JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 185.65.133.45

185.65.133.45 was found in our database!

This IP was reported 23 times. Confidence of Abuse is 9%: ?

ISP	31173 Services AB infrastructure in Helsinki, FI.
Usage Type	Data Center/Web Hosting/Transit
ASN	AS39351
Domain Name	31173.se
Country	🇫🇮 Finland
City	Helsinki, Uusimaa

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 185.65.133.45

Whois 185.65.133.45

IP Abuse Reports for 185.65.133.45:

This IP address has been reported a total of 23 times from 15 distinct sources. 185.65.133.45 was first reported on May 20th 2026, and the most recent report was 2 weeks ago.

Old Reports: The most recent abuse report for this IP address is from 2 weeks ago . It is possible that this IP is no longer involved in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
Anonymous	2026-10-10 11:16:24 (2 weeks ago)	denied traffic to a honeypot network. destination port 5901.	Port Scan Hacking
🇧🇬 Stoyko Stoykov	2026-09-02 06:10:42 (1 month ago)	185.65.133.45 - - [02/Sep/2026:09:10:41 +0300] "GET /api/.env HTTP/1.1" 400 248 "-" "Go-http-client/ ... show more 185.65.133.45 - - [02/Sep/2026:09:10:41 +0300] "GET /api/.env HTTP/1.1" 400 248 "-" "Go-http-client/1.1" ... show less	Hacking Web App Attack
🇫🇷 SpaceHost-Server	2026-08-17 03:01:44 (2 months ago)	185.65.133.45 - - [17/Aug/2026:05:01:22 +0200] "POST /xmlrpc.php HTTP/1.1" 200 6384 "-" "WordPress.c ... show more 185.65.133.45 - - [17/Aug/2026:05:01:22 +0200] "POST /xmlrpc.php HTTP/1.1" 200 6384 "-" "WordPress.com; https://wordpress.com" 185.65.133.45 - - [17/Aug/2026:05:01:32 +0200] "POST /xmlrpc.php HTTP/1.1" 200 6384 "-" "WordPress.com; https://wordpress.com" 185.65.133.45 - - [17/Aug/2026:05:01:42 +0200] "POST /xmlrpc.php HTTP/1.1" 200 6384 "-" "WordPress.com; https://wordpress.com" show less	Hacking Web App Attack
🇫🇷 SpaceHost-Server	2026-08-17 02:46:13 (2 months ago)	185.65.133.45 - - [17/Aug/2026:04:45:51 +0200] "POST /xmlrpc.php HTTP/1.1" 200 6384 "-" "Jetpack by ... show more 185.65.133.45 - - [17/Aug/2026:04:45:51 +0200] "POST /xmlrpc.php HTTP/1.1" 200 6384 "-" "Jetpack by WordPress.com (Jetpack 12.0; WordPress 6.3)" 185.65.133.45 - - [17/Aug/2026:04:46:01 +0200] "POST /xmlrpc.php HTTP/1.1" 200 6384 "-" "Jetpack by WordPress.com" 185.65.133.45 - - [17/Aug/2026:04:46:12 +0200] "POST /xmlrpc.php HTTP/1.1" 200 6384 "-" "Jetpack by WordPress.com (Jetpack 12.5; WordPress 6.4)" show less	Hacking Web App Attack
🇫🇮 YF	2026-08-17 01:30:27 (2 months ago)	xmlrpc.php Potential DDoS or brute force	DDoS Attack Brute-Force
🇧🇪 madeit	2026-08-17 00:33:29 (2 months ago)		Web App Attack
🇺🇸 TPI-Abuse	2026-08-17 00:15:20 (2 months ago)	(mod_security) mod_security (id:240335) triggered by 185.65.133.45 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:240335) triggered by 185.65.133.45 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Aug 16 20:15:15.566294 2026] [security2:error] [pid 12030:tid 12030] [client 185.65.133.45:65266] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 185.65.133.45 (+1 hits since last alert)\|yerevanpress.am\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "yerevanpress.am"] [uri "/xmlrpc.php"] [unique_id "aoJSk_BEFEnCtO7cb5jN8QAAABo"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 WeekendWeb	2026-08-16 19:25:57 (2 months ago)	Wordpress Vunerability attack	Web App Attack
