JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 37.19.65.200

37.19.65.200 was found in our database!

This IP was reported 45 times. Confidence of Abuse is 100%: ?

100%

ISP	siaIT d.o.o.
Usage Type	Fixed Line ISP
ASN	AS22773
Domain Name	siait.si
Country	🇺🇸 United States of America
City	Camp Hill, Pennsylvania

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 37.19.65.200

Whois 37.19.65.200

IP Abuse Reports for 37.19.65.200:

This IP address has been reported a total of 45 times from 37 distinct sources. 37.19.65.200 was first reported on December 3rd 2025, and the most recent report was 1 hour ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇩🇪 Grossmann-Gruppe	2026-10-23 16:23:33 (1 hour ago)	Plesk Fail2Ban: plesk-modsecurity	Hacking Brute-Force
🇺🇸 Sockets-AR	2026-10-23 14:40:46 (3 hours ago)	CrowdSec: sensitive file probing detected (crowdsecurity/http-sensitive-files) at 2026-10-23T14:40:4 ... show more CrowdSec: sensitive file probing detected (crowdsecurity/http-sensitive-files) at 2026-10-23T14:40:45.298Z show less	Web App Attack
🇺🇸 TPI-Abuse	2026-10-23 12:02:28 (5 hours ago)	(mod_security) mod_security (id:210492) triggered by 37.19.65.200 (-): 1 in the last 300 secs; Ports ... show more (mod_security) mod_security (id:210492) triggered by 37.19.65.200 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 23 08:02:24.519112 2026] [security2:error] [pid 23884:tid 23884] [client 37.19.65.200:0] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "autodiscover.nyemdr.com"] [uri "/.env.staging"] [unique_id "attM0GflON0XP_d2uQeVEwAAAD0"] show less	Brute-Force Bad Web Bot Web App Attack
Anonymous	2026-10-23 11:14:03 (6 hours ago)	Bot / scanning and/or hacking attempts: GET /application-dev.yml HTTP/1.1, GET /local_settings.py HT ... show more Bot / scanning and/or hacking attempts: GET /application-dev.yml HTTP/1.1, GET /local_settings.py HTTP/1.1, GET /app/.env HTTP/1.1, GET /api/v1/config/ HTTP/1.1, GET /.claude/agents/index.md HTTP/1.1, GET /aws-bedrock.json HTTP/1.1, GET /settings.json HTTP/1.1, GET /crm/.env HTTP/1.1, GET /google-ai.json HTTP/1.1, GET /.env.backup HTTP/1.1, GET /credentials.json HTTP/1.1, GET /application.yml HTTP/1.1, GET /config/database.yml HTTP/1.1, GET /old/.env HTTP/1.1, GET /config.php HTTP/1.1, GET /config.js HTTP/1.1, GET /config/runtime-env.js HTTP/1.1, GET /secrets HTTP/1.1, GET /settings.py HTTP/1.1, GET /.git/refs/heads/main HTTP/1.1 show less	Hacking Web App Attack
🇳🇱 debestelapp	2026-10-23 09:20:09 (8 hours ago)		Web App Attack
🇩🇪 ger-stg-sifi1	2026-10-23 08:56:01 (8 hours ago)	(wordpress) Failed wordpress login using wp-login.php or xmlrpc.php	Web App Attack
🇵🇱 Budyn	2026-10-23 07:12:06 (10 hours ago)	Automated threat detected by Budyn Honeypot Sinkhole. Attack type: CRITICAL: ModSecurity WAF Exploit ... show more Automated threat detected by Budyn Honeypot Sinkhole. Attack type: CRITICAL: ModSecurity WAF Exploit Block. Malicious scanner triggered a security trap targeting emulated vulnerabilities. Evidence: HOST: astropot.space \| URI: /.env \| UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 \| BODY: [Empty / GET Request] \| HEADERS: {"Connection":"Keep-Alive","X-Forwarded-Proto":"https","Cf-Visitor":"{\"scheme\":\"https\"}","Cf-Ipcountry":"US","Cf-Connecting-Ip":"37.19.65.200","Cdn-Loop":"cloudflare; loops=1","Sec-Fetch-Site":"none","Accept":"text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/avif,image\/webp,image\/apng, show less	Hacking Web App Attack
