JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 95.70.142.21

95.70.142.21 was found in our database!

This IP was reported 15 times. Confidence of Abuse is 78%: ?

78%

ISP	Turknet-Broadband
Usage Type	Fixed Line ISP
ASN	AS12735
Hostname(s)	21.142.70.95.reverse.turk.net
Domain Name	turknet.net.tr
Country	🇹🇷 Turkey
City	Bursa, Bursa Province

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 95.70.142.21

Whois 95.70.142.21

IP Abuse Reports for 95.70.142.21:

This IP address has been reported a total of 15 times from 13 distinct sources. 95.70.142.21 was first reported on September 25th 2026, and the most recent report was 9 hours ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇩🇪 ghostwarriors	2026-09-30 10:21:26 (9 hours ago)	Webpage scraping	Brute-Force Bad Web Bot Web App Attack
🇩🇪 ksol-hostmaster	2026-09-30 10:06:16 (9 hours ago)	2026/09/30 12:06:16 [error] 19856#104864: 3921240 access forbidden by rule, client: 95.70.142.21, s ... show more 2026/09/30 12:06:16 [error] 19856#104864: 3921240 access forbidden by rule, client: 95.70.142.21, server: revolutionbim.com, request: "POST /xmlrpc.php HTTP/1.1", host: "revolutionbim.com" ... show less	Web Spam
🇳🇱 wlt-blocker	2026-09-30 07:35:19 (12 hours ago)	Unauthorized access to webpage admin	Web App Attack
🇩🇪 4server	2026-09-29 10:48:02 (1 day ago)	[TueSep2912:47:55.7031522026][security2:error][pid2146605:tid2146775][client95.70.142.21:0]ModSecuri ... show more [TueSep2912:47:55.7031522026][security2:error][pid2146605:tid2146775][client95.70.142.21:0]ModSecurity:Accessdeniedwithcode403\(phase1\).Stringmatch\"/xmlrpc.php\"atREQUEST_URI.[file\"/etc/apache2/conf.d/modsec_custom_rules.conf\"][line\"170\"][id\"960024\"][msg\"XML-RPCdisabled\"][hostname\"newbeauty-pully.ch\"][uri\"/xmlrpc.php\"][unique_id\"aruXW6I6CVtiVRn8Q8uRFAAAAEs\"] show less	Port Scan Brute-Force Web App Attack
🇳🇿 Tripwire	2026-09-28 06:00:30 (2 days ago)	Probing for Wordpress - /xmlrpc.php	Brute-Force Web App Attack
🇩🇪 big-cloud.nl	2026-09-27 07:38:04 (3 days ago)	Try to access /xmlrpc.php	Web App Attack
🇳🇴 jad-abuse	2026-09-26 16:54:56 (4 days ago)	ActiveDefense automated detection: malicious HTTP scanning / exploit attempts. Signatures: xmlrpc. O ... show more ActiveDefense automated detection: malicious HTTP scanning / exploit attempts. Signatures: xmlrpc. Observed by 1 sensor(s); 1 hits. show less	Brute-Force Web App Attack
Anonymous	2026-09-26 16:05:39 (4 days ago)	Blocked: Reason='Vulnerability probing — PHP scan detected (15/60 min)'; Requests=15	Port Scan
🇲🇹 Malta	2026-09-26 13:02:45 (4 days ago)	95.70.142.21 - - [26/Sep/2026:15:02:45 +0200] "POST /xmlrpc.php HTTP/1.1" "Mozilla/5.0 (Windows NT 6 ... show more 95.70.142.21 - - [26/Sep/2026:15:02:45 +0200] "POST /xmlrpc.php HTTP/1.1" "Mozilla/5.0 (Windows NT 6.3; arm64) AppleWebKit/537.36 (KHTML, like Gecko) Firefox/100.0.0.0 Safari/537.36" show less	Hacking Web App Attack
🇩🇪 pscriptos	2026-09-26 12:27:20 (4 days ago)	{"ClientAddr":"95.70.142.21:54431","ClientHost":"95.70.142.21","ClientPort":"54431","ClientUsername" ... show more {"ClientAddr":"95.70.142.21:54431","ClientHost":"95.70.142.21","ClientPort":"54431","ClientUsername":"-","DownstreamContentSize":418,"DownstreamStatus":403,"Duration":158375864,"OriginContentSize":418,"OriginDuration":153975287,"OriginStatus":403,"Overhead":4400577,"RequestAddr":"www.cleveradmin.de","RequestContentSize":680,"RequestCount":586588,"RequestHost":"www.cleveradmin.de","RequestMethod":"POST","RequestPath":"/xmlrpc.php","RequestPort":"-","RequestProtocol":"HTTP/1.1","RequestScheme":"https","RetryAttempts":0,"RouterName":"cleveradmin-www-websecure@file","ServiceAddr":"172.16.80.10:80","ServiceName":"cleveradmin-www@file","ServiceURL":"http://172.16.80.10:80","StartLocal":"2026-09-26T14:23:29.625958724+02:00","StartUTC":"2026-09-26T12:23:29.625958724Z","TLSCipher":"TLS_AES_128_GCM_SHA256","TLSVersion":"1.3","entryPointName":"websecure","level":"info","msg":"","time":"2026-09-26T14:23:29+02:00"} {"ClientAddr":"95.70.142.21:53172","ClientHost":"95.70.142.21","ClientPort":"53172", ... show less	Brute-Force Web App Attack
