JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 37.52.240.233

37.52.240.233 was found in our database!

This IP was reported 13 times. Confidence of Abuse is 41%: ?

41%

ISP	JSC Ukrtelecom
Usage Type	Fixed Line ISP
ASN	AS6849
Hostname(s)	233-240-52-37.pool.ukrtel.net
Domain Name	ukrtelecom.ua
Country	🇺🇦 Ukraine
City	Kyiv, Kyiv City

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 37.52.240.233

Whois 37.52.240.233

IP Abuse Reports for 37.52.240.233:

This IP address has been reported a total of 13 times from 13 distinct sources. 37.52.240.233 was first reported on April 27th 2026, and the most recent report was 1 week ago.

Old Reports: The most recent abuse report for this IP address is from 1 week ago . It is possible that this IP is no longer involved in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇳🇱 nate naten	2026-10-17 15:31:58 (1 week ago)	HoneyTrap: xmlrpc attempt on /xmlrpc.php from Ukraine	Brute-Force Web App Attack
🇬🇧 consul.to	2026-10-11 13:03:32 (2 weeks ago)	Web attack/malicious scanning detected	Web App Attack
🇩🇪 NervousNiffler	2026-10-07 19:34:16 (2 weeks ago)	[PathScanning] Path scanning/probing detected: WordPress system file probe (path: /xmlrpc.php) \| [Xm ... show more [PathScanning] Path scanning/probing detected: WordPress system file probe (path: /xmlrpc.php) \| [XmlRpc] XML-RPC abuse detected: XML-RPC endpoint probe (GET) show less	Port Scan Hacking Brute-Force Web App Attack
🇬🇷 setupgr	2026-10-07 18:50:51 (2 weeks ago)	(XMLRPC) WP XMLRPC Attack 37.52.240.233 (UA/Ukraine/Kyiv City/Kyiv/-/[AS6849 JSC Ukrtelecom]): 1 in ... show more (XMLRPC) WP XMLRPC Attack 37.52.240.233 (UA/Ukraine/Kyiv City/Kyiv/-/[AS6849 JSC Ukrtelecom]): 1 in the last 86400 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: 37.52.240.233 - - [07/Oct/2026:21:46:11 +0300] "POST /xmlrpc.php HTTP/1.1" 403 18937 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Opera/68.0.0.0 Safari/537.36" show less	Port Scan
🇩🇪 4server	2026-10-05 14:36:24 (3 weeks ago)	[MonOct0516:36:22.4049532026][security2:error][pid2413507:tid2413638][client37.52.240.233:0]ModSecur ... show more [MonOct0516:36:22.4049532026][security2:error][pid2413507:tid2413638][client37.52.240.233:0]ModSecurity:Accessdeniedwithcode403\(phase1\).Stringmatch\"/xmlrpc.php\"atREQUEST_URI.[file\"/etc/apache2/conf.d/modsec_custom_rules.conf\"][line\"170\"][id\"960024\"][msg\"XML-RPCdisabled\"][hostname\"ggarchitetti.ch\"][uri\"/xmlrpc.php\"][unique_id\"asO15nr3UTmYb0KFOBJ5RAAAAQ8\"] show less	Port Scan Brute-Force Web App Attack
🇫🇮 inlink.ltd	2026-10-05 13:01:55 (3 weeks ago)	Known malicious PHP file or CMS probe	Web App Attack
🇵🇱 Budyn	2026-09-29 15:21:28 (3 weeks ago)	Automated threat detected by Budyn Honeypot Sinkhole. Attack type: WP Path Scanning (Recon). Malicio ... show more Automated threat detected by Budyn Honeypot Sinkhole. Attack type: WP Path Scanning (Recon). Malicious scanner triggered a security trap targeting emulated vulnerabilities. Evidence: HOST: goblinpot.online \| URI: /xmlrpc.php \| UA: Mozilla/5.0 (Windows NT 6.2; arm64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.0.0 Safari/537.36 \| BODY: <?xml version="1.0"?><methodCall><methodName>metaWeblog.newPost</methodName><params><param><value><string>1</string></value></param><param><value><string>32360</string></value></param><param><value><string>32360</string></value></param><param><value><struct><member><name>title</name><value><string>0xd88588e5</string></value></member><me show less	Bad Web Bot Web App Attack
