JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 45.139.252.21

45.139.252.21 was found in our database!

This IP was reported 175 times. Confidence of Abuse is 7%: ?

ISP	Cyberzone S.A.
Usage Type	Data Center/Web Hosting/Transit
ASN	AS209854
Domain Name	cyberzonehub.com
Country	🇮🇸 Iceland
City	Reykjavik, Capital Region

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 45.139.252.21

Whois 45.139.252.21

IP Abuse Reports for 45.139.252.21:

This IP address has been reported a total of 175 times from 87 distinct sources. 45.139.252.21 was first reported on April 25th 2023, and the most recent report was 1 month ago.

Old Reports: The most recent abuse report for this IP address is from 1 month ago . It is possible that this IP is no longer involved in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇳🇱 NSCA-ISEU	2026-06-18 06:34:03 (1 month ago)	Nmap Scripting Engine Scanner Over HTTP Request - Cyberzone S.A. Abused VPN Service. VT: Mali ... show more Nmap Scripting Engine Scanner Over HTTP Request - Cyberzone S.A. Abused VPN Service. VT: Malicious: 3 - Suspicious: 3. AS209854 Cyberzone S.A.. Org: Cyberzone S.A show less	Web App Attack Port Scan VPN IP Exploited Host Hacking Email Spam
🇺🇦 URAN Publishing Service	2026-06-10 10:33:56 (1 month ago)	45.139.252.21 - - [10/Jun/2026:13:33:55 +0300] "GET /wp-admin/ckeditor/filemanager/browser/default/b ... show more 45.139.252.21 - - [10/Jun/2026:13:33:55 +0300] "GET /wp-admin/ckeditor/filemanager/browser/default/browser.html HTTP/1.1" 404 769 "-" "Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0)" 45.139.252.21 - - [10/Jun/2026:13:33:56 +0300] "GET /wp-content/ckeditor/filemanager/browser/default/browser.html HTTP/1.1" 404 769 "-" "Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0)" ... show less	Web App Attack
🇩🇪 LRob	2026-05-08 03:30:08 (2 months ago)	WordPress login brute-force detected by Fail2Ban in plesk-wordpress jail	Brute-Force Web App Attack
🇩🇪 Prepaid-Host.com	2026-05-07 22:36:55 (2 months ago)	Web Exploit detected \| Events: 15 \| First seen: 2026-05-07 22:36 UTC \| Last seen: 2026-05-07 22:36 U ... show more Web Exploit detected \| Events: 15 \| First seen: 2026-05-07 22:36 UTC \| Last seen: 2026-05-07 22:36 UTC \| Sample: Web Exploit detected by fail2ban jail 'plesk-wordpress': 15 failed attempt(s) from 45.139.252.21 Web Exploit detected by fail2ban jail 'plesk-wordpress': 15 failed attempt(s) from 45.139.252.21 show less	Web App Attack
🇩🇪 grassau.com	2026-05-07 17:37:10 (2 months ago)	(wordpress) Failed wordpress login from 45.139.252.21 (IS/Iceland/Reykjavíkurborg/Reykjavik/-)	Brute-Force
🇬🇧 consul.to	2026-05-07 11:56:33 (2 months ago)	Web attack/malicious scanning detected	Web App Attack
🇳🇱 BlueWire Hosting	2026-05-07 11:39:04 (2 months ago)	Probing websites for vulnerabilities	Web App Attack
🇺🇸 rsiddall	2026-05-07 11:20:48 (2 months ago)	45.139.252.21 - - [07/May/2026:07:20:41 -0400] "POST /wp-login.php HTTP/1.1" 403 1809 "https://crf-l ... show more 45.139.252.21 - - [07/May/2026:07:20:41 -0400] "POST /wp-login.php HTTP/1.1" 403 1809 "https://crf-llc.com/wp-login.php" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.2 Safari/605.1.15" 45.139.252.21 - - [07/May/2026:07:20:43 -0400] "POST /wp-login.php HTTP/1.1" 403 1809 "https://crf-llc.com/wp-login.php" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36" 45.139.252.21 - - [07/May/2026:07:20:44 -0400] "POST /wp-login.php HTTP/1.1" 403 1809 "https://crf-llc.com/wp-login.php" "Mozilla/5.0 (Macintosh; Intel Mac OS X 13_6_1) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.6 Safari/605.1.15" 45.139.252.21 - - [07/May/2026:07:20:45 -0400] "POST /wp-login.php HTTP/1.1" 403 1809 "https://crf-llc.com/wp-login.php" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36" 45.139.252.21 - - [07/May/2026:07:20:46 -0400] "POST ... show less	Brute-Force