🇫🇷 masterguru	2026-10-23 06:52:40 (11 hours ago)	Restricted File Access Attempt. Matched phrase ".env" at REQUEST_FILENAME. (930130-193)	Hacking Web App Attack
🇺🇸 Rocky Mountain Bioengineering Symposium	2026-10-23 05:48:52 (12 hours ago)	[Thu Oct 22 23:48:52.107900 2026] [authz_core:error] [pid 94041:tid 140148055209536] [client 37.19.6 ... show more [Thu Oct 22 23:48:52.107900 2026] [authz_core:error] [pid 94041:tid 140148055209536] [client 37.19.65.200:42955] AH01630: client denied by server configuration: /var/www/horde/data.sql [Thu Oct 22 23:48:52.109316 2026] [authz_core:error] [pid 94041:tid 140148030031424] [client 37.19.65.200:42955] AH01630: client denied by server configuration: /var/www/horde/backup.sql [Thu Oct 22 23:48:52.109657 2026] [authz_core:error] [pid 94041:tid 140148055209536] [client 37.19.65.200:42955] AH01630: client denied by server configuration: /var/www/horde/db_backup.sql ... show less	Bad Web Bot
🇵🇱 strefapi_com	2026-10-23 05:19:52 (12 hours ago)	Brute-force, web ...	Hacking Brute-Force Web App Attack
🇩🇪 curiosity	2026-10-23 04:06:22 (13 hours ago)	This IP was detected by CrowdSec triggering crowdsecurity/http-cve-probing	Web App Attack Hacking
🇳🇱 Alt255	2026-10-23 03:38:32 (14 hours ago)	[ti-tinov] Web exploit scanning: 1 suspicious requests detected by fail2ban jail <name>. Example: 37 ... show more [ti-tinov] Web exploit scanning: 1 suspicious requests detected by fail2ban jail <name>. Example: 37.19.65.200 - - \[23/Oct/2026:05:38:25 +0200\] "GET /.env HTTP/1.1" 404 2121 "-" "Mozilla/5.0 $Windows NT 10.0\; Win64\; x64$ AppleWebKit/537.36 $KHTML, like Gecko$ Chrome/152.0.0.0 Safari/537.36" ... show less	Bad Web Bot Web App Attack
🇩🇪 4server	2026-10-23 02:38:16 (15 hours ago)	[FriOct2304:38:09.8442522026][security2:error][pid1989988:tid1990136][client37.19.65.200:0]ModSecuri ... show more [FriOct2304:38:09.8442522026][security2:error][pid1989988:tid1990136][client37.19.65.200:0]ModSecurity:Accessdeniedwithcode403$phase2$.Patternmatch\"$\?:\\\\\\\\b\(\?:\\\\\\\\.\(\?:ht\(\?:access\\|passwd\\|group$\\|www_\?acl\)\\|global\\\\\\\\.asa\\|httpd\\\\\\\\.conf\\|boot\\\\\\\\.ini\\|web.config\)\\\\\\\\b\\|$\\|\^\\|\\\\\\\\.\\\\\\\\.$/etc/\\|/\\\\\\\\.$\?:history\\|bash_history\\|sh_history\\|env$\$\)\"atREQUEST_FILENAME.[file\"/etc/apache2/conf.d/modsec_rules/10_asl_rules.conf\"][line\"204\"][id\"390709\"][rev\"30\"][msg\"Atomicorp.comWAFRules:Attempttoaccessprotectedfileremotely\"][data\"/.env\"][severity\"CRITICAL\"][hostname\"autoconfig.creazione-siti-web-ticino.ch\"][uri\"/.env\"][unique_id\"atrIkatSMFfi62heM_mR9wAAAVM\"] show less	Port Scan Brute-Force Web App Attack
🇳🇱 Site.eu	2026-10-23 02:11:01 (15 hours ago)	Excessive 404/403 errors	Brute-Force
🇮🇹 VHosting	2026-10-23 02:05:05 (15 hours ago)	Detected WordPress attack from different servers	Brute-Force Web App Attack

Showing 1 to 15 of 45 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇨🇳 219.159.79.49

🇸🇬 103.189.234.27

🇷🇴 89.121.255.194

🇳🇱 77.91.71.90

🇺🇸 66.132.186.229

🇯🇵 34.97.120.17

🇳🇱 195.128.162.35

🇺🇸 193.56.116.54

🇲🇽 189.182.250.115

🇬🇧 154.16.44.56

🇨🇳 183.56.216.153

🇺🇸 172.71.255.52

🇮🇩 36.67.227.241

🇧🇷 187.91.166.143

🇵🇦 179.43.153.2

🇳🇱 142.93.228.104

🇩🇪 139.59.213.126

🇷🇴 92.118.39.58

🇩🇿 41.99.101.24

🇳🇱 23.97.182.38