JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 40.75.131.16

40.75.131.16 was found in our database!

This IP was reported 40 times. Confidence of Abuse is 100%: ?

100%

ISP	Microsoft Corporation
Usage Type	Data Center/Web Hosting/Transit
ASN	AS8075
Domain Name	microsoft.com
Country	🇺🇸 United States of America
City	San Jose, California

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 40.75.131.16

Whois 40.75.131.16

IP Abuse Reports for 40.75.131.16:

This IP address has been reported a total of 40 times from 34 distinct sources. 40.75.131.16 was first reported on May 27th 2026, and the most recent report was 5 hours ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇩🇪 Hugopvigo	2026-06-04 21:14:05 (5 hours ago)	"2026-06-04 21:14:05+00:00 40.75.131.16 IP con score alto (100) detectada en el log."	Brute-Force SSH
🇸🇬 securejdprop	2026-06-04 13:07:17 (13 hours ago)	This IP was detected by CrowdSec triggering crowdsecurity/http-probing. crowdsecurity/http-probing	Hacking Web App Attack
🇩🇪 kommunos	2026-06-04 11:54:19 (14 hours ago)	/wp/xmlrpc.php	Web App Attack
🇺🇸 TPI-Abuse	2026-06-04 11:50:07 (14 hours ago)	(mod_security) mod_security (id:240335) triggered by 40.75.131.16 (-): 1 in the last 300 secs; Ports ... show more (mod_security) mod_security (id:240335) triggered by 40.75.131.16 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jun 04 07:49:58.034664 2026] [security2:error] [pid 4382:tid 4382] [client 40.75.131.16:61583] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 40.75.131.16 (+1 hits since last alert)\|mathewsdental.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "mathewsdental.com"] [uri "/wp/xmlrpc.php"] [unique_id "aiFmZnEraKn_QBpNSzzIeQAAAAU"] show less	Brute-Force Bad Web Bot Web App Attack
Anonymous	2026-06-04 11:35:21 (15 hours ago)	Backdrop CMS module - malicious activity detected	Bad Web Bot Web App Attack
Anonymous	2026-06-04 11:28:11 (15 hours ago)	40.75.131.16 - - [04/Jun/2026:11:28:11 +0000] "POST /wp/xmlrpc.php HTTP/1.1" 404 2818 "-" "Mozilla/5 ... show more 40.75.131.16 - - [04/Jun/2026:11:28:11 +0000] "POST /wp/xmlrpc.php HTTP/1.1" 404 2818 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36" ... show less	Bad Web Bot Web App Attack
🇬🇧 sonot	2026-06-04 11:27:22 (15 hours ago)	Blocked by UFW on tunneluk01 [443/tcp] Source port: 60683 TTL: 107 Packet length: 40 TOS: 0x00 This ... show more Blocked by UFW on tunneluk01 [443/tcp] Source port: 60683 TTL: 107 Packet length: 40 TOS: 0x00 This report was generated by: https://github.com/sefinek/UFW-AbuseIPDB-Reporter show less	Port Scan
🇳🇿 Tripwire	2026-06-04 11:19:56 (15 hours ago)	Probing for Wordpress - /wp/xmlrpc.php	Brute-Force Web App Attack
🇺🇸 TPI-Abuse	2026-06-04 11:12:14 (15 hours ago)	(mod_security) mod_security (id:240335) triggered by 40.75.131.16 (-): 1 in the last 300 secs; Ports ... show more (mod_security) mod_security (id:240335) triggered by 40.75.131.16 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jun 04 07:12:08.812051 2026] [security2:error] [pid 5180:tid 5180] [client 40.75.131.16:60697] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 40.75.131.16 (+1 hits since last alert)\|isjustabitch.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "isjustabitch.com"] [uri "/wp/xmlrpc.php"] [unique_id "aiFdiLcV0DkylnG72ybOKQAAAA4"] show less	Brute-Force Bad Web Bot Web App Attack
🇩🇪 pltcldvlpr	2026-06-04 11:06:35 (15 hours ago)	CMS/framework probe: 40.75.131.16 - - [04/Jun/2026:13:06:35 +0200] "POST /wp/xmlrpc.php HTTP/1.1" 40 ... show more CMS/framework probe: 40.75.131.16 - - [04/Jun/2026:13:06:35 +0200] "POST /wp/xmlrpc.php HTTP/1.1" 404 564 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36" asn=8075 org="Microsoft Corporation" country=US ... show less	Web App Attack
🇨🇦 polycoda	2026-06-04 11:04:33 (15 hours ago)	🔑 Probes for xmlrpc.php everywhere	Hacking Web App Attack
Anonymous	2026-06-04 10:54:11 (15 hours ago)	40.75.131.16 - - [04/Jun/2026:18:54:11 +0800] "POST /wp/xmlrpc.php HTTP/1.1" 404 196 "-" "Mozilla/5. ... show more 40.75.131.16 - - [04/Jun/2026:18:54:11 +0800] "POST /wp/xmlrpc.php HTTP/1.1" 404 196 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36" ... show less	Bad Web Bot Web App Attack
🇺🇸 interbiznw.com	2026-06-04 10:47:47 (15 hours ago)	malicious-web-requests-vulnerability-scanning	Hacking Brute-Force Exploited Host Web App Attack
🇺🇸 kosada.com	2026-06-04 10:30:07 (16 hours ago)	Web vulnerability probing: /wp/xmlrpc.php	Web App Attack
🇺🇦 URAN Publishing Service	2026-06-04 10:28:59 (16 hours ago)	40.75.131.16 - - [04/Jun/2026:13:27:33 +0300] "POST /wp/xmlrpc.php HTTP/1.1" 404 3307 "-" "Mozilla/5 ... show more 40.75.131.16 - - [04/Jun/2026:13:27:33 +0300] "POST /wp/xmlrpc.php HTTP/1.1" 404 3307 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36" 40.75.131.16 - - [04/Jun/2026:13:28:58 +0300] "POST /wp/xmlrpc.php HTTP/1.1" 404 3297 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36" ... show less	Web App Attack

Showing 1 to 15 of 40 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇧🇷 2804:187c:84dd:2b00:4580:2c68:d035:65ac

🇨🇳 222.186.42.147

🇨🇳 221.233.50.238

🇺🇸 185.180.141.12

🇺🇸 184.105.139.67

🇧🇷 177.76.134.111

🇫🇷 176.125.224.179

🇷🇴 80.94.92.186

🇺🇸 65.49.1.192

🇸🇬 43.134.110.104

🇺🇸 34.68.33.46

🇺🇸 2602:fb54:1400::1e8

🇨🇳 222.174.65.38

🇺🇸 216.25.89.156

🇳🇱 192.142.24.7

🇺🇸 185.226.198.7

🇺🇸 184.105.139.75

🇸🇳 154.125.101.247

🇻🇳 103.77.246.174

🇳🇬 102.88.137.213