JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 207.127.94.142

207.127.94.142 was found in our database!

This IP was reported 105 times. Confidence of Abuse is 52%: ?

52%

ISP	Oracle Corporation
Usage Type	Data Center/Web Hosting/Transit
ASN	AS31898
Domain Name	oracle.com
Country	🇸🇪 Sweden
City	Stockholm, Stockholm

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 207.127.94.142

Whois 207.127.94.142

IP Abuse Reports for 207.127.94.142:

This IP address has been reported a total of 105 times from 29 distinct sources. 207.127.94.142 was first reported on September 15th 2023, and the most recent report was 3 hours ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇩🇪 big-cloud.nl	2026-07-30 18:41:22 (3 hours ago)	Try to access /https://meneerdekok.nl/xmlrpc.php?rsd	Web App Attack
🇩🇪 LRob	2026-07-30 02:10:09 (19 hours ago)	CrowdSec: crowdsecurity/http-probing \| req: /https://www.atce-energies.com/feed/ \| 11 distinct paths ... show more CrowdSec: crowdsecurity/http-probing \| req: /https://www.atce-energies.com/feed/ \| 11 distinct paths \| UA: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.1.8) Gecko/20100214 Ubuntu/9.10 (karmic) Firefox/3.5.8 show less	Port Scan Web App Attack
🇩🇪 big-cloud.nl	2026-07-23 18:41:24 (1 week ago)	Try to access /https://meneerdekok.nl/xmlrpc.php?rsd	Web App Attack
🇺🇸 TPI-Abuse	2026-07-23 04:50:45 (1 week ago)	(mod_security) mod_security (id:210730) triggered by 207.127.94.142 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210730) triggered by 207.127.94.142 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jul 23 00:50:36.509959 2026] [security2:error] [pid 2318683:tid 2318683] [client 207.127.94.142:43298] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy\|\|www.solcargomiami.com\|F\|2"] [data ".arpiximagepro.com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.solcargomiami.com"] [uri "/https:/www.arpiximagepro.com"] [unique_id "amGdnJ9eAW2whNJN_dV7YAAAABA"] show less	Brute-Force Bad Web Bot Web App Attack
🇩🇪 LRob	2026-07-23 02:10:07 (1 week ago)	CrowdSec: crowdsecurity/http-probing \| req: /https://www.atce-energies.com/feed/ \| 11 distinct paths ... show more CrowdSec: crowdsecurity/http-probing \| req: /https://www.atce-energies.com/feed/ \| 11 distinct paths \| UA: Mozilla/5.0 (Windows NT 6.2; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/32.0.1667.0 Safari/537.36 show less	Port Scan Web App Attack
Anonymous	2026-07-21 07:20:02 (1 week ago)	Malicious activity detected	Hacking Web App Attack
🇩🇪 big-cloud.nl	2026-07-16 18:40:20 (2 weeks ago)	Try to access /https://meneerdekok.nl/xmlrpc.php	Web App Attack
🇮🇹 CoreTech srl	2026-07-16 02:48:57 (2 weeks ago)	cloudlinux2 fail2ban: 2026-07-16 04:44:02,477 fail2ban.filter [1812]: INFO [plesk-apache] ... show more cloudlinux2 fail2ban: 2026-07-16 04:44:02,477 fail2ban.filter [1812]: INFO [plesk-apache] Found 54.149.186.213 - 2026-07-16 04:44:02cloudlinux2 fail2ban: 2026-07-16 04:44:19,031 fail2ban.filter [1812]: INFO [plesk-wordpress] Found 173.239.214.232 - 2026-07-16 04:44:18cloudlinux2 fail2ban: 2026-07-16 04:44:14,887 fail2ban.filter [1812]: INFO [plesk-wordpress] Found 173.239.214.232 - 2026-07-16 04:44:13cloudlinux2 fail2ban: 2026-07-16 04:46:58,801 fail2ban.filter [1812]: INFO [plesk-wordpress] Found 137.184.209.151 - 2026-07-16 04:46:56cloudlinux2 fail2ban: 2026-07-16 04:46:58,633 fail2ban.filter [1812]: INFO [plesk-wordpress] Found 137.184.209.151 - 2026-07-16 04:46:56cloudlinux2 fail2ban: 2026-07-16 04:46:59,744 fail2ban.filter [1812]: INFO [plesk-wordpress] Found 216.73.163.178 - 2026-07-16 04:46:58cloudlinux2 fail2ban: 2026-07-16 04:47:09,043 fail2ban.filter [1812]: INFO [plesk-modsecurity] Found 207.127.94.142 - 2026-07-16 04:47:0 show less	Web App Attack
🇩🇪 LRob	2026-07-16 02:10:08 (2 weeks ago)	CrowdSec: crowdsecurity/http-probing \| req: /https://www.atce-energies.com/feed/ \| 11 distinct paths ... show more CrowdSec: crowdsecurity/http-probing \| req: /https://www.atce-energies.com/feed/ \| 11 distinct paths \| UA: Mozilla/5.0 (compatible; Konqueror/4.3; Linux) KHTML/4.3.2 (like Gecko) show less	Port Scan Web App Attack
