JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 179.209.140.143

179.209.140.143 was found in our database!

This IP was reported 18 times. Confidence of Abuse is 76%: ?

76%

ISP	Claro NXT Telecomunicacoes Ltda
Usage Type	Fixed Line ISP
ASN	AS28573
Hostname(s)	b3d18c8f.virtua.com.br
Domain Name	claro.com.br
Country	🇧🇷 Brazil
City	Sao Paulo, Sao Paulo

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 179.209.140.143

Whois 179.209.140.143

IP Abuse Reports for 179.209.140.143:

This IP address has been reported a total of 18 times from 17 distinct sources. 179.209.140.143 was first reported on August 27th 2026, and the most recent report was 4 hours ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇨🇭 4server	2026-10-17 11:39:18 (4 hours ago)	[SatOct1713:39:13.0621902026][security2:error][pid1619364:tid1619455][client179.209.140.143:0]ModSec ... show more [SatOct1713:39:13.0621902026][security2:error][pid1619364:tid1619455][client179.209.140.143:0]ModSecurity:Accessdeniedwithcode403\(phase1\).Stringmatch\"/xmlrpc.php\"atREQUEST_URI.[file\"/etc/apache2/conf.d/modsec_custom_rules.conf\"][line\"714\"][id\"960024\"][msg\"XML-RPCdisabled\"][hostname\"rd-gaming.net\"][uri\"/xmlrpc.php\"][unique_id\"atNeYUe3jyTTIs9TdEA0MAAAAI0\"] show less	Hacking Web App Attack
🇬🇧 consul.to	2026-10-16 16:58:17 (23 hours ago)	Web attack/malicious scanning detected	Web App Attack
🇺🇸 OceanTreasure	2026-10-11 10:21:27 (6 days ago)	tcp/443; WordPress XML-RPC brute force attempt: "POST /xmlrpc.php" @ 2026-10-11T10:21:27Z [proxy]	Web App Attack Brute-Force
🇳🇴 jad-abuse	2026-10-10 19:58:03 (6 days ago)	ActiveDefense automated detection: malicious HTTP scanning / exploit attempts. Signatures: xmlrpc. O ... show more ActiveDefense automated detection: malicious HTTP scanning / exploit attempts. Signatures: xmlrpc. Observed by 1 sensor(s); 1 hits. show less	Brute-Force Web App Attack
🇺🇸 IndigoRidge	2026-10-10 07:11:47 (1 week ago)	179.209.140.143 - - [10/Oct/2026:03:09:56 -0400] "GET /wp-json/wp/v2/users HTTP/1.1" 200 16958 "-" " ... show more 179.209.140.143 - - [10/Oct/2026:03:09:56 -0400] "GET /wp-json/wp/v2/users HTTP/1.1" 200 16958 "-" "Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)" 179.209.140.143 - - [10/Oct/2026:03:10:34 -0400] "POST /xmlrpc.php HTTP/1.1" 200 5072 "-" "Mozilla/5.0 (Windows NT 6.3; x86) AppleWebKit/537.36 (KHTML, like Gecko) Firefox/89.0.0.0 Safari/537.36" 179.209.140.143 - - [10/Oct/2026:03:10:58 -0400] "POST /xmlrpc.php HTTP/1.1" 200 5072 "-" "Mozilla/5.0 (Windows NT 6.2; x86) AppleWebKit/537.36 (KHTML, like Gecko) Safari/11.0.0.0 Safari/537.36" 179.209.140.143 - - [10/Oct/2026:03:11:21 -0400] "POST /xmlrpc.php HTTP/1.1" 200 5072 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7; arm64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.0.0 Safari/537.36" 179.209.140.143 - - [10/Oct/2026:03:11:46 -0400] "POST /xmlrpc.php HTTP/1.1" 200 5072 "-" "Mozilla/5.0 (Windows NT 6.2; arm64) AppleWebKit/537.36 (KHTML, like Gecko) Edge/82.0.0.0 Safari/537.36" ... show less	Web App Attack
Anonymous	2026-10-09 08:29:14 (1 week ago)	(wordpress) Failed wordpress login from 179.209.140.143 (BR/Brazil/b3d18c8f.virtua.com.br)	Brute-Force
