JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 95.70.202.240

95.70.202.240 was found in our database!

This IP was reported 22 times. Confidence of Abuse is 97%: ?

97%

ISP	TurkNet-DSL
Usage Type	Fixed Line ISP
ASN	AS12735
Hostname(s)	240.202.70.95.static.turk.net
Domain Name	turknet.net.tr
Country	🇹🇷 Turkey
City	Bursa, Bursa Province

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 95.70.202.240

Whois 95.70.202.240

IP Abuse Reports for 95.70.202.240:

This IP address has been reported a total of 22 times from 18 distinct sources. 95.70.202.240 was first reported on July 16th 2026, and the most recent report was 4 hours ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇳🇱 Site.eu	2026-08-26 11:43:05 (4 hours ago)	Repeated wp-login/xmlrpc attempts	Brute-Force SSH
🇩🇪 LRob	2026-08-26 10:33:40 (5 hours ago)	Malicious web request: probing for secrets, traversal or a known exploit path \| method: POST \| path: ... show more Malicious web request: probing for secrets, traversal or a known exploit path \| method: POST \| path: /xmlrpc.php \| 2026-08-26 10:33 UTC show less	Hacking Web App Attack
🇺🇸 ArturShelby	2026-08-25 15:28:14 (1 day ago)	Honeypot triggered: /xmlrpc.php	Web App Attack
🇩🇪 Jochen Pretli	2026-08-25 14:12:11 (1 day ago)	connection to honeypot	Email Spam Port Scan
🇺🇸 TPI-Abuse	2026-08-25 12:16:07 (1 day ago)	(mod_security) mod_security (id:225170) triggered by 95.70.202.240 (240.202.70.95.static.turk.net): ... show more (mod_security) mod_security (id:225170) triggered by 95.70.202.240 (240.202.70.95.static.turk.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Aug 25 08:16:01.661317 2026] [security2:error] [pid 32432:tid 32432] [client 95.70.202.240:47201] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)\|\|celebritybikinigossip.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "celebritybikinigossip.com"] [uri "/wp-json/wp/v2/users"] [unique_id "ao2HgaKgE43Ggjzz9jwLfAAAAAo"] show less	Brute-Force Bad Web Bot Web App Attack
🇦🇺 QT	2026-08-25 12:10:15 (1 day ago)	Unauthorised WordPress admin login attempted at 2026-08-25 22:10:09 +1000	Web App Attack
🇩🇪 Vegascosmetics	2026-08-25 08:20:40 (1 day ago)	Kingcopy.org AI-IDS (Vegas Cosmetics shop): auto-blocked after PHP/CMS/webshell exploit probe (possi ... show more Kingcopy.org AI-IDS (Vegas Cosmetics shop): auto-blocked after PHP/CMS/webshell exploit probe (possible exploited host). Evidence: AttackPattern: /[a-z0-9]{1,12}\.php (Match: /xmlrpc.php) show less	Hacking Exploited Host Web App Attack
🇺🇸 TPI-Abuse	2026-08-24 19:52:50 (1 day ago)	(mod_security) mod_security (id:225170) triggered by 95.70.202.240 (240.202.70.95.static.turk.net): ... show more (mod_security) mod_security (id:225170) triggered by 95.70.202.240 (240.202.70.95.static.turk.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Aug 24 15:52:46.404194 2026] [security2:error] [pid 30980:tid 30980] [client 95.70.202.240:46979] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)\|\|gulftelecom.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "gulftelecom.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aoyhDpvWDuC0xk8y4MgEjgAAAAU"] show less	Brute-Force Bad Web Bot Web App Attack