🇺🇸 TPI-Abuse	2026-08-16 17:55:45 (2 months ago)	(mod_security) mod_security (id:240335) triggered by 185.65.133.45 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:240335) triggered by 185.65.133.45 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Aug 16 13:55:40.621266 2026] [security2:error] [pid 3738:tid 3738] [client 185.65.133.45:57605] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 185.65.133.45 (+1 hits since last alert)\|ritterlien.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "ritterlien.com"] [uri "/xmlrpc.php"] [unique_id "aoH5nHOPKkqouEwrjgfDgAAAAAY"] show less	Brute-Force Bad Web Bot Web App Attack
🇮🇹 Progetto1	2026-08-16 12:00:03 (2 months ago)	Website Scanning / Scraping	Bad Web Bot Exploited Host Web App Attack
🇦🇺 screwlooseit.com.au	2026-08-16 08:38:11 (2 months ago)	Blocked by CSF 13 firewall - Rule: XMLRPC SE/Sweden/-	Web App Attack
🇫🇷 Kenshin869	2026-08-16 04:32:54 (2 months ago)	Wordpress unauthorized access attempt	Brute-Force
🇺🇸 TPI-Abuse	2026-08-16 01:32:33 (2 months ago)	(mod_security) mod_security (id:240335) triggered by 185.65.133.45 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:240335) triggered by 185.65.133.45 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Aug 15 21:32:26.134327 2026] [security2:error] [pid 13081:tid 13081] [client 185.65.133.45:65198] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 185.65.133.45 (+1 hits since last alert)\|transcapitalsolutions.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "transcapitalsolutions.com"] [uri "/xmlrpc.php"] [unique_id "aoETKlhxeKDenaYHUug0FgAAAA8"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-08-16 01:01:17 (2 months ago)	(mod_security) mod_security (id:240335) triggered by 185.65.133.45 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:240335) triggered by 185.65.133.45 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Aug 15 21:01:12.615762 2026] [security2:error] [pid 25070:tid 25070] [client 185.65.133.45:52245] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 185.65.133.45 (+1 hits since last alert)\|naturalacu.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "naturalacu.com"] [uri "/xmlrpc.php"] [unique_id "aoEL2JevyBjtb5eoE6PAXgAAAAI"] show less	Brute-Force Bad Web Bot Web App Attack
🇩🇪 4server	2026-08-15 20:15:05 (2 months ago)	[SatAug1522:15:02.3559512026][security2:error][pid3308295:tid3308401][client185.65.133.45:0]ModSecur ... show more [SatAug1522:15:02.3559512026][security2:error][pid3308295:tid3308401][client185.65.133.45:0]ModSecurity:Accessdeniedwithcode403\(phase1\).Stringmatch\"/xmlrpc.php\"atREQUEST_URI.[file\"/etc/apache2/conf.d/modsec_custom_rules.conf\"][line\"170\"][id\"960024\"][msg\"XML-RPCdisabled\"][hostname\"cpfacilityservices.ch\"][uri\"/xmlrpc.php\"][unique_id\"aoDIxr8NtpiUjS3wDKohcgAAAM4\"] show less	Port Scan Brute-Force Web App Attack

Showing 1 to 15 of 23 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇬🇧 185.247.137.81

🇦🇷 181.228.80.171

🇨🇭 179.43.153.2

🇨🇳 118.145.107.219

🇺🇦 94.178.193.19

🇬🇧 90.222.120.142

🇰🇷 43.133.255.216

🇺🇸 216.25.89.120

🇺🇸 199.165.159.120

🇦🇷 181.25.197.234

🇳🇱 176.65.132.251

🇺🇸 172.98.32.108

🇺🇸 136.242.96.98

🇩🇪 92.118.12.45

🇺🇸 48.47.30.171

🇨🇦 45.198.224.20

🇧🇷 45.70.0.140

🇨🇳 36.106.166.98

🇺🇸 18.117.74.43

🇫🇮 13.140.86.214