.184.121.40

137.184.121.40 was found in our database!

This IP was reported 20 times. Confidence of Abuse is 69%: ?

69%

ISP	DigitalOcean, LLC
Usage Type	Data Center/Web Hosting/Transit
ASN	AS14061
Domain Name	digitalocean.com
Country	🇺🇸 United States of America
City	Santa Clara, California

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 137.184.121.40

Whois 137.184.121.40

IP Abuse Reports for 137.184.121.40:

This IP address has been reported a total of 20 times from 16 distinct sources. 137.184.121.40 was first reported on August 4th 2026, and the most recent report was 6 days ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇺🇸 TPI-Abuse	2026-08-28 04:27:38 (6 days ago)	(mod_security) mod_security (id:210730) triggered by 137.184.121.40 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210730) triggered by 137.184.121.40 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Aug 28 00:27:31.358877 2026] [security2:error] [pid 8195:tid 8195] [client 137.184.121.40:55538] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy\|\|genesis-castle.com\|F\|2"] [data ".ini.ea3.bak"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "genesis-castle.com"] [uri "/php.ini.ea3.bak"] [unique_id "apEOM62CDrsrVmkiKUMtuQAAABQ"] show less	Brute-Force Bad Web Bot Web App Attack
🇫🇷 masterguru	2026-08-27 12:15:51 (6 days ago)	(modsec_5080) ModSec 5080: Infrastructure subdomain probe from 137.184.121.40 (US/United States/-): ... show more (modsec_5080) ModSec 5080: Infrastructure subdomain probe from 137.184.121.40 (US/United States/-): 1 in the last 3600 secs (0-195) show less	Hacking
🇺🇸 cwytech	2026-08-27 11:34:55 (6 days ago)	Fleet-wide ban from the Ghostfleet 👻. Triggered by scenario: cwy/tpot-web-high.	Bad Web Bot Web App Attack
Anonymous	2026-08-25 03:37:34 (1 week ago)	denied traffic to a honeypot network. destination port 3333.	Port Scan Hacking
🇩🇪 dispaisyenterprises	2026-08-25 03:14:37 (1 week ago)	Honeypot [fra-de-honeypot]: HTTP/1.1 request on 1911 GET / User-Agent: Mozilla/5.0 (X11; Linux x86_ ... show more Honeypot [fra-de-honeypot]: HTTP/1.1 request on 1911 GET / User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate; 1911 [2] TCP Reported by DisPaisy Enterprises (dispaisy.systems) using: https://github.com/sefinek/T-Pot-To-AbuseIPDB show less	Hacking Bad Web Bot
🇳🇱 ByeByte API	2026-08-25 02:35:31 (1 week ago)	Port scan from this IP. Firewall dropped every packet. Targeted TCP ports: 8899. Single burst at 202 ... show more Port scan from this IP. Firewall dropped every packet. Targeted TCP ports: 8899. Single burst at 2026-08-25 02:35 UTC. show less	Port Scan
🇺🇸 xmission.com	2026-08-16 16:23:55 (2 weeks ago)	Blocked by UFW (TCP on 11111) Source port: 61013 TTL: 244 Packet length: 44 TOS: 0x08 This report ( ... show more Blocked by UFW (TCP on 11111) Source port: 61013 TTL: 244 Packet length: 44 TOS: 0x08 This report (for 137.184.121.40) was generated by: https://github.com/sefinek/UFW-AbuseIPDB-Reporter show less	Port Scan
🇺🇸 MPL	2026-08-16 16:12:09 (2 weeks ago)	tcp/8087 (2 or more attempts)	Port Scan
🇬🇧 Hobby Bob	2026-08-16 07:19:58 (2 weeks ago)	Aug 16 08:19:58 mail postfix/submission/smtpd[3918851]: warning: non-SMTP command from unknown[137.1 ... show more Aug 16 08:19:58 mail postfix/submission/smtpd[3918851]: warning: non-SMTP command from unknown[137.184.121.40]: GET / HTTP/1.1 show less	Hacking Brute-Force
🇫🇮 sonot	2026-08-16 07:11:09 (2 weeks ago)	Blocked by UFW on mail [8443/tcp] \| SPT: 61001 \| TTL: 234 \| LEN: 44 \| TOS: 0x00 • Reported by: githu ... show more Blocked by UFW on mail [8443/tcp] \| SPT: 61001 \| TTL: 234 \| LEN: 44 \| TOS: 0x00 • Reported by: github.com/sefinek/UFW-AbuseIPDB-Reporter show less	Port Scan
🇳🇱 EGP Abuse Dept	2026-08-16 06:54:26 (2 weeks ago)	Unauthorized connection to proxy port 8080	Port Scan Hacking
🇺🇸 sumnone	2026-08-13 14:53:20 (2 weeks ago)	Port probing on unauthorized port 8082	Port Scan Hacking Exploited Host
🇬🇧 SlavaUkraini	2026-08-10 10:19:00 (3 weeks ago)	Haraka "errorCode": 909, "message": "Too many unrecognized commands"	Brute-Force
🇺🇸 MPL	2026-08-09 12:10:47 (3 weeks ago)	tcp/6606 (2 or more attempts)	Port Scan
🇺🇸 xmission.com	2026-08-09 11:37:36 (3 weeks ago)	Blocked by UFW (TCP on 6606) Source port: 61005 TTL: 245 Packet length: 44 TOS: 0x08 This report (f ... show more Blocked by UFW (TCP on 6606) Source port: 61005 TTL: 245 Packet length: 44 TOS: 0x08 This report (for 137.184.121.40) was generated by: https://github.com/sefinek/UFW-AbuseIPDB-Reporter show less	Port Scan

Showing 1 to 15 of 20 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇮🇷 217.11.23.245

🇨🇳 183.232.212.207

🇮🇩 182.8.226.150

🇧🇷 181.191.194.175

🇺🇸 172.71.150.40

🇷🇺 154.83.196.237

🇺🇸 136.119.195.137

🇧🇪 130.211.60.140

🇺🇸 65.49.1.24

🇺🇸 64.227.97.246

🇺🇸 64.62.197.7

🇹🇼 59.125.252.50

🇧🇷 45.205.1.125

🇨🇳 36.24.46.149

🇺🇸 20.121.141.38

🇬🇧 5.226.140.95

🇳🇱 213.152.187.235

🇧🇪 207.175.54.220

🇧🇪 198.235.24.200

🇫🇷 185.210.204.64