🇳🇱 Site.eu	2026-08-24 11:35:01 (2 days ago)	Repeated wp-login/xmlrpc attempts	Brute-Force SSH
🇺🇸 jcbriar	2026-08-24 09:53:03 (2 days ago)	Searching for vulnerable scripts	Hacking Web App Attack
🇮🇩 Burayot	2026-08-24 08:34:01 (2 days ago)	LF_MODSEC: (mod_security) mod_security (id:1000001) triggered by 95.70.202.240 (TR/Türkiye/240.202.7 ... show more LF_MODSEC: (mod_security) mod_security (id:1000001) triggered by 95.70.202.240 (TR/Türkiye/240.202.70.95.static.turk.net): 1 in the last 3600 secs show less	Web App Attack
🇩🇪 4server	2026-08-23 17:29:23 (2 days ago)	[SunAug2319:29:20.0107862026][security2:error][pid4110510:tid4110578][client95.70.202.240:0]ModSecur ... show more [SunAug2319:29:20.0107862026][security2:error][pid4110510:tid4110578][client95.70.202.240:0]ModSecurity:Accessdeniedwithcode403\(phase1\).Stringmatch\"/xmlrpc.php\"atREQUEST_URI.[file\"/etc/apache2/conf.d/modsec_custom_rules.conf\"][line\"170\"][id\"960024\"][msg\"XML-RPCdisabled\"][hostname\"asw-sa.com\"][uri\"/xmlrpc.php\"][unique_id\"aost8Ani5kg2E9VXmPQCnwAAAIc\"] show less	Port Scan Brute-Force Web App Attack
Anonymous	2026-08-23 16:26:59 (2 days ago)	Web scanner: POST /xmlrpc.php	Web App Attack Hacking
🇬🇧 consul.to	2026-08-23 13:41:41 (3 days ago)	Web attack/malicious scanning detected	Web App Attack
🇺🇸 IndigoRidge	2026-08-23 11:56:22 (3 days ago)	95.70.202.240 - - [23/Aug/2026:07:54:53 -0400] "POST /xmlrpc.php HTTP/1.0" 200 5088 "-" "Mozilla/5.0 ... show more 95.70.202.240 - - [23/Aug/2026:07:54:53 -0400] "POST /xmlrpc.php HTTP/1.0" 200 5088 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7; x86) AppleWebKit/537.36 (KHTML, like Gecko) Safari/12.0.0.0 Safari/537.36" 95.70.202.240 - - [23/Aug/2026:07:55:18 -0400] "POST /xmlrpc.php HTTP/1.0" 200 5088 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7; x64) AppleWebKit/537.36 (KHTML, like Gecko) Edge/87.0.0.0 Safari/537.36" 95.70.202.240 - - [23/Aug/2026:07:55:44 -0400] "POST /xmlrpc.php HTTP/1.0" 200 5088 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7; x64) AppleWebKit/537.36 (KHTML, like Gecko) Safari/10.0.0.0 Safari/537.36" 95.70.202.240 - - [23/Aug/2026:07:56:08 -0400] "POST /xmlrpc.php HTTP/1.0" 200 5088 "-" "Mozilla/5.0 (Windows NT 6.3; x64) AppleWebKit/537.36 (KHTML, like Gecko) Opera/77.0.0.0 Safari/537.36" 95.70.202.240 - - [23/Aug/2026:07:56:21 -0400] "POST /xmlrpc.php HTTP/1.0" 200 5088 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7; x64) AppleWebKit/537.36 (KHTML, like ... show less	Web App Attack

Showing 1 to 15 of 22 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇮🇩 182.253.221.210

🇩🇪 92.209.204.177

🇱🇹 77.90.185.20

🇻🇳 45.119.81.245

🇨🇳 42.100.24.72

🇺🇸 2400:cb00:988:1000:57e0:e8d4:4b30:801d

🇮🇶 212.237.127.189

🇨🇼 190.88.101.11

🇵🇱 188.47.95.215

🇹🇷 176.53.86.227

🇧🇷 138.186.46.74

🇸🇬 103.250.10.63

🇺🇸 66.132.186.168

🇨🇳 61.240.145.80

🇺🇸 172.203.207.200

🇩🇪 167.94.146.33

🇨🇳 120.87.99.202

🇮🇳 117.192.41.235

🇸🇪 95.155.234.161

🇫🇷 91.196.152.122