JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 180.240.217.38

180.240.217.38 was found in our database!

This IP was reported 17 times. Confidence of Abuse is 71%: ?

71%

ISP	Asia Pacific Network Information Centre
Usage Type	Fixed Line ISP
ASN	AS56308
Domain Name	apnic.net
Country	🇸🇬 Singapore
City	Singapore

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 180.240.217.38

Whois 180.240.217.38

IP Abuse Reports for 180.240.217.38:

This IP address has been reported a total of 17 times from 11 distinct sources. 180.240.217.38 was first reported on August 22nd 2026, and the most recent report was 50 minutes ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇺🇸 TPI-Abuse	2026-08-22 22:30:51 (50 minutes ago)	(mod_security) mod_security (id:210492) triggered by 180.240.217.38 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210492) triggered by 180.240.217.38 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Aug 22 18:30:45.939569 2026] [security2:error] [pid 21077:tid 21077] [client 180.240.217.38:62666] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.takemehomedogrescue.org"] [uri "/sftp-config.json"] [unique_id "aoojFWZz7zokMP6Ik_AT9AAAAAU"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-08-22 21:42:48 (1 hour ago)	(mod_security) mod_security (id:210492) triggered by 180.240.217.38 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210492) triggered by 180.240.217.38 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Aug 22 17:42:39.798582 2026] [security2:error] [pid 20266:tid 20266] [client 180.240.217.38:60562] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.arofish.us"] [uri "/sftp-config.json"] [unique_id "aooXz7JoYJmB_pBPAPBadAAAAAY"] show less	Brute-Force Bad Web Bot Web App Attack
🇩🇪 LRob	2026-08-22 20:44:25 (2 hours ago)	Probing for secret files (.git, .env, credentials, database dumps, wp-config) \| method: GET \| path: ... show more Probing for secret files (.git, .env, credentials, database dumps, wp-config) \| method: GET \| path: /sftp-config.json show less	Hacking Web App Attack
🇬🇧 Bytemark	2026-08-22 19:53:28 (3 hours ago)	180.240.217.38 - - [22/Aug/2026:20:53:27 +0100] "GET /sftp-config.json HTTP/1.1" 404 6767 "-" "pytho ... show more 180.240.217.38 - - [22/Aug/2026:20:53:27 +0100] "GET /sftp-config.json HTTP/1.1" 404 6767 "-" "python-requests/2.32.5" show less	Brute-Force Web App Attack
🇺🇸 TPI-Abuse	2026-08-22 19:29:58 (3 hours ago)	(mod_security) mod_security (id:210492) triggered by 180.240.217.38 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210492) triggered by 180.240.217.38 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Aug 22 15:29:54.263645 2026] [security2:error] [pid 25564:tid 25564] [client 180.240.217.38:54521] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "web.cruisingforsex.com"] [uri "/sftp-config.json"] [unique_id "aon4sjaO0ElmJUWCmZ9UjAAAAAk"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-08-22 19:00:39 (4 hours ago)	(mod_security) mod_security (id:210492) triggered by 180.240.217.38 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210492) triggered by 180.240.217.38 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Aug 22 15:00:31.733778 2026] [security2:error] [pid 13868:tid 13868] [client 180.240.217.38:64942] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.gardnercastle.com"] [uri "/sftp-config.json"] [unique_id "aonxz-Lzrg1piFDordyt-gAAAAs"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-08-22 17:16:55 (6 hours ago)	(mod_security) mod_security (id:210492) triggered by 180.240.217.38 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210492) triggered by 180.240.217.38 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Aug 22 13:16:48.498276 2026] [security2:error] [pid 6350:tid 6375] [client 180.240.217.38:55111] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.maxpowered.jp"] [uri "/sftp-config.json"] [unique_id "aonZgJrgf-nLvEmMtAtSqQAAAU4"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-08-22 16:25:21 (6 hours ago)	(mod_security) mod_security (id:210492) triggered by 180.240.217.38 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210492) triggered by 180.240.217.38 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Aug 22 12:25:12.037513 2026] [security2:error] [pid 2659:tid 2659] [client 180.240.217.38:64526] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.quakeprediction.com"] [uri "/sftp-config.json"] [unique_id "aonNaG8KNrhin1YrO8RtyAAAAAY"] show less	Brute-Force Bad Web Bot Web App Attack
🇫🇷 Stara	2026-08-22 15:29:26 (7 hours ago)	Automated block by CSF/LFD - suspicious activity detected	Brute-Force Web App Attack
🇺🇦 URAN Publishing Service	2026-08-22 15:11:55 (8 hours ago)	[22/Aug/2026:18:11:54 +0300] -- 180.240.217.38 Ban reason: User-Agent python-requests	Bad Web Bot Web App Attack
🇩🇪 MusicLibrary	2026-08-22 15:10:12 (8 hours ago)	Probing foreign-stack admin panels / known exploit paths (Joomla, phpMyAdmin, phpunit, OWA, etc.)	Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-08-22 14:51:56 (8 hours ago)	(mod_security) mod_security (id:210492) triggered by 180.240.217.38 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210492) triggered by 180.240.217.38 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Aug 22 10:51:50.606038 2026] [security2:error] [pid 13702:tid 13702] [client 180.240.217.38:56630] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "ceta-arts.com"] [uri "/sftp-config.json"] [unique_id "aom3hqBqL6UvxVGeBxLLSQAAABI"] show less	Brute-Force Bad Web Bot Web App Attack
🇧🇪 cmbplf	2026-08-22 14:34:40 (8 hours ago)	446 requests with url.path config.json 388 requests with url.path sftp.json	Brute-Force Bad Web Bot
🇯🇵 VXG-NET	2026-08-22 14:17:38 (9 hours ago)	port=80, indicator_type=info-leak	Hacking
🇺🇸 nyt	2026-08-22 13:34:44 (9 hours ago)	Deploy Config Probe	Web App Attack

Showing 1 to 15 of 17 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇧🇷 200.189.22.53

🇳🇱 192.42.116.15

🇩🇪 185.168.30.231

🇨🇦 51.222.168.119

🇫🇷 213.32.68.81

🇩🇪 212.227.150.238

🇺🇸 172.253.213.17

🇺🇸 167.172.197.187

🇺🇸 159.223.149.57

🇫🇮 147.185.133.246

🇫🇷 141.101.95.79

🇫🇷 141.94.76.134

🇹🇭 119.59.99.18

🇨🇮 102.210.19.164

🇫🇮 34.88.174.234

🇨🇦 15.235.98.76

🇺🇸 2607:f8b0:4023:1004::12c

🇬🇧 217.154.62.224

🇧🇷 200.36.221.123

🇷🇺 178.178.222.56