Anonymous	2026-09-28 16:32:38 (4 weeks ago)	[redacted] 37.52.240.233 - - [28/Sep/2026:18:32:01 +0200] "POST /xmlrpc.php HTTP/1.1" 405 428 "-" "M ... show more [redacted] 37.52.240.233 - - [28/Sep/2026:18:32:01 +0200] "POST /xmlrpc.php HTTP/1.1" 405 428 "-" "Mozilla/5.0 (Windows NT 6.2; x86) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.0.0 Safari/537.36" [redacted] 37.52.240.233 - - [28/Sep/2026:18:32:11 +0200] "POST /xmlrpc.php HTTP/1.1" 405 428 "-" "Mozilla/5.0 (Windows NT 10.0; x64) AppleWebKit/537.36 (KHTML, like Gecko) Safari/13.0.0.0 Safari/537.36" [redacted] 37.52.240.233 - - [28/Sep/2026:18:32:20 +0200] "POST /xmlrpc.php HTTP/1.1" 405 428 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; arm64) AppleWebKit/537.36 (KHTML, like Gecko) Opera/70.0.0.0 Safari/537.36" [redacted] 37.52.240.233 - - [28/Sep/2026:18:32:29 +0200] "POST /xmlrpc.php HTTP/1.1" 405 428 "-" "Mozilla/5.0 (Windows NT 10.0; arm64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.0.0 Safari/537.36" [redacted] 37.52.240.233 - - [28/Sep/2026:18:32:37 +0200] "POST /xmlrpc.php HTTP/1.1" 405 428 "-" "Mozilla/5.0 (Windows NT 6.2; x86) Apple ... show less	Hacking Web App Attack
Anonymous	2026-09-23 17:50:09 (1 month ago)	Attempt to POST to xmlrpc.php at 2026-09-23T17:50:09+00:00	Brute-Force Web App Attack
🇩🇪 Holger	2026-09-17 16:52:31 (1 month ago)	WordPress WebAttack	Brute-Force Web App Attack
🇫🇷 Kenshin869	2026-09-16 13:26:12 (1 month ago)	Wordpress unauthorized access attempt	Brute-Force
🇩🇪 Hazzard	2026-09-12 15:26:08 (1 month ago)	(wordpress) Failed wordpress login from 37.52.240.233 (UA/Ukraine/Kyiv City/Kyiv/233-240-52-37.pool. ... show more (wordpress) Failed wordpress login from 37.52.240.233 (UA/Ukraine/Kyiv City/Kyiv/233-240-52-37.pool.ukrtel.net/[redacted]): (CF_ENABLE) show less	Brute-Force
🇺🇸 TPI-Abuse	2026-04-27 20:34:47 (5 months ago)	(mod_security) mod_security (id:225170) triggered by 37.52.240.233 (233-240-52-37.pool.ukrtel.net): ... show more (mod_security) mod_security (id:225170) triggered by 37.52.240.233 (233-240-52-37.pool.ukrtel.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Apr 27 16:34:42.454716 2026] [security2:error] [pid 21103:tid 21103] [client 37.52.240.233:58164] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)\|\|mainefirst.org\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "mainefirst.org"] [uri "/wp-json/wp/v2/users"] [unique_id "ae_IYrFUfLREIzF0aGK0OwAAABM"], referer: https://www.google.com/ show less	Brute-Force Bad Web Bot Web App Attack

Showing 1 to 13 of 13 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇨🇴 186.194.62.19

🇮🇩 116.197.132.47

🇰🇿 92.47.0.230

🇧🇬 79.124.56.138

🇪🇨 45.171.120.2

🇳🇱 45.148.10.151

🇺🇸 204.48.22.204

🇺🇸 199.165.159.22

🇺🇸 198.105.126.231

🇬🇧 193.163.125.41

🇮🇳 182.76.71.82

🇮🇩 182.4.197.9

🇮🇩 180.249.97.112

🇩🇪 69.5.169.252

🇺🇸 206.189.226.128

🇺🇸 205.210.31.25

🇳🇱 200.138.46.29

🇧🇴 200.105.172.184

🇹🇼 198.235.24.29

🇺🇸 195.184.76.12