JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 37.140.254.205

37.140.254.205 was found in our database!

This IP was reported 91 times. Confidence of Abuse is 27%: ?

27%

ISP	VPN Consumer Network Services
Usage Type	Data Center/Web Hosting/Transit
ASN	AS206092
Domain Name	vpnconsumer.com
Country	🇨🇭 Switzerland
City	Oberhausen-Boschenwiesen, Zurich

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 37.140.254.205

Whois 37.140.254.205

IP Abuse Reports for 37.140.254.205:

This IP address has been reported a total of 91 times from 48 distinct sources. 37.140.254.205 was first reported on September 6th 2023, and the most recent report was 2 days ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇨🇭 4server	2026-08-26 22:23:42 (2 days ago)	[ThuAug2700:23:34.8480472026][security2:error][pid2209236:tid2210262][client37.140.254.205:0]ModSecu ... show more [ThuAug2700:23:34.8480472026][security2:error][pid2209236:tid2210262][client37.140.254.205:0]ModSecurity:Accessdeniedwithcode403\(phase2\).Patternmatch\"modules/mod_simplefileuploadv1\\\\\\\\.3\"atREQUEST_URI.[file\"/etc/apache2/conf.d/modsec_rules/99_asl_jitp.conf\"][line\"640\"][id\"390746\"][rev\"1\"][msg\"Atomicorp.comWAFRules-VirtualJustInTimePatch:KnownVulnerableJoomlaSimpleFileUploadv1.3Accessblocked\"][hostname\"leonitraslochi.ch\"][uri\"/modules/mod_simplefileuploadv1.3/elements/filemanager.php\"][unique_id\"ao9nZikCMXj6VWFF3Y5qDwAAAUE\"] show less	Hacking Web App Attack
🇯🇵 demonsword	2026-08-02 13:06:44 (3 weeks ago)	Detected by SentinelX honeypot: sent HTTP CONNECT request probing for an open proxy. Connection was ... show more Detected by SentinelX honeypot: sent HTTP CONNECT request probing for an open proxy. Connection was hijacked and held in a tarpit to slow down the scan. Probed target: account.jetbrains.com:443 show less	Open Proxy Port Scan
🇺🇸 OceanTreasure	2026-07-31 08:17:22 (4 weeks ago)	tcp/443; Archivarix CMS web shell target: "GET /archivarix.cms.php" @ 2026-07-31T08:11:07Z [proxy]	Brute-Force
🇨🇭 YF	2026-07-31 08:00:36 (4 weeks ago)	Distributed subnet attack — coordinated scanning from multiple IPs in the same /24	DDoS Attack Web App Attack
🇫🇷 masterguru	2026-07-29 14:31:14 (4 weeks ago)	(modsec_5015) ModSec 5015: Suspicious User-Agent from 37.140.254.205 (CH/Switzerland/-): 1 in the la ... show more (modsec_5015) ModSec 5015: Suspicious User-Agent from 37.140.254.205 (CH/Switzerland/-): 1 in the last 3600 secs (0-195) show less	Hacking
🇫🇷 masterguru	2026-07-29 02:02:09 (1 month ago)	(modsec_5015) ModSec 5015: Suspicious User-Agent from 37.140.254.205 (CH/Switzerland/-): 1 in the la ... show more (modsec_5015) ModSec 5015: Suspicious User-Agent from 37.140.254.205 (CH/Switzerland/-): 1 in the last 3600 secs (0-196) show less	Hacking
🇩🇪 Carsten	2026-07-29 01:56:10 (1 month ago)	GET [archivarix.cms.php]	Port Scan
🇨🇦 TechnoSolutions CL	2026-06-13 11:31:28 (2 months ago)	37.140.254.205 - - [13/Jun/2026:11:31:26 +0000] "GET /wp-admin/includes/admin.php HTTP/1.1" 405 552 ... show more 37.140.254.205 - - [13/Jun/2026:11:31:26 +0000] "GET /wp-admin/includes/admin.php HTTP/1.1" 405 552 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.3" 37.140.254.205 - - [13/Jun/2026:11:31:27 +0000] "GET /wp-admin/user/upgrade/ HTTP/1.1" 405 552 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.3" 37.140.254.205 - - [13/Jun/2026:11:31:27 +0000] "GET /wp-content/languages/ HTTP/1.1" 405 552 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.3" 37.140.254.205 - - [13/Jun/2026:11:31:28 +0000] "GET /wp-admin/images/ HTTP/1.1" 405 552 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.3" ... show less	Hacking Brute-Force Web App Attack
