JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 37.140.223.80

37.140.223.80 was found in our database!

This IP was reported 280 times. Confidence of Abuse is 66%: ?

66%

ISP	Turkbil Sunucu Hizmetleri
Usage Type	Data Center/Web Hosting/Transit
ASN	AS206092
Domain Name	turkbil.net.tr
Country	🇺🇸 United States of America
City	Los Angeles, California

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 37.140.223.80

Whois 37.140.223.80

IP Abuse Reports for 37.140.223.80:

This IP address has been reported a total of 280 times from 111 distinct sources. 37.140.223.80 was first reported on October 13th 2022, and the most recent report was 1 day ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇩🇪 LRob	2026-07-24 11:56:41 (1 day ago)	CrowdSec: crowdsecurity/http-probing \| req: //wp-includes/wlwmanifest.xml \| 10 distinct paths \| UA: ... show more CrowdSec: crowdsecurity/http-probing \| req: //wp-includes/wlwmanifest.xml \| 10 distinct paths \| UA: - show less	Port Scan Web App Attack
🇺🇸 TPI-Abuse	2026-07-24 10:33:49 (1 day ago)	(mod_security) mod_security (id:225170) triggered by 37.140.223.80 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:225170) triggered by 37.140.223.80 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jul 24 06:33:43.346407 2026] [security2:error] [pid 3638552:tid 3638552] [client 37.140.223.80:36601] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)\|\|schwanpaint.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "schwanpaint.com"] [uri "/wp-json/wp/v2/users/"] [unique_id "amM_h8cpBjpSVvXlom4pbgAAAAg"] show less	Brute-Force Bad Web Bot Web App Attack
🇧🇾 lns.bz	2026-07-24 09:42:08 (1 day ago)	Too many 404 requests [BY]	Web App Attack
🇺🇸 Rip	2026-07-24 08:55:56 (1 day ago)	WordPress fingerprinting and attack surface probing	Port Scan Web App Attack
🇫🇷 masterguru	2026-07-24 06:38:58 (1 day ago)	(wordpress) Apache: Failed WordPress login from 37.140.223.80 (US/United States/-): 10 in the last 3 ... show more (wordpress) Apache: Failed WordPress login from 37.140.223.80 (US/United States/-): 10 in the last 3600 secs (0-196) show less	Hacking
🇺🇸 TPI-Abuse	2026-07-24 05:16:37 (1 day ago)	(mod_security) mod_security (id:225170) triggered by 37.140.223.80 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:225170) triggered by 37.140.223.80 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jul 24 01:16:31.474318 2026] [security2:error] [pid 4027761:tid 4027761] [client 37.140.223.80:27157] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)\|\|naturephotographyadventures.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "naturephotographyadventures.com"] [uri "/blog/wp-json/wp/v2/users/"] [unique_id "amL1L0ARTB62SDEEuaPTdAAAAAA"] show less	Brute-Force Bad Web Bot Web App Attack
🇫🇷 dynamix	2026-07-24 04:01:28 (1 day ago)	WordPress wp-login.php Brute Force Attack	Brute-Force Web App Attack
🇫🇷 masterguru	2026-07-24 02:46:02 (1 day ago)	(wordpress) Apache: Failed WordPress login from 37.140.223.80 (US/United States/-): 10 in the last 3 ... show more (wordpress) Apache: Failed WordPress login from 37.140.223.80 (US/United States/-): 10 in the last 3600 secs (0-193) show less	Hacking
🇺🇸 etu brutus	2026-07-16 01:41:33 (1 week ago)	37.140.223.80 has been banned for [WebApp Attack] ...	Hacking Bad Web Bot Web App Attack
🇫🇮 6kilowatti	2026-07-16 01:12:50 (1 week ago)	37.140.223.80 - - [16/Jul/2026:04:12:50 +0300] "POST //xmlrpc.php HTTP/1.1" 403 55 "-" "Mozilla/5.0 ... show more 37.140.223.80 - - [16/Jul/2026:04:12:50 +0300] "POST //xmlrpc.php HTTP/1.1" 403 55 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4240.193 Safari/537.36" 37.140.223.80 - [16/Jul/2026:04:12:50 +0300] "POST /xmlrpc.php HTTP/1.1" 403 8192 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4240.193 Safari/537.36" ... show less	Web App Attack
🇧🇾 lns.bz	2026-06-26 22:56:34 (4 weeks ago)	Too many 404 requests [BY]	Web App Attack
🇦🇺 paulshipley.com.au	2026-06-26 20:53:03 (4 weeks ago)	ccideas.com.au:443 37.140.223.80 - - [27/Jun/2026:06:52:59 +1000] "GET /?author=1 HTTP/1.1" 404 2478 ... show more ccideas.com.au:443 37.140.223.80 - - [27/Jun/2026:06:52:59 +1000] "GET /?author=1 HTTP/1.1" 404 247870 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 Version/17.0 Safari/605.1.15" ... show less	Web App Attack
🇺🇸 etu brutus	2026-06-26 17:11:11 (4 weeks ago)	37.140.223.80 has been banned for [WebApp Attack] ...	Hacking Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-06-25 22:34:00 (4 weeks ago)	(mod_security) mod_security (id:234930) triggered by 37.140.223.80 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:234930) triggered by 37.140.223.80 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jun 25 18:33:51.758067 2026] [security2:error] [pid 25550:tid 25550] [client 37.140.223.80:29469] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\/lib\\\\/php\\\\/connector\\\\.minimal\\\\.php$" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/27_Apps_WPPlugin.conf"] [line "6778"] [id "234930"] [rev "2"] [msg "COMODO WAF: File upload vulnerability in the file manager plugin before 6.9 for WordPress (CVE-2020-25213)\|\|aroilcontrolsystem.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WPPlugin"] [hostname "aroilcontrolsystem.com"] [uri "/wp-content/plugins/wp-file-manager/lib/php/connector.minimal.php"] [unique_id "aj2sz4HGQxOBFRDn0XFHewAAAAY"] show less	Brute-Force Bad Web Bot Web App Attack
🇫🇷 Octopuce	2026-06-25 21:59:42 (4 weeks ago)	Aggressive web search of vulnerable pages: /wp-links-opml.php /as.php /wp-includes/blocks/pullquote/ ... show more Aggressive web search of vulnerable pages: /wp-links-opml.php /as.php /wp-includes/blocks/pullquote/ /wp-content/themes/twentytwentyone/templat ... show less	Web App Attack

Showing 1 to 15 of 280 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇨🇳 182.119.230.5

🇳🇱 192.42.116.98

🇺🇸 159.65.224.88

🇺🇸 143.110.153.215

🇨🇳 120.41.45.213

🇮🇩 103.105.53.15

🇧🇷 45.205.1.240

🇵🇸 213.6.105.232

🇭🇰 168.76.131.178

🇩🇪 141.11.32.150

🇯🇵 139.162.70.53

🇻🇳 103.149.87.4

🇮🇩 69.5.20.205

🇮🇳 40.126.18.32

🇮🇹 5.89.75.194

🇻🇪 190.142.224.195

🇵🇱 104.164.44.175

🇸🇬 101.47.159.50

🇨🇳 39.171.219.91

🇭🇰 152.32.212.224