JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 64.112.56.140

64.112.56.140 was found in our database!

This IP was reported 17 times. Confidence of Abuse is 64%: ?

64%

ISP	Nexus Bytes LLC
Usage Type	Fixed Line ISP
ASN	AS6079
Domain Name	nexusbytes.com
Country	🇺🇸 United States of America
City	Leesburg, Virginia

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 64.112.56.140

Whois 64.112.56.140

IP Abuse Reports for 64.112.56.140:

This IP address has been reported a total of 17 times from 10 distinct sources. 64.112.56.140 was first reported on July 8th 2026, and the most recent report was 11 hours ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇺🇸 ipblock.com	2026-07-10 11:50:00 (11 hours ago)	IPBlock protected site ID [4055-d][s=06]. Persistent 404, vulnerability scanner	Hacking Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-07-10 06:27:33 (16 hours ago)	(mod_security) mod_security (id:210492) triggered by 64.112.56.140 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:210492) triggered by 64.112.56.140 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jul 10 02:27:16.786789 2026] [security2:error] [pid 21868:tid 21868] [client 64.112.56.140:45231] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.caferutadelaseda.com"] [uri "/.env.bak"] [unique_id "alCQxK17X6VixSaYgHVwPAAAAA8"] show less	Brute-Force Bad Web Bot Web App Attack
🇫🇷 mikekarl	2026-07-10 04:49:17 (18 hours ago)	SQL INJECTION forms_send''	SQL Injection
🇺🇸 TPI-Abuse	2026-07-10 04:43:04 (18 hours ago)	(mod_security) mod_security (id:210492) triggered by 64.112.56.140 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:210492) triggered by 64.112.56.140 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jul 10 00:42:47.017054 2026] [security2:error] [pid 30306:tid 30306] [client 64.112.56.140:49395] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.athletefirst.org"] [uri "/.env.bak"] [unique_id "alB4R_DqwE0FplbyZY_jZAAAAB0"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-07-09 21:57:35 (1 day ago)	(mod_security) mod_security (id:210492) triggered by 64.112.56.140 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:210492) triggered by 64.112.56.140 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jul 09 17:57:08.285348 2026] [security2:error] [pid 15236:tid 15236] [client 64.112.56.140:42665] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "wryemusings.com"] [uri "/.env.dev.local"] [unique_id "alAZNG3e-ziXBNIQOlfSgAAAAAo"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 directorioeducativo.com	2026-07-09 18:04:14 (1 day ago)	GET URL: "/.env.dev"Agent: "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTM ... show more GET URL: "/.env.dev"Agent: "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36" show less	Web App Attack
🇻🇳 Xuan Can	2026-07-09 10:00:41 (1 day ago)	(mod_security) mod_security (id:1900947722) triggered by 64.112.56.140 (US/United States/-): 1 in th ... show more (mod_security) mod_security (id:1900947722) triggered by 64.112.56.140 (US/United States/-): 1 in the last 3600 secs; Ports: 80,443; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jul 09 17:00:28.867415 2026] [security2:error] [pid 27143:tid 27190] [client 64.112.56.140:0] ModSecurity: Access denied with code 403 (phase 1). String match "/phpMyAdmin" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec/modsec2.user.conf"] [line "58"] [id "1900947722"] [msg "Deny phpMyAdmin"] [hostname "www.sieuthimaychu.vn"] [uri "/phpMyAdmin-2.2.3/"] [unique_id "ak9xPNig7HX2eHiaOv_FlwAAAFQ"] show less	Brute-Force SSH
🇩🇪 stinpriza	2026-07-09 09:21:45 (1 day ago)	Drupal Authentication failure	Brute-Force Web App Attack
🇨🇭 backslash	2026-07-09 08:27:08 (1 day ago)		Web App Attack
🇭🇺 bcsaba	2026-07-09 08:01:45 (1 day ago)	Probing for .env file: 64.112.56.140 - - [09/Jul/2026:10:01:00 +0200] "GET /.env.dev.local HTTP/2.0" ... show more Probing for .env file: 64.112.56.140 - - [09/Jul/2026:10:01:00 +0200] "GET /.env.dev.local HTTP/2.0" 403 548 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36" show less	Web App Attack
🇺🇸 TPI-Abuse	2026-07-09 07:17:50 (1 day ago)	(mod_security) mod_security (id:210492) triggered by 64.112.56.140 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:210492) triggered by 64.112.56.140 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jul 09 03:17:30.632899 2026] [security2:error] [pid 819906:tid 819906] [client 64.112.56.140:52033] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "psdinnersready.com"] [uri "/.env"] [unique_id "ak9LColzOF5_pcMLG_c1jAAAAA8"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-07-09 04:18:38 (1 day ago)	(mod_security) mod_security (id:211190) triggered by 64.112.56.140 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:211190) triggered by 64.112.56.140 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jul 09 00:18:18.468557 2026] [security2:error] [pid 28764:tid 28933] [client 64.112.56.140:40807] ModSecurity: Access denied with code 403 (phase 2). Match of "contains cpanel" against "REQUEST_URI" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "55"] [id "211190"] [rev "9"] [msg "COMODO WAF: Remote File Access Attempt\|\|www.adultbaja.com\|F\|2"] [data "Matched Data: /etc/ found within REQUEST_URI: /index.php?option=com_biblestudy&id=1&view=studieslist&controller=../../../../../../../../etc/passwd"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.adultbaja.com"] [uri "/index.php"] [unique_id "ak8hCvOvMKT8-UyubSD1NgAAAco"] show less	Brute-Force Bad Web Bot Web App Attack
🇩🇪 Bedios GmbH	2026-07-09 04:02:01 (1 day ago)	Login credentials theft attempt	Hacking
🇨🇦 polycoda	2026-07-08 23:42:07 (1 day ago)	🥶 Part of a DDoS attack wave	DDoS Attack
🇨🇦 polycoda	2026-07-08 21:48:26 (2 days ago)	🥶 Part of massive botnet scraping campaign that nearly turned into a DDoS on 2025-11-27	DDoS Attack

Showing 1 to 15 of 17 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇳🇱 45.148.10.151

🇻🇳 171.231.195.224

🇺🇸 107.172.168.193

🇺🇸 81.30.98.204

🇮🇱 2.55.84.240

🇪🇪 196.196.253.20

🇳🇱 195.178.110.217

🇺🇸 192.163.244.125

🇨🇳 183.215.27.197

🇮🇳 182.95.101.182

🇺🇸 40.124.179.77

🇨🇳 36.26.74.162

🇨🇳 119.179.250.111

🇻🇳 117.5.152.164

🇺🇸 44.215.197.235

🇧🇪 34.78.243.65

🇧🇷 205.210.31.236

🇪🇹 196.189.116.182

🇮🇳 122.180.242.27

🇷🇴 80.94.95.211