🇺🇸 TPI-Abuse	2026-07-15 20:47:47 (2 weeks ago)	(mod_security) mod_security (id:210730) triggered by 207.127.94.142 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210730) triggered by 207.127.94.142 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jul 15 16:47:42.780606 2026] [security2:error] [pid 9026:tid 9026] [client 207.127.94.142:33990] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy\|\|www.primelb.com\|F\|2"] [data ".com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.primelb.com"] [uri "/https:/directnic.com"] [unique_id "alfx7nj2Tmq6d69QcMfBfAAAAAI"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-07-15 20:16:10 (2 weeks ago)	(mod_security) mod_security (id:210730) triggered by 207.127.94.142 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210730) triggered by 207.127.94.142 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jul 15 16:16:03.502843 2026] [security2:error] [pid 21361:tid 21361] [client 207.127.94.142:47674] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy\|\|www.maffiniandbearce.com\|F\|2"] [data ".maffiniandbearce.com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.maffiniandbearce.com"] [uri "/https:/www.maffiniandbearce.com"] [unique_id "alfqg0SO5Prx6mzp6Ui8RQAAAAw"] show less	Brute-Force Bad Web Bot Web App Attack
🇪🇸 pipeline.es	2026-07-12 15:08:11 (2 weeks ago)	Web scanning / probing for vulnerable paths \| URL: /https://onlinetours.es/es/casas/casas.htm \| Evid ... show more Web scanning / probing for vulnerable paths \| URL: /https://onlinetours.es/es/casas/casas.htm \| Evidence: onlinetours.es 207.127.94.142 - - [12/Jul/2026:17:07:10 +0200] \"GET /https://onlinetours.es/es/casas/casas.htm HTTP/1.1\" 404 51355 \"-\" \"Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/[internal_ip] Safari/534.16\" GEOIP_COUNTRY_CODE=SE \| ASN: ORACLE-BMC-31898 \| Country: SE show less	Port Scan Web App Attack
🇺🇸 TPI-Abuse	2026-07-12 03:41:15 (2 weeks ago)	(mod_security) mod_security (id:210730) triggered by 207.127.94.142 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210730) triggered by 207.127.94.142 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Jul 11 23:41:09.373237 2026] [security2:error] [pid 8490:tid 8490] [client 207.127.94.142:43900] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy\|\|www.insua.com\|F\|2"] [data ".googleapis.com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.insua.com"] [uri "/https:/fonts.googleapis.com"] [unique_id "alMM1ZUARdBRPTadLfk8sAAAAAk"] show less	Brute-Force Bad Web Bot Web App Attack
🇳🇱 WeCloudit-Anti-Abuse	2026-07-12 02:13:43 (2 weeks ago)	This IP was detected by CrowdSec triggering crowdsecurity/http-probing	Web App Attack Hacking
🇺🇸 TPI-Abuse	2026-07-11 12:35:17 (2 weeks ago)	(mod_security) mod_security (id:210730) triggered by 207.127.94.142 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210730) triggered by 207.127.94.142 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Jul 11 08:35:09.842424 2026] [security2:error] [pid 8721:tid 8721] [client 207.127.94.142:35216] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "4"] [msg "COMODO WAF: URL file extension is restricted by policy\|\|www.1214productions.com\|F\|2"] [data ".zodiacgate.com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.1214productions.com"] [uri "/https:/www.zodiacgate.com"] [unique_id "alI4fUNOuhjQNb_UAqAERAAAAAE"] show less	Brute-Force Bad Web Bot Web App Attack

Showing 1 to 15 of 105 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇩🇪 131.189.177.42

🇳🇱 45.148.10.141

🇺🇸 2a03:2880:f800:31::

🇧🇪 198.235.24.200

🇺🇸 162.216.150.120

🇷🇺 128.0.136.107

🇨🇳 119.60.9.114

🇨🇳 118.249.191.163

🇻🇳 113.172.122.112

🇨🇳 113.16.16.130

🇳🇬 102.88.137.80

🇳🇱 45.148.10.147

🇨🇿 31.222.6.222

🇦🇺 2400:8280:3:104:9999::245

🇺🇸 205.210.31.59

🇧🇷 138.255.157.62

🇨🇳 118.113.164.137

🇹🇼 101.13.5.26

🇫🇷 51.159.110.167

🇦🇺 27.32.200.175