JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 140.82.16.230

140.82.16.230 was found in our database!

This IP was reported 30 times. Confidence of Abuse is 100%: ?

100%

ISP	Vultr Holdings, LLC
Usage Type	Data Center/Web Hosting/Transit
ASN	AS20473
Hostname(s)	140.82.16.230.vultrusercontent.com
Domain Name	vultr.com
Country	🇺🇸 United States of America
City	Los Angeles, California

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 140.82.16.230

Whois 140.82.16.230

IP Abuse Reports for 140.82.16.230:

This IP address has been reported a total of 30 times from 21 distinct sources. 140.82.16.230 was first reported on October 23rd 2026, and the most recent report was 12 hours ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇪🇸 pipeline.es	2026-10-26 22:19:48 (12 hours ago)	PHP RCE exploit attempt (php2shell, CVE-2026-109618) blocked by WAF	Web App Attack
🇺🇸 francelink.fr	2026-10-25 00:28:26 (2 days ago)	Azure WAF blocked a request. Rule: 949110. Observed at: 2026-10-24T07:04:39.000Z.	Web App Attack
🇪🇸 pipeline.es	2026-10-25 00:16:40 (2 days ago)	PHP RCE exploit attempt (php2shell, CVE-2026-109618) blocked by WAF	Web App Attack
🇫🇷 tecnicorioja	2026-10-24 22:01:48 (2 days ago)	(Mod_security)	Web App Attack Brute-Force Bad Web Bot
🇫🇷 Bensay	2026-10-24 11:26:13 (2 days ago)	Repeated suspicious HTTP service scan against a blocked web sinkhole; threshold=3 events/10m; result ... show more Repeated suspicious HTTP service scan against a blocked web sinkhole; threshold=3 events/10m; result=blocked; user-agent=Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 show less	Port Scan
🇺🇸 francelink.fr	2026-10-24 10:36:26 (3 days ago)	Azure WAF blocked a request. Rule: 949110. Observed at: 2026-10-23T23:32:31.000Z.	Web App Attack
🇩🇪 gadix	2026-10-24 08:44:06 (3 days ago)	[24/Oct/2026:10:44:05.803760 +0200] atxv1CXJT8gwgsR_i7CmMQAAAAE 140.82.16.230 49952 127.0.0.1 7081 [ ... show more [24/Oct/2026:10:44:05.803760 +0200] atxv1CXJT8gwgsR_i7CmMQAAAAE 140.82.16.230 49952 127.0.0.1 7081 [24/Oct/2026:10:44:05.807133 +0200] atxv1CMcXRFqMuI73hU9BAAAAAM 140.82.16.230 49968 127.0.0.1 7081 [24/Oct/2026:10:44:05.808394 +0200] atxv1ENzQddpOy4N2wn2cAAAABc 140.82.16.230 49932 127.0.0.1 7081 ... show less	Web App Attack
🇬🇷 setupgr	2026-10-24 08:09:05 (3 days ago)	(PERMBLOCK) 140.82.16.230 (US/United States/California/Los Angeles/-/[AS20473 The Constant Company, ... show more (PERMBLOCK) 140.82.16.230 (US/United States/California/Los Angeles/-/[AS20473 The Constant Company, LLC]) has had more than 2 temp blocks in the last 86400 secs; Ports: *; Direction: inout; Trigger: LF_PERMBLOCK_COUNT; Logs: N/A show less	Port Scan
Anonymous	2026-10-24 06:54:09 (3 days ago)	Blocked by ModSec and CSF	Port Scan
🇫🇷 LRob	2026-10-24 04:13:50 (3 days ago)	Not following 301 redirects — wasted requests \| method: GET, POST \| path: / \| ua: Mozilla/5.0 (Windo ... show more Not following 301 redirects — wasted requests \| method: GET, POST \| path: / \| ua: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 show less	Bad Web Bot
