JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 212.56.54.237

212.56.54.237 was found in our database!

This IP was reported 26 times. Confidence of Abuse is 11%: ?

11%

ISP	VPN Consumer New Jersey, United States of America
Usage Type	Data Center/Web Hosting/Transit
ASN	AS4213
Domain Name	vpnconsumer.com
Country	🇺🇸 United States of America
City	Trenton, New Jersey

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 212.56.54.237

Whois 212.56.54.237

IP Abuse Reports for 212.56.54.237:

This IP address has been reported a total of 26 times from 21 distinct sources. 212.56.54.237 was first reported on May 15th 2025, and the most recent report was 1 week ago.

Old Reports: The most recent abuse report for this IP address is from 1 week ago . It is possible that this IP is no longer involved in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇺🇸 xmission.com	2026-06-20 20:59:39 (1 week ago)	Blocked by UFW (TCP on 1) Source port: 36545 TTL: 113 Packet length: 52 TOS: 0x08 This report (for ... show more Blocked by UFW (TCP on 1) Source port: 36545 TTL: 113 Packet length: 52 TOS: 0x08 This report (for 212.56.54.237) was generated by: https://github.com/sefinek/UFW-AbuseIPDB-Reporter show less	Port Scan
🇫🇷 Octopuce	2026-05-12 07:14:18 (1 month ago)	Aggressive web search of vulnerable pages: /mediawiki/index.php?title=Accueil&action=/\/\bestbuy.com ... show more Aggressive web search of vulnerable pages: /mediawiki/index.php?title=Accueil&action=/\/\bestbuy.com&section=4 /mediawiki/index.php?title=Accue ... show less	Web App Attack
🇮🇹 VHosting	2026-01-09 05:33:42 (5 months ago)	Detected mail brute force attack from 4 different servers	Brute-Force
🇩🇪 marzzzello	2025-11-24 04:19:51 (7 months ago)	Ports: 25x 33456	Port Scan
Anonymous	2025-10-07 11:14:46 (8 months ago)	Botnet activity detected: Repeated interval SYN attack, Coordinated SYN scan, Complex coordinated at ... show more Botnet activity detected: Repeated interval SYN attack, Coordinated SYN scan, Complex coordinated attack, Distributed coordinated scan, Distributed botnet participant, Multi-pattern distributed attack, Advanced persistent scanning, Multi-IP interval attack, Low-rate interval scan, Botnet scanning activity. Total 10 blocks. show less	DDoS Attack Port Scan Hacking
Anonymous	2025-10-02 21:27:51 (8 months ago)	(mod_security) mod_security triggered on hostname [redacted] 212.56.54.237 (US/United States/-): (C ... show more (mod_security) mod_security triggered on hostname [redacted] 212.56.54.237 (US/United States/-): (CF_ENABLE) show less	SQL Injection
🇫🇷 Sklurk	2025-10-02 19:06:59 (8 months ago)	Web App Attack	Web App Attack
🇺🇸 TPI-Abuse	2025-10-02 12:06:30 (8 months ago)	(mod_security) mod_security (id:211190) triggered by 212.56.54.237 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:211190) triggered by 212.56.54.237 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 02 08:06:26.625967 2025] [security2:error] [pid 23453:tid 23523] [client 212.56.54.237:17043] ModSecurity: Access denied with code 403 (phase 2). Match of "contains cpanel" against "REQUEST_URI" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "55"] [id "211190"] [rev "9"] [msg "COMODO WAF: Remote File Access Attempt\|\|www.volcano-sa.com\|F\|2"] [data "Matched Data: /etc/ found within REQUEST_URI: /products.php?catId=/etc/passwd"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.volcano-sa.com"] [uri "/products.php"] [unique_id "aN5qwr-Tzbk4NpPl-b-BvAAAAIw"] show less	Brute-Force Bad Web Bot Web App Attack
🇯🇵 VXG-NET	2025-10-02 09:19:27 (8 months ago)	port=80, indicator_type=info-leak	Hacking
🇬🇧 Steve	2025-10-02 07:41:08 (8 months ago)	SQL Injection Attempts	SQL Injection Brute-Force
🇫🇮 tjs	2025-10-02 07:10:00 (8 months ago)	web attack	Hacking Web App Attack
🇺🇸 TPI-Abuse	2025-10-02 05:08:09 (8 months ago)	(mod_security) mod_security (id:211190) triggered by 212.56.54.237 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:211190) triggered by 212.56.54.237 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 02 01:08:02.604446 2025] [security2:error] [pid 14938:tid 14938] [client 212.56.54.237:27377] ModSecurity: Access denied with code 403 (phase 2). Match of "contains cpanel" against "REQUEST_URI" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "55"] [id "211190"] [rev "9"] [msg "COMODO WAF: Remote File Access Attempt\|\|www.powerkiteforum.com\|F\|2"] [data "Matched Data: /etc/ found within REQUEST_URI: /viewthread.php?tid=/etc/passwd"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.powerkiteforum.com"] [uri "/viewthread.php"] [unique_id "aN4IssIZXQEgOlIhIwI8LAAAABY"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 octageeks.com	2025-10-02 04:07:34 (8 months ago)	Wordpress malicious attack:[octablocked]	Web App Attack
🇺🇸 fortypoundhead	2025-10-01 23:48:52 (8 months ago)	SQL Injection Attempt	SQL Injection Web App Attack
🇫🇷 COMAITE	2025-10-01 22:43:07 (8 months ago)	SQL injection attempt from 212.56.54.237.	Web App Attack

Showing 1 to 15 of 26 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇺🇸 207.32.143.72

🇸🇪 155.212.37.232

🇲🇽 138.84.54.124

🇨🇳 111.26.63.83

🇺🇸 66.132.195.75

🇮🇪 51.186.54.221

🇳🇱 45.154.98.101

🇳🇱 213.177.179.79

🇳🇱 213.152.161.54

🇺🇸 193.19.109.38

🇨🇴 186.80.230.116

🇸🇦 169.148.4.121

🇺🇸 162.216.150.189

🇺🇸 162.216.149.7

🇺🇸 138.197.215.2

🇨🇳 121.41.169.65

🇿🇦 102.212.198.204

🇫🇷 88.169.124.169

🇰🇪 41.212.103.161

🇬🇧 35.203.211.230