JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 213.202.233.140

213.202.233.140 was found in our database!

This IP was reported 72 times. Confidence of Abuse is 65%: ?

65%

This address is a Tor exit node. Neither the owner nor the provider are directly behind the offending action.

ISP	WIIT AG
Usage Type	Data Center/Web Hosting/Transit
ASN	AS24961
Hostname(s)	srv20935.dus7.dedicated.server-hosting.expert
Domain Name	wiit.cloud
Country	🇩🇪 Germany
City	Essen, North Rhine-Westphalia

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 213.202.233.140

Whois 213.202.233.140

IP Abuse Reports for 213.202.233.140:

This IP address has been reported a total of 72 times from 41 distinct sources. 213.202.233.140 was first reported on March 2nd 2022, and the most recent report was 9 hours ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
Anonymous	2026-07-14 21:41:45 (9 hours ago)	Detected by CrowdSec: crowdsecurity/http-bad-user-agent	Web App Attack
🇺🇸 xmission.com	2026-07-14 17:34:18 (13 hours ago)	Blocked by UFW (TCP on 63107) Source port: 57322 TTL: 47 Packet length: 60 TOS: 0x08 This report (f ... show more Blocked by UFW (TCP on 63107) Source port: 57322 TTL: 47 Packet length: 60 TOS: 0x08 This report (for 213.202.233.140) was generated by: https://github.com/sefinek/UFW-AbuseIPDB-Reporter show less	Port Scan
🇦🇺 oncord	2026-07-14 05:45:37 (1 day ago)	Form spam	Web Spam
🇺🇸 xmission.com	2026-07-13 15:47:18 (1 day ago)	Blocked by UFW (TCP on 17159) Source port: 36232 TTL: 47 Packet length: 60 TOS: 0x08 This report (f ... show more Blocked by UFW (TCP on 17159) Source port: 36232 TTL: 47 Packet length: 60 TOS: 0x08 This report (for 213.202.233.140) was generated by: https://github.com/sefinek/UFW-AbuseIPDB-Reporter show less	Port Scan
🇦🇺 oncord	2026-07-13 05:35:39 (2 days ago)	Form spam	Web Spam
🇺🇸 xmission.com	2026-07-12 20:49:18 (2 days ago)	Blocked by UFW (TCP on 6881) Source port: 58804 TTL: 47 Packet length: 60 TOS: 0x08 This report (fo ... show more Blocked by UFW (TCP on 6881) Source port: 58804 TTL: 47 Packet length: 60 TOS: 0x08 This report (for 213.202.233.140) was generated by: https://github.com/sefinek/UFW-AbuseIPDB-Reporter show less	Port Scan
🇩🇪 pscriptos	2026-07-12 18:04:26 (2 days ago)	This IP was detected by CrowdSec triggering crowdsecurity/http-probing	Web App Attack Hacking
🇺🇸 TPI-Abuse	2026-07-12 12:52:25 (2 days ago)	(mod_security) mod_security (id:225170) triggered by 213.202.233.140 (srv20935.dus7.dedicated.server ... show more (mod_security) mod_security (id:225170) triggered by 213.202.233.140 (srv20935.dus7.dedicated.server-hosting.expert): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Jul 12 08:52:17.532307 2026] [security2:error] [pid 14867:tid 14968] [client 213.202.233.140:37074] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)\|\|gemini.pe\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "gemini.pe"] [uri "/wp-json/wp/v2/users"] [unique_id "alOOARnp8enOFD8foCQWPAAAAQE"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-07-12 02:10:57 (3 days ago)	(mod_security) mod_security (id:225170) triggered by 213.202.233.140 (srv20935.dus7.dedicated.server ... show more (mod_security) mod_security (id:225170) triggered by 213.202.233.140 (srv20935.dus7.dedicated.server-hosting.expert): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Jul 11 22:10:54.319924 2026] [security2:error] [pid 18632:tid 18632] [client 213.202.233.140:40072] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)\|\|eftekharschool.ir\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "eftekharschool.ir"] [uri "/wp-json/wp/v2/users"] [unique_id "alL3rh80Nr8pMSORd_ZP4gAAABc"] show less	Brute-Force Bad Web Bot Web App Attack
🇩🇪 FeG Deutschland	2026-07-11 03:25:32 (4 days ago)	Looking for CMS/PHP/SQL vulnerablilities/excessive crawling - 267	Exploited Host Web App Attack
🇬🇧 relianoid.com	2026-07-09 08:07:53 (5 days ago)	POST Abuse detected by Relianoid OSS Load Balancer - relianoid.com	Web Spam
🇺🇸 TPI-Abuse	2026-07-09 08:06:37 (5 days ago)	(mod_security) mod_security (id:211220) triggered by 213.202.233.140 (srv20935.dus7.dedicated.server ... show more (mod_security) mod_security (id:211220) triggered by 213.202.233.140 (srv20935.dus7.dedicated.server-hosting.expert): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jul 09 04:06:32.624483 2026] [security2:error] [pid 21456:tid 21456] [client 213.202.233.140:46328] ModSecurity: Access denied with code 403 (phase 2). Pattern match "<\\\\?(?!xml\\\\s)" at ARGS:vars[0]. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "70"] [id "211220"] [rev "4"] [msg "COMODO WAF: PHP Injection Attack\|\|cmc4president.homebuilt.org\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cmc4president.homebuilt.org"] [uri "/index.php"] [unique_id "ak9WiAjKk9i0ACnEi4kUaQAAAAU"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 oncord	2026-07-08 18:59:29 (6 days ago)	Form spam	Web Spam
🇨🇿 ptlab	2026-07-08 10:45:36 (6 days ago)	Detected php_null_array_access attack from WP-host.	Hacking Web App Attack
🇳🇱 homeshowdomain.nl	2026-07-07 21:59:08 (1 week ago)	Auto-ban: >3000 req/min op 2026-07-07	Web App Attack SSH Hacking

Showing 1 to 15 of 72 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇷🇴 193.32.162.84

🇺🇸 172.93.106.153

🇫🇮 147.185.133.212

🇨🇳 123.245.85.126

🇻🇳 103.60.242.169

🇧🇬 91.92.47.123

🇺🇸 47.251.179.212

🇬🇧 35.203.210.187

🇳🇱 34.34.103.195

🇮🇩 202.145.0.61

🇳🇱 158.94.210.15

🇨🇳 119.96.55.122

🇺🇸 104.194.192.170

🇺🇸 67.52.95.38

🇹🇭 210.1.31.3

🇺🇸 195.184.76.222

🇳🇱 185.223.235.2

🇺🇸 172.104.210.105

🇺🇸 159.89.135.205

🇱🇻 151.242.43.229