🇮🇹 VHosting	2026-09-26 09:55:03 (4 days ago)	Detected WordPress attack from different servers	Brute-Force Web App Attack
🇩🇪 4server	2026-09-26 09:30:05 (4 days ago)	[SatSep2611:30:00.4687072026][security2:error][pid2084686:tid2084779][client95.70.142.21:0]ModSecuri ... show more [SatSep2611:30:00.4687072026][security2:error][pid2084686:tid2084779][client95.70.142.21:0]ModSecurity:Accessdeniedwithcode403\(phase1\).Stringmatch\"/xmlrpc.php\"atREQUEST_URI.[file\"/etc/apache2/conf.d/modsec_custom_rules.conf\"][line\"170\"][id\"960024\"][msg\"XML-RPCdisabled\"][hostname\"rvengineering.ch\"][uri\"/xmlrpc.php\"][unique_id\"areQmM2s-ivmsPJKFsaZZwAAAJg\"] show less	Port Scan Brute-Force Web App Attack
🇫🇮 inlink.ltd	2026-09-26 09:29:06 (4 days ago)	Known malicious PHP file or CMS probe	Web App Attack
Anonymous	2026-09-26 05:21:09 (4 days ago)	[redacted] 95.70.142.21 - - [26/Sep/2026:07:19:46 +0200] "POST /xmlrpc.php HTTP/1.1" 200 418 "-" "Mo ... show more [redacted] 95.70.142.21 - - [26/Sep/2026:07:19:46 +0200] "POST /xmlrpc.php HTTP/1.1" 200 418 "-" "Mozilla/5.0 (Windows NT 10.0; x64) AppleWebKit/537.36 (KHTML, like Gecko) Opera/77.0.0.0 Safari/537.36" [redacted] 95.70.142.21 - - [26/Sep/2026:07:19:58 +0200] "POST /xmlrpc.php HTTP/1.1" 200 418 "-" "Mozilla/5.0 (Windows NT 10.0; arm64) AppleWebKit/537.36 (KHTML, like Gecko) Opera/60.0.0.0 Safari/537.36" [redacted] 95.70.142.21 - - [26/Sep/2026:07:20:10 +0200] "POST /xmlrpc.php HTTP/1.1" 200 418 "-" "Mozilla/5.0 (Windows NT 10.0; x64) AppleWebKit/537.36 (KHTML, like Gecko) Opera/79.0.0.0 Safari/537.36" [redacted] 95.70.142.21 - - [26/Sep/2026:07:20:22 +0200] "POST /xmlrpc.php HTTP/1.1" 200 418 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; x86) AppleWebKit/537.36 (KHTML, like Gecko) Safari/11.0.0.0 Safari/537.36" [redacted] 95.70.142.21 - - [26/Sep/2026:07:20:34 +0200] "POST /xmlrpc.php HTTP/1.1" 200 418 "-" "Mozilla/5.0 (Windows NT 6.3; x64) AppleWeb ... show less	Hacking Web App Attack
Anonymous	2026-09-25 15:33:42 (5 days ago)	[redacted] 95.70.142.21 - - [25/Sep/2026:17:32:30 +0200] "POST /xmlrpc.php HTTP/1.1" 200 418 "-" "Mo ... show more [redacted] 95.70.142.21 - - [25/Sep/2026:17:32:30 +0200] "POST /xmlrpc.php HTTP/1.1" 200 418 "-" "Mozilla/5.0 (Windows NT 6.2; x86) AppleWebKit/537.36 (KHTML, like Gecko) Edge/93.0.0.0 Safari/537.36" [redacted] 95.70.142.21 - - [25/Sep/2026:17:32:38 +0200] "POST /xmlrpc.php HTTP/1.1" 200 418 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36" [redacted] 95.70.142.21 - - [25/Sep/2026:17:32:46 +0200] "POST /xmlrpc.php HTTP/1.1" 200 418 "-" "Mozilla/5.0 (Windows NT 6.3; arm64) AppleWebKit/537.36 (KHTML, like Gecko) Firefox/96.0.0.0 Safari/537.36" [redacted] 95.70.142.21 - - [25/Sep/2026:17:32:58 +0200] "POST /xmlrpc.php HTTP/1.1" 200 418 "-" "Mozilla/5.0 (Windows NT 10.0; x86) AppleWebKit/537.36 (KHTML, like Gecko) Safari/11.0.0.0 Safari/537.36" [redacted] 95.70.142.21 - - [25/Sep/2026:17:33:06 +0200] "POST /xmlrpc.php HTTP/1.1" 200 418 "-" "Mozilla/5.0 (Windows NT 6.2; x64) AppleWe ... show less	Hacking Web App Attack

Showing 1 to 15 of 15 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇺🇸 207.177.80.37

🇳🇱 195.178.110.228

🇺🇸 147.185.132.37

🇻🇳 103.146.23.23

🇬🇧 206.189.115.217

🇧🇷 190.89.136.232

🇨🇴 186.84.20.19

🇩🇪 151.243.11.138

🇹🇷 131.222.130.244

🇨🇭 104.244.74.84

🇺🇸 104.23.187.66

🇫🇷 37.187.241.191

🇺🇸 20.127.194.89

🇰🇷 211.38.86.57

🇧🇷 205.210.31.218

🇺🇬 197.239.8.164

🇨🇳 183.196.144.45

🇩🇪 172.70.246.19

🇻🇳 161.248.147.22

🇦🇪 87.200.183.200