🇷🇺 Agrohim	2026-04-24 05:14:23 (2 months ago)	Gate Inet blocked for categories:	DDoS Attack Ping of Death Port Scan Hacking Brute-Force
🇬🇧 consul.to	2026-04-07 06:03:02 (3 months ago)	Web attack/malicious scanning detected	Web App Attack
🇳🇱 Mangelot Hosting	2026-04-07 02:40:53 (3 months ago)	(upload_shell) srv103 Shell upload 45.139.252.21 (IS/Iceland/-): 1 in the last 3600 secs; Ports: ; ... show more (upload_shell) srv103 Shell upload 45.139.252.21 (IS/Iceland/-): 1 in the last 3600 secs; Ports: ; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: show less	Web App Attack
🇺🇸 TPI-Abuse	2026-04-07 02:20:51 (3 months ago)	(mod_security) mod_security (id:240000) triggered by 45.139.252.21 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:240000) triggered by 45.139.252.21 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Apr 06 22:20:45.754631 2026] [security2:error] [pid 769427:tid 769427] [client 45.139.252.21:50286] ModSecurity: Access denied with code 403 (phase 2). String match ".php" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/24_Apps_Joomla.conf"] [line "74"] [id "240000"] [rev "1"] [msg "COMODO WAF: Protecting Joomla folder\|\|offbeatcompassion.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "Joomla"] [hostname "offbeatcompassion.com"] [uri "/images/stories/themes.php"] [unique_id "adRp_bUa023JP7Gy2h7j6QAAABg"] show less	Brute-Force Bad Web Bot Web App Attack
🇧🇪 cmbplf	2026-04-06 23:32:58 (3 months ago)	206 requests with url.path /.well-known/acme-challenge/.php	Brute-Force Bad Web Bot
🇺🇸 TPI-Abuse	2026-04-06 21:21:20 (3 months ago)	(mod_security) mod_security (id:240000) triggered by 45.139.252.21 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:240000) triggered by 45.139.252.21 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Apr 06 17:21:12.415109 2026] [security2:error] [pid 1045807:tid 1045807] [client 45.139.252.21:58802] ModSecurity: Access denied with code 403 (phase 2). String match ".php" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/24_Apps_Joomla.conf"] [line "74"] [id "240000"] [rev "1"] [msg "COMODO WAF: Protecting Joomla folder\|\|collegecheating.net\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "Joomla"] [hostname "collegecheating.net"] [uri "/images/stories/themes.php"] [unique_id "adQjyH-CiHu-sDXA29fe4QAAABk"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-04-06 17:02:46 (3 months ago)	(mod_security) mod_security (id:240000) triggered by 45.139.252.21 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:240000) triggered by 45.139.252.21 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Apr 06 13:02:40.424178 2026] [security2:error] [pid 416233:tid 416233] [client 45.139.252.21:50834] ModSecurity: Access denied with code 403 (phase 2). String match ".php" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/24_Apps_Joomla.conf"] [line "74"] [id "240000"] [rev "1"] [msg "COMODO WAF: Protecting Joomla folder\|\|jangamble.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "Joomla"] [hostname "jangamble.com"] [uri "/images/stories/themes.php"] [unique_id "adPnMBdVygQfHbyS7mMXDQAAAAc"] show less	Brute-Force Bad Web Bot Web App Attack

Showing 1 to 15 of 175 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇲🇽 187.230.22.130

🇨🇴 186.96.105.227

🇫🇮 147.185.133.10

🇨🇳 117.72.35.56

🇵🇰 110.38.198.229

🇵🇰 110.37.95.146

🇳🇱 91.92.40.46

🇨🇦 85.217.149.73

🇺🇸 72.14.178.148

🇵🇱 54.37.235.85

🇻🇳 42.1.65.123

🇩🇪 116.202.13.21

🇵🇰 110.36.77.148

🇺🇸 65.49.20.69

🇧🇷 45.234.40.2

🇺🇸 34.135.200.178

🇺🇸 20.65.193.168

🇺🇸 2620:171:fc:f0::6

🇲🇽 189.161.43.93

🇧🇷 186.193.29.34