JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 37.140.254.159

37.140.254.159 was found in our database!

This IP was reported 101 times. Confidence of Abuse is 20%: ?

20%

ISP	VPN Consumer Network Services
Usage Type	Data Center/Web Hosting/Transit
ASN	AS206092
Domain Name	vpnconsumer.com
Country	🇨🇭 Switzerland
City	Oberhausen-Boschenwiesen, Zurich

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 37.140.254.159

Whois 37.140.254.159

IP Abuse Reports for 37.140.254.159:

This IP address has been reported a total of 101 times from 53 distinct sources. 37.140.254.159 was first reported on August 6th 2023, and the most recent report was 1 week ago.

Old Reports: The most recent abuse report for this IP address is from 1 week ago . It is possible that this IP is no longer involved in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇪🇸 pipeline.es	2026-06-05 19:29:14 (1 week ago)	Web scanning / probing for vulnerable paths	Port Scan Web App Attack
🇪🇸 pipeline.es	2026-06-05 18:54:48 (1 week ago)	Web scanning / probing for vulnerable paths \| URL: /assets/script.js.php \| Evidence: www.oberoi.es 3 ... show more Web scanning / probing for vulnerable paths \| URL: /assets/script.js.php \| Evidence: www.oberoi.es 37.140.254.159 - - [05/Jun/2026:20:35:34 +0200] \"GET /assets/script.js.php HTTP/1.1\" 404 218 \"-\" \"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.129 Safari/537.36\" GEOIP_COUNTRY_CODE=CH \| ASN: F.n.s. Holdings Limited \| Country: CH show less	Port Scan Web App Attack
🇪🇸 pipeline.es	2026-06-05 18:36:27 (1 week ago)	Web scanning / probing for vulnerable paths \| URL: /wp-includes/rest-api/about.php \| Evidence: www.o ... show more Web scanning / probing for vulnerable paths \| URL: /wp-includes/rest-api/about.php \| Evidence: www.oberoi.es 37.140.254.159 - - [05/Jun/2026:20:35:28 +0200] \"GET /wp-includes/rest-api/about.php HTTP/1.1\" 404 228 \"-\" \"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/69.0.3497.100 Safari/537.36\" GEOIP_COUNTRY_CODE=CH \| ASN: F.n.s. Holdings Limited \| Country: CH show less	Port Scan Web App Attack
🇧🇷 SOC Blue Team	2026-05-27 03:25:50 (3 weeks ago)	IPs get by Hunting on SIEM	Phishing Web Spam Port Scan Hacking
🇨🇦 Mediashaker	2026-05-07 03:45:33 (1 month ago)	(apache-scanners) Failed apache-scanners trigger with match [redacted] from 37.140.254.159 (CH/Switz ... show more (apache-scanners) Failed apache-scanners trigger with match [redacted] from 37.140.254.159 (CH/Switzerland/-) show less	Port Scan
🇳🇱 Mangelot Hosting	2026-04-28 05:15:04 (1 month ago)	(php_susp_dir) srv103 PHP in suspicious dir 37.140.254.159 (CH/Switzerland/-): 1 in the last 3600 se ... show more (php_susp_dir) srv103 PHP in suspicious dir 37.140.254.159 (CH/Switzerland/-): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: show less	Web App Attack
🇬🇧 consul.to	2026-04-25 05:26:44 (1 month ago)	Web attack/malicious scanning detected	Web App Attack
🇬🇧 consul.to	2026-04-24 01:24:45 (1 month ago)	Web attack/malicious scanning detected	Web App Attack
🇭🇷 fmilkovic	2026-04-15 10:34:16 (2 months ago)	Coordinated scanner farm (VPN exit) probing for PHPUnit RCE (CVE-2017-9841), .env files, Redmine exp ... show more Coordinated scanner farm (VPN exit) probing for PHPUnit RCE (CVE-2017-9841), .env files, Redmine exposure show less	Web App Attack
🇩🇪 barbarella	2026-04-15 02:58:25 (2 months ago)	Multiple (2) times attack on http port 80: Configuration snooping in .env file (GET /..;/env.js) ... show more Multiple (2) times attack on http port 80: Configuration snooping in .env file (GET /..;/env.js) 02:58:36 searching Vulnerable Cross-Site Scripting (GET /main.js) show less	Hacking Web App Attack
🇸🇬 Starburst SysOp Team	2026-04-14 13:24:51 (2 months ago)	Host header is a numeric IP address. Pattern match "(?:^( (920350-sin2-2)	Hacking Bad Web Bot
🇺🇸 Starburst SysOp Team	2026-04-14 11:21:20 (2 months ago)	Host header is a numeric IP address. Pattern match "(?:^( (920350-stl2-13)	Hacking Bad Web Bot
🇫🇷 Baking333	2026-04-13 21:02:47 (2 months ago)	[redacted] 37.140.254.159 - - [13/Apr/2026:22:02:45 +0100] "GET /wp-admin/css/colors/[redacted] HTTP ... show more [redacted] 37.140.254.159 - - [13/Apr/2026:22:02:45 +0100] "GET /wp-admin/css/colors/[redacted] HTTP/1.1" 301 580 0/743 "-" "Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36" [redacted] 37.140.254.159 - - [13/Apr/2026:22:02:45 +0100] "GET /wp-content/themes/aahana/[redacted] HTTP/1.1" 301 584 0/160 "-" "Mozilla/5.0 (X11; Ubuntu; Linux i686; rv:79.0) Gecko/20100101 Firefox/79.0" show less	Bad Web Bot Web App Attack
🇧🇪 cmbplf	2026-04-11 14:32:30 (2 months ago)	1.015 requests with url.path */xmlrpc.php	Brute-Force Bad Web Bot
🇪🇸 masterguru	2026-03-08 15:15:10 (3 months ago)	BAD BOT - Detected and Blocked.. Matched phrase "go-http-client" at REQUEST_HEADERS:User-Agent. (110 ... show more BAD BOT - Detected and Blocked.. Matched phrase "go-http-client" at REQUEST_HEADERS:User-Agent. (1100000-123) show less	Bad Web Bot

Showing 1 to 15 of 101 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇩🇪 87.156.176.191

🇨🇳 47.94.218.130

🇳🇱 45.142.193.223

🇺🇸 40.124.173.234

🇹🇷 31.145.131.202

🇰🇷 211.226.58.162

🇷🇺 185.236.64.166

🇧🇷 179.185.227.77

🇦🇴 154.116.254.157

🇺🇸 150.107.38.3

🇨🇳 139.170.73.10

🇨🇳 113.206.177.225

🇰🇷 112.185.48.244

🇺🇸 103.234.62.54

🇮🇳 103.211.80.154

🇦🇪 92.97.160.80

🇩🇪 69.5.169.167

🇺🇸 64.62.156.46

🇰🇾 63.167.212.86

🇳🇱 45.198.224.5