🇦🇺 paulshipley.com.au	2026-10-24 03:56:44 (3 days ago)	[Sat Oct 24 14:56:43.751364 2026] [security2:error] [pid 242796] [client 140.82.16.230:37498] [clien ... show more [Sat Oct 24 14:56:43.751364 2026] [security2:error] [pid 242796] [client 140.82.16.230:37498] [client 140.82.16.230] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/modsecurity/crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.4"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "levellagiftware.com.au"] [uri "/"] [unique_id "atwse8TQyrQIJR0vdBcikgAAAAo"] ... show less	Web App Attack
🇬🇷 setupgr	2026-10-24 02:44:10 (3 days ago)	(mod_security) mod_security (id:11000011) triggered by 140.82.16.230 (US/United States/California/Lo ... show more (mod_security) mod_security (id:11000011) triggered by 140.82.16.230 (US/United States/California/Los Angeles/-/[AS20473 The Constant Company, LLC]): 1 in the last 86400 secs (CF_ENABLE); Ports: *; Direction: inout; Trigger: LF_MODSEC; Logs: [Sat Oct 24 05:44:09.020318 2026] [security2:error] [pid 869464:tid 869498] [remote 140.82.16.230:39696] ModSecurity: Access denied with code 406 (phase 1). Matched phrase "vultrusercontent.com" at REMOTE_HOST. [file "/etc/apache2/conf.d/modsec/modsec2.user.conf"] [line "140"] [id "11000011"] [msg "BLOCKED BAD DOMAIN: 140.82.16.230.vultrusercontent.com"] [severity "CRITICAL"] [hostname "ions.gr"] [uri "/"] [unique_id "atwbeQMR0ehh0zLmJ_08sQACzQM"] show less	Port Scan
🇦🇺 paulshipley.com.au	2026-10-24 02:26:55 (3 days ago)	[Sat Oct 24 13:26:54.468527 2026] [security2:error] [pid 234530] [client 140.82.16.230:54484] [clien ... show more [Sat Oct 24 13:26:54.468527 2026] [security2:error] [pid 234530] [client 140.82.16.230:54484] [client 140.82.16.230] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/modsecurity/crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.4"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "iaki.com.au"] [uri "/"] [unique_id "atwXbmaEvh6U548PgM2lTgAAAAY"] ... show less	Web App Attack
🇩🇪 SCHAPPY	2026-10-24 01:25:48 (3 days ago)	Critical web app attack detected. Possible Session Fixation Attack: SessionID Parameter Name with No ... show more Critical web app attack detected. Possible Session Fixation Attack: SessionID Parameter Name with No Referer show less	Web App Attack
🇪🇸 pipeline.es	2026-10-24 00:27:43 (3 days ago)	PHP RCE exploit attempt (php2shell, CVE-2026-109618) blocked by WAF \| Evidence: [Sat Oct 24 02:27:15 ... show more PHP RCE exploit attempt (php2shell, CVE-2026-109618) blocked by WAF \| Evidence: [Sat Oct 24 02:27:15.113508 2026] [:error] [pid 2730763:tid 134880415450880] [client 140.82.16.230:45692] [client 140.82.16.230] WAF: Access denied with code 403 (phase 2). Pattern match \"(?i)^PHP[_. ]SESSION[_. ]UPLOAD[_. ]PROGRESS$\" at ARGS_NAMES:PHP_SESSION_UPLOAD_PROGRESS. [file \"/etc/httpd/WAF.d/local_rules/zz-php2shell.conf\"] [line \"30\"] [id \"9261007\"] [msg \"php2shell: campo PHP_SES \| ASN: AS-VULTR \| Country: US show less	Web App Attack

Showing 1 to 15 of 30 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇺🇸 2602:80d:1006::60

🇧🇷 186.239.41.74

🇹🇯 185.121.0.254

🇳🇮 161.0.55.134

🇻🇳 160.250.246.219

🇻🇳 160.22.106.87

🇰🇪 102.0.13.212

🇺🇦 91.203.60.139

🇫🇷 45.95.174.62

🇮🇳 216.10.242.215

🇪🇬 197.134.248.163

🇬🇧 192.248.150.180

🇳🇱 185.136.15.13

🇮🇳 182.237.13.208

🇭🇰 168.76.131.178

🇺🇸 159.65.99.44

🇺🇸 157.230.218.106

🇩🇪 157.230.19.72

🇯🇵 157.7.133.168

🇩🇪 156.236.31.85