JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 141.98.140.252

141.98.140.252 was found in our database!

This IP was reported 15 times. Confidence of Abuse is 50%: ?

50%

ISP	Vodafone Albania Sh.A.
Usage Type	Fixed Line ISP
ASN	AS21183
Domain Name	vodafone.al
Country	🇦🇱 Albania
City	Tirana, Tirana

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 141.98.140.252

Whois 141.98.140.252

IP Abuse Reports for 141.98.140.252:

This IP address has been reported a total of 15 times from 11 distinct sources. 141.98.140.252 was first reported on July 27th 2025, and the most recent report was 14 hours ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇺🇸 TPI-Abuse	2026-07-06 02:58:55 (14 hours ago)	(mod_security) mod_security (id:240335) triggered by 141.98.140.252 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:240335) triggered by 141.98.140.252 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Jul 05 22:58:52.466844 2026] [security2:error] [pid 1714:tid 1714] [client 141.98.140.252:2470] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 141.98.140.252 (+1 hits since last alert)\|fernfield.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "fernfield.com"] [uri "/xmlrpc.php"] [unique_id "aksZ7ARMQSIPUTVWE1rNlgAAABE"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-07-06 02:25:55 (15 hours ago)	(mod_security) mod_security (id:240335) triggered by 141.98.140.252 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:240335) triggered by 141.98.140.252 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Jul 05 22:25:48.328149 2026] [security2:error] [pid 12227:tid 12227] [client 141.98.140.252:30276] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 141.98.140.252 (+1 hits since last alert)\|eye7graphics.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "eye7graphics.com"] [uri "/xmlrpc.php"] [unique_id "aksSLD34cCig0Pm2l6x9SQAAAAU"] show less	Brute-Force Bad Web Bot Web App Attack
🇦🇺 screwlooseit.com.au	2026-07-06 02:24:03 (15 hours ago)	Blocked by CSF 13 firewall - Rule: XMLRPC AL/Albania/-	Web App Attack
🇧🇪 cmbplf	2026-07-06 01:30:53 (16 hours ago)	4.235 requests with url.path */xmlrpc.php	Brute-Force Bad Web Bot
Anonymous	2026-07-05 23:30:26 (18 hours ago)	(wordpress) Failed wordpress login from 141.98.140.252 (AL/Albania/-)	Brute-Force
🇺🇸 TPI-Abuse	2026-07-05 20:16:11 (21 hours ago)	(mod_security) mod_security (id:240335) triggered by 141.98.140.252 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:240335) triggered by 141.98.140.252 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Jul 05 16:16:07.041167 2026] [security2:error] [pid 7210:tid 7228] [client 141.98.140.252:41522] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 141.98.140.252 (+1 hits since last alert)\|rawhabitat.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "rawhabitat.com"] [uri "/xmlrpc.php"] [unique_id "akq7h1Rvw7HmjF43Bo8l9QAAAAg"] show less	Brute-Force Bad Web Bot Web App Attack
🇫🇷 applemooz	2026-07-05 20:14:39 (21 hours ago)	WordPress XMLRPC Brute Force Attacks ...	Brute-Force Web App Attack
🇫🇷 dynamix	2026-07-05 18:11:36 (23 hours ago)	WordPress XMLRPC Brute Force Attack	Brute-Force Web App Attack
🇺🇸 TPI-Abuse	2026-07-05 16:43:53 (1 day ago)	(mod_security) mod_security (id:240335) triggered by 141.98.140.252 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:240335) triggered by 141.98.140.252 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Jul 05 12:43:49.552343 2026] [security2:error] [pid 20984:tid 20984] [client 141.98.140.252:6563] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 141.98.140.252 (+1 hits since last alert)\|egelfitness.nl\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "egelfitness.nl"] [uri "/xmlrpc.php"] [unique_id "akqJxd7KBj0zVsKZX5-ZkwAAAAg"] show less	Brute-Force Bad Web Bot Web App Attack
🇪🇸 masterguru	2026-07-05 14:40:42 (1 day ago)	(xmlrpc) Failed xmlrpc access from 141.98.140.252 (AL/Albania/-): 5 in the last 3600 secs (0-122)	Hacking
🇺🇸 SiliSoftware	2026-03-19 21:16:20 (3 months ago)	/phpBB3/ucp.php?mode=login&sid=fe5eacd62bf72889cc61972fda38af03	Web App Attack
🇺🇸 TPI-Abuse	2025-12-10 14:52:11 (6 months ago)	"Participant in large-scale DDoS Attack in which data injection was attmpted to gain unauthorized ac ... show more "Participant in large-scale DDoS Attack in which data injection was attmpted to gain unauthorized access" show less	DDoS Attack SQL Injection Exploited Host
Anonymous	2025-11-25 22:54:34 (7 months ago)	scanning http requests from known botnet	Web App Attack
🇩🇪 Packets-Decreaser.NET	2025-11-08 18:26:19 (7 months ago)	Incoming Layer 7 Flood Detected	DDoS Attack Web Spam
🇪🇸 Global Cyber Police	2025-07-27 16:51:33 (11 months ago)	Malicious bot activity detected: Hitting honeypot page (200 OK with 258/259 bytes sent).	Port Scan Brute-Force Web App Attack

Showing 1 to 15 of 15 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇺🇸 195.184.76.210

🇷🇺 185.173.176.108

🇮🇩 139.255.66.35

🇧🇷 131.196.29.175

🇫🇮 46.62.131.171

🇺🇸 45.146.54.48

🇺🇸 20.98.140.180

🇩🇪 8.211.37.65

🇨🇳 1.30.28.149

🇳🇱 195.178.110.217

🇷🇺 193.233.48.169

🇧🇷 192.91.254.230

🇧🇷 192.91.254.150

🇵🇪 190.119.147.50

🇦🇷 143.0.65.206

🇨🇦 85.217.149.51

🇧🇬 79.124.40.166

🇸🇬 47.237.86.37

🇸🇪 31.59.160.12

🇦🇷 190.181.87.65