JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 37.140.254.118

37.140.254.118 was found in our database!

This IP was reported 10 times. Confidence of Abuse is 48%: ?

48%

ISP	VPN Consumer Network Services
Usage Type	Data Center/Web Hosting/Transit
ASN	AS206092
Domain Name	vpnconsumer.com
Country	🇨🇭 Switzerland
City	Oberhausen-Boschenwiesen, Zurich

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 37.140.254.118

Whois 37.140.254.118

IP Abuse Reports for 37.140.254.118:

This IP address has been reported a total of 10 times from 9 distinct sources. 37.140.254.118 was first reported on June 9th 2026, and the most recent report was 3 hours ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇩🇪 Starburst SysOp Team	2026-07-01 17:05:45 (3 hours ago)	Host header is a numeric IP address. Pattern match "(?:^( (920350-nue6-1)	Hacking Bad Web Bot
🇨🇭 YF	2026-07-01 17:00:24 (3 hours ago)	Attaque distribuée subnet	DDoS Attack Web App Attack
🇬🇧 markawes	2026-07-01 16:14:05 (4 hours ago)	[SynFast] Auto banned by Fail2Ban. Reason: Web vulnerability scan detected. Evidence: 37.140.254.11 ... show more [SynFast] Auto banned by Fail2Ban. Reason: Web vulnerability scan detected. Evidence: 37.140.254.118 - - [01/Jul/2026:16:14:04 +0000] "GET /.env.local HTTP/1.1" 404 564 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_4) AppleWebKit/537.36 Chrome/124.0.0.0 Safari/537.36" 37.140.254.118 - - [01/Jul/2026:16:14:04 +0000] "GET /.env.local HTTP/1.1" 404 162 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0" show less	Web App Attack Port Scan
Anonymous	2026-07-01 15:52:07 (4 hours ago)	2026/07/01 15:51:48 [error] 3404738#3404738: 12705 [client 37.140.254.118] ModSecurity: Access deni ... show more 2026/07/01 15:51:48 [error] 3404738#3404738: 12705 [client 37.140.254.118] ModSecurity: Access denied with code 403 (phase 2). Matched "Operator `Ge' with parameter `5' against variable `TX:BLOCKING_INBOUND_ANOMALY_SCORE' (Value: `5' ) [file "/usr/local/owasp-modsecurity-crs-4.11.0/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "222"] [id "949110"] [rev ""] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [data ""] [severity "0"] [ver "OWASP_CRS/4.27.0"] [maturity "0"] [accuracy "0"] [tag "anomaly-evaluation"] [tag "OWASP_CRS"] [hostname "94.72.101.158"] [uri "/phpinfo.php"] [unique_id "178292110882.109463"] [ref ""], client: 37.140.254.118, server: srv.ingeltechgh.com, request: "GET /phpinfo.php HTTP/1.1", host: "94.72.101.158" 2026/07/01 15:51:58 [error] 3404735#3404735: *12745 [client 37.140.254.118] ModSecurity: Access denied with code 403 (phase 2). Matched "Operator `Ge' with parameter `5' against variable `TX:BLOCKING_INBOUND_ANOMALY_SCORE' (Value: `5' ) [file "/usr/local/ ... show less	Brute-Force
🇫🇷 YF	2026-07-01 15:15:41 (4 hours ago)	Environment file probe	Web App Attack
🇳🇱 BlueWire Hosting	2026-07-01 08:22:09 (11 hours ago)	Probing websites for vulnerabilities	Web App Attack
🇫🇷 LoneRider	2026-07-01 06:46:17 (13 hours ago)	[01/Jul/2026:08:43:21.543684 +0200] akS3CTibR57wOBNtWw0k1gAAAAc 37.140.254.118 52190 127.0.0.1 7080 ... show more [01/Jul/2026:08:43:21.543684 +0200] akS3CTibR57wOBNtWw0k1gAAAAc 37.140.254.118 52190 127.0.0.1 7080 [01/Jul/2026:08:43:25.842885 +0200] akS3DXW6E7mko-T8mgVRogAAAAI 37.140.254.118 35952 127.0.0.1 7081 [01/Jul/2026:08:46:17.059690 +0200] akS3uZ6bY6c0L9AzLaofmwAAAAE 37.140.254.118 57116 127.0.0.1 7081 ... show less	Hacking
🇺🇦 URAN Publishing Service	2026-06-09 16:04:58 (3 weeks ago)	37.140.254.118 - - [09/Jun/2026:19:04:57 +0300] "GET /wp-content/plugins/ubh/up.php HTTP/1.1" 404 70 ... show more 37.140.254.118 - - [09/Jun/2026:19:04:57 +0300] "GET /wp-content/plugins/ubh/up.php HTTP/1.1" 404 706 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:73.0) Gecko/20100101 Firefox/73.0" 37.140.254.118 - - [09/Jun/2026:19:04:58 +0300] "GET /wp-admin/images/bootstrap.php HTTP/1.1" 404 706 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.3" ... show less	Web App Attack
🇩🇪 TrackerSB	2026-06-09 14:20:55 (3 weeks ago)	37.140.254.118 - "-" [09/Jun/2026:16:20:49 +0200] "GET //wp-includes/ID3/license.txt HTTP/1.1" 200 2 ... show more 37.140.254.118 - "-" [09/Jun/2026:16:20:49 +0200] "GET //wp-includes/ID3/license.txt HTTP/1.1" 200 2442 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36" "37.140.254.118" 37.140.254.118 - "-" [09/Jun/2026:16:20:54 +0200] "GET //blog/wp-includes/wlwmanifest.xml HTTP/1.1" 200 2442 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36" "37.140.254.118" ... show less	Web App Attack
🇫🇷 Octopuce	2026-06-09 12:39:11 (3 weeks ago)	Aggressive web search of vulnerable pages: /wp-admin/user/about.php /wp-admin/js/widgets/index.php / ... show more Aggressive web search of vulnerable pages: /wp-admin/user/about.php /wp-admin/js/widgets/index.php /webadmin.php /wp-includes/PHPMailer/about.p ... show less	Web App Attack

Showing 1 to 10 of 10 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇺🇸 192.81.131.83

🇮🇹 151.60.146.76

🇸🇬 139.59.244.68

🇿🇦 105.184.153.190

🇺🇸 98.159.233.179

🇫🇷 90.119.180.87

🇮🇹 79.3.96.178

🇳🇱 45.148.10.35

🇸🇬 43.156.3.248

🇷🇴 2.57.122.238

🇸🇪 192.71.126.249

🇧🇴 190.181.25.210

🇺🇸 154.16.115.34

🇺🇸 152.53.193.154

🇵🇰 119.152.233.105

🇮🇳 4.224.59.75

🇺🇸 195.184.76.192

🇦🇺 192.46.221.70

🇧🇷 179.176.210.17

🇻🇳 171.244.142.4