Anonymous	2026-10-08 19:06:01 (1 week ago)	Reported by internal abuse tracking	DDoS Attack Web App Attack
🇨🇿 ddw	2026-10-08 17:38:09 (1 week ago)	WordPress XMLRPC.PHP Access Attempt.	Hacking Web App Attack
🇩🇪 Marc	2026-10-07 03:41:33 (1 week ago)	179.209.140.143 - - [07/Oct/2026:05:14:52 +0200] "POST /xmlrpc.php HTTP/1.1" 200 5066 "-" "Mozilla/5 ... show more 179.209.140.143 - - [07/Oct/2026:05:14:52 +0200] "POST /xmlrpc.php HTTP/1.1" 200 5066 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36" 179.209.140.143 - - [07/Oct/2026:05:41:00 +0200] "POST /xmlrpc.php HTTP/1.1" 200 5113 "-" "Mozilla/5.0 (Linux; Android 10; x64) AppleWebKit/537.36 (KHTML, like Gecko) Firefox/93.0.0.0 Safari/537.36" 179.209.140.143 - - [07/Oct/2026:05:41:31 +0200] "POST /xmlrpc.php HTTP/1.1" 200 5114 "-" "Mozilla/5.0 (Windows NT 6.3; x86) AppleWebKit/537.36 (KHTML, like Gecko) Opera/64.0.0.0 Safari/537.36" show less	Brute-Force Web App Attack
🇺🇸 IndigoRidge	2026-10-05 17:53:05 (1 week ago)	179.209.140.143 - - [05/Oct/2026:13:47:31 -0400] "POST /xmlrpc.php HTTP/1.1" 200 5130 "-" "Mozilla/5 ... show more 179.209.140.143 - - [05/Oct/2026:13:47:31 -0400] "POST /xmlrpc.php HTTP/1.1" 200 5130 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; arm64) AppleWebKit/537.36 (KHTML, like Gecko) Firefox/76.0.0.0 Safari/537.36" 179.209.140.143 - - [05/Oct/2026:13:48:57 -0400] "POST /xmlrpc.php HTTP/1.1" 200 5158 "-" "Mozilla/5.0 (Windows NT 6.3; x86) AppleWebKit/537.36 (KHTML, like Gecko) Firefox/79.0.0.0 Safari/537.36" 179.209.140.143 - - [05/Oct/2026:13:52:31 -0400] "GET /wp-json/wp/v2/users HTTP/1.1" 403 5749 "-" "Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)" 179.209.140.143 - - [05/Oct/2026:13:52:37 -0400] "GET /wp-json/wp/v2/users HTTP/1.1" 403 5786 "-" "Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)" 179.209.140.143 - - [05/Oct/2026:13:53:04 -0400] "POST /xmlrpc.php HTTP/1.1" 200 5130 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Safari/11.0.0.0 Safari/537.36" ... show less	Web App Attack
🇫🇮 inlink.ltd	2026-10-05 10:15:14 (1 week ago)	Known malicious PHP file or CMS probe	Web App Attack
🇬🇧 spamverify.com	2026-10-05 05:39:43 (1 week ago)	Honeypot Hit: xmlrpc.php	Web Spam Blog Spam Bad Web Bot Web App Attack
🇫🇷 dynamix	2026-10-05 04:42:03 (1 week ago)	WordPress XMLRPC Brute Force Attack	Brute-Force Web App Attack
Anonymous	2026-10-05 04:05:10 (1 week ago)	Blocked: Reason='Vulnerability probing — PHP scan detected (15/60 min)'; Requests=15	Port Scan
🇩🇪 LRob	2026-10-03 16:06:14 (2 weeks ago)	Web exploit attempt \| method: GET \| path: /wp-json/wp/v2/users \| ua: Mozilla/4.0 (compatible; Win32; ... show more Web exploit attempt \| method: GET \| path: /wp-json/wp/v2/users \| ua: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) show less	Hacking Web App Attack

Showing 1 to 15 of 18 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇰🇷 59.8.107.159

🇺🇸 57.141.4.40

🇭🇰 34.150.3.215

🇬🇭 154.160.18.215

🇿🇼 143.105.233.162

🇭🇰 141.11.77.128

🇳🇵 113.199.251.96

🇷🇴 92.118.39.96

🇵🇱 45.138.12.25

🇷🇴 2.57.122.150

🇺🇿 185.74.5.70

🇺🇦 176.97.124.253

🇺🇸 172.174.115.124

🇨🇳 118.31.188.237

🇨🇳 115.60.90.204

🇯🇵 111.238.174.6

🇺🇦 95.158.47.199

🇺🇸 91.233.0.159

🇺🇸 71.79.179.179

🇳🇱 45.148.10.151