JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

94.140.231.15

Recent Activity

Abuse Confidence Score

44% Elevated

11 reports

10 reporters · latest 1 day ago

ISP: CityLink Ltd ISP
Usage Type: Fixed Line ISP
ASN: AS47236
Hostname(s): ip-94-140-231-15.citylink.pro
Domain Name: citylink.pro
Country: 🇷🇺 Russian Federation
City: Kostomuksha, Karelia

ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report Whois

Example preview

Account required for the enhanced features Log in Sign up

Abuse Reports

Export reports CSV

Total reports

11 from 10 distinct reporters

First reported

November 9th 2024

Most recent report

1 day ago

Last 60 days

Top reporter locations 🇺🇸 United States of America 3 🇨🇿 Czechia 2 🇩🇪 Germany 1

Most common categories Web App Attack 8 Brute-Force 6 Bad Web Bot 4 Hacking 3 VPN IP 1

Recent reports We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇩🇪 thesimonmanuel	2026-11-12 12:37:34 UTC · (1 day ago)	94.140.231.15 - admin [12/Nov/2026:18:07:33 +0530] "GET /wp-json/wp/v2/users/me HTTP/2.0" 200 1234 "-" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/155.0.0.0 Mobile Safari/537.36" "-"	Web App Attack
Anonymous	2026-11-05 17:56:03 UTC · (1 week ago)	Bot / scanning and/or hacking attempts: POST /xmlrpc.php HTTP/2.0	Hacking Web App Attack
🇨🇿 Countryman	2026-11-05 01:10:01 UTC · (1 week ago)	repeated unauthorized VPN login attempt, user sweep	VPN IP Hacking Brute-Force
🇮🇹 Inartis	2026-11-04 12:08:11 UTC · (1 week ago)	94.140.231.15 - - [04/Nov/2026:13:08:11 +0100] "POST /api/graphql HTTP/2.0" 403 17081 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36" ...	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-11-04 07:40:57 UTC · (1 week ago)	(mod_security) mod_security (id:225170) triggered by 94.140.231.15 (ip-94-140-231-15.citylink.pro): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 04 02:40:50.780048 2026] [security2:error] [pid 558809:tid 558994] ... show more (mod_security) mod_security (id:225170) triggered by 94.140.231.15 (ip-94-140-231-15.citylink.pro): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 04 02:40:50.780048 2026] [security2:error] [pid 558809:tid 558994] [client 94.140.231.15:33252] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)\|\|www.peterhansenranch.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "www.peterhansenranch.com"] [uri "/wp-json/wp/v2/users/me/"] [unique_id "aurhguAP6rY4x3NewRQueAAAARY"] show less	Brute-Force Bad Web Bot Web App Attack
🇨🇿 lp	2026-10-30 21:48:35 UTC · (1 week ago)	Unauthorized VPN login attempts: 1 attempts were recorded from 94.140.231.15 2026-10-30T22:28:51+0100 vpn Access-Reject station: 94.140.231.15	Brute-Force Web App Attack
🇺🇸 cwytech	2026-10-24 21:26:58 UTC · (2 weeks ago)	Fleet-wide ban from the Ghostfleet 👻. Triggered by scenario: cwy/wp-us-login-only-high.	Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-10-24 15:27:46 UTC · (2 weeks ago)	(mod_security) mod_security (id:225170) triggered by 94.140.231.15 (ip-94-140-231-15.citylink.pro): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 24 11:27:40.369489 2026] [security2:error] [pid 20050:tid 20050] [c ... show more (mod_security) mod_security (id:225170) triggered by 94.140.231.15 (ip-94-140-231-15.citylink.pro): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 24 11:27:40.369489 2026] [security2:error] [pid 20050:tid 20050] [client 94.140.231.15:46640] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)\|\|wallawallafirearmstraining.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "wallawallafirearmstraining.com"] [uri "/wp-json/wp/v2/users"] [unique_id "atzObDDyb6JLmgINqYN5KQAAABQ"] show less	Brute-Force Bad Web Bot Web App Attack
🇲🇹 Malta	2026-10-19 17:34:13 UTC · (3 weeks ago)	94.140.231.15 - - [19/Oct/2026:19:34:13 +0200] "POST /wp-login.php HTTP/1.1" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36" Brute-force password attempt	Hacking Web App Attack Brute-Force
🇺🇸 xmission.com	2026-09-02 01:47:58 UTC · (2 months ago)	Blocked by UFW (TCP on 9101) Source port: 64034 TTL: 40 Packet length: 52 TOS: 0x08 This report (for 94.140.231.15) was generated by: https://github.com/sefinek/UFW-AbuseIPDB-Reporter	Port Scan
Anonymous	2024-11-09 02:23:50 UTC · (2 years ago)	Ports: 80,443; Direction: 0; Trigger: LF_CUSTOMTRIGGER	Brute-Force SSH

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown

Recently Reported IPs:

🇵🇱 194.180.49.218

🇺🇸 216.250.125.30

🇫🇮 216.40.74.190

🇧🇷 205.210.31.208

🇹🇼 198.235.24.28

🇸🇬 148.66.155.73

🇺🇸 70.182.12.151

🇹🇼 211.23.109.116

🇦🇷 201.254.119.58

🇹🇼 198.235.24.93

🇳🇱 193.47.62.69

🇸🇬 178.128.84.112

🇭🇰 220.246.42.227

🇺🇸 216.25.89.70

🇺🇦 192.162.33.161

🇿🇦 165.165.112.109

🇮🇳 103.121.27.218

🇧🇬 78.128.112.74

🇰🇷 59.28.174.77

🇨🇳 39.107.136.130