🇺🇸 nyt	2026-05-20 12:57:27 (3 months ago)	404 flood (16/60s), 404 flood (17/60s)	Bad Web Bot Web App Attack
🇫🇷 IRISIO	2026-05-20 08:42:59 (3 months ago)	scans/SQL injection/spam posts : 39 queries	Web App Attack SQL Injection
🇺🇸 Major Hostility	2026-04-29 02:09:50 (4 months ago)	"GET /wp-includes/functions.wp-scripts-call.php HTTP/1.1" 404 "GET /wp-admin/includes/class-pclzip-q ... show more "GET /wp-includes/functions.wp-scripts-call.php HTTP/1.1" 404 "GET /wp-admin/includes/class-pclzip-query.php HTTP/1.1" 404 "GET /wp-includes/l10n/class-wp-translations-library.php HTTP/1.1" 404 "GET /wp-content/themes/twentytwentyfour/patterns/content-type.php HTTP/1.1" 404 "GET /wp-includes/widgets/class-wp-widget-search-interpreter.php HTTP/1.1" 404 "GET /wp-admin/includes/class-theme-upgrader-skin-json.php HTTP/1.1" 404 "GET /wp-includes/customize/class-wp-customize-header-image-control-list.php HTTP/1.1" 404 "GET /wp-includes/SimplePie/Cache-queue.php HTTP/1.1" 404 "GET /wp-content/plugins/wpcall-button/admin.php HTTP/1.1" 404 "GET /wp-includes/class-wp-network-query-stat.php HTTP/1.1" 404 "GET /wp-includes/customize/class-wp-customize-new-menu-control-firewall.php HTTP%2 show less	Web App Attack
🇫🇷 dynamix	2026-04-28 23:59:41 (4 months ago)	Multiple WAF Violations	Web App Attack
🇲🇾 Rizzy	2026-04-28 20:11:15 (4 months ago)	Multiple WAF Violations	Brute-Force Web App Attack
🇺🇦 URAN Publishing Service	2026-04-27 09:56:07 (4 months ago)	37.140.254.205 - - [27/Apr/2026:12:56:05 +0300] "GET /wp-includes/ID3/class-config.php HTTP/1.1" 404 ... show more 37.140.254.205 - - [27/Apr/2026:12:56:05 +0300] "GET /wp-includes/ID3/class-config.php HTTP/1.1" 404 709 "-" "Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/72.0.3626.121 Safari/537.36" 37.140.254.205 - - [27/Apr/2026:12:56:06 +0300] "GET /wp-admin/maint/go.php HTTP/1.1" 404 709 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/84.0.4147.125 Safari/537.36" ... show less	Web App Attack
🇺🇸 TPI-Abuse	2026-04-26 19:34:41 (4 months ago)	(mod_security) mod_security (id:222160) triggered by 37.140.254.205 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:222160) triggered by 37.140.254.205 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Apr 26 15:34:38.291135 2026] [security2:error] [pid 11606:tid 11606] [client 37.140.254.205:44013] ModSecurity: Access denied with code 403 (phase 1). String match "wp-content/plugins/wp-easycart/inc/admin/phpinfo.php" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/27_Apps_WPPlugin.conf"] [line "6347"] [id "222160"] [rev "1"] [msg "COMODO WAF: Information disclosure vulnerability in The EasyCart plugin before 2.0.6 for WordPress (CVE-2014-4942)\|\|lexie.org\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WPPlugin"] [hostname "lexie.org"] [uri "/wp-content/plugins/wp-easycart/inc/admin/phpinfo.php"] [unique_id "ae5oztqiBmAY4i9skTID7gAAAAU"] show less	Brute-Force Bad Web Bot Web App Attack

Showing 1 to 15 of 91 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇧🇷 205.210.31.177

🇵🇰 182.186.45.147

🇦🇷 181.110.193.76

🇨🇳 111.225.214.143

🇳🇱 91.92.40.200

🇭🇰 74.125.179.156

🇩🇪 69.5.169.82

🇸🇬 68.183.233.239

🇭🇰 2.26.201.104

🇧🇪 198.235.24.163

🇬🇧 185.122.141.219

🇮🇳 182.59.224.65

🇲🇳 180.149.125.162

🇸🇬 159.223.53.238

🇹🇼 110.24.32.16

🇳🇱 91.92.40.42

🇸🇬 84.75.148.28

🇵🇭 61.28.144.154

🇵🇰 59.103.216.94

🇺🇸 57.141.20.12