JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 45.91.20.139

45.91.20.139 was found in our database!

This IP was reported 98 times. Confidence of Abuse is 41%: ?

41%

ISP	VPN Consumer Milan, Italy
Usage Type	Data Center/Web Hosting/Transit
ASN	AS9009
Domain Name	vpnconsumer.com
Country	🇮🇹 Italy
City	Milan, Lombardy

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 45.91.20.139

Whois 45.91.20.139

IP Abuse Reports for 45.91.20.139:

This IP address has been reported a total of 98 times from 55 distinct sources. 45.91.20.139 was first reported on October 1st 2025, and the most recent report was 1 day ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇮🇩 soc-yk	2026-08-17 11:54:13 (1 day ago)	Type: suspicious_network_activity Risk: 100 Events: 115 Evidence: - Persistent suspicious network a ... show more Type: suspicious_network_activity Risk: 100 Events: 115 Evidence: - Persistent suspicious network activity detected - Repeated hostile operational behavior observed - Multi-event operational persistence identified - Threat escalation behavior observed show less	Port Scan Hacking
🇫🇷 Octopuce	2026-08-16 15:48:36 (2 days ago)	Aggressive web search of vulnerable pages: /bless.php /O-Simple.php /lock360.php /zwso.php /chosen.p ... show more Aggressive web search of vulnerable pages: /bless.php /O-Simple.php /lock360.php /zwso.php /chosen.php /about.php /admin.php /mah.php /.wp/wso. ... show less	Web App Attack
🇳🇱 WeCloudit-Anti-Abuse	2026-08-16 14:42:02 (2 days ago)	This IP was detected by CrowdSec triggering crowdsecurity/http-probing	Web App Attack Hacking
🇹🇷 neron	2026-08-15 01:06:48 (4 days ago)	CrowdSec blocked: http:exploit detected via OPNsense firewall	Hacking Web App Attack
🇱🇻 garmtech.com	2026-08-05 06:57:28 (1 week ago)	IM360 WAF: WordPress wp2shell REST batch endpoint before 7.0.2 or 6.9.5 (CVE-2026-63030) MV:0	Hacking
🇺🇦 URAN Publishing Service	2026-08-05 00:25:04 (2 weeks ago)	[05/Aug/2026:03:25:04 +0300] -- 45.91.20.139 Ban reason: Scanner [CMS_GENERIC] \| Request: GET /wp-js ... show more [05/Aug/2026:03:25:04 +0300] -- 45.91.20.139 Ban reason: Scanner [CMS_GENERIC] \| Request: GET /wp-json/ HTTP/1.1 show less	Bad Web Bot Web App Attack
🇹🇷 neron	2026-08-01 06:16:14 (2 weeks ago)	CrowdSec blocked: http:exploit detected via OPNsense firewall	Hacking Web App Attack
🇺🇸 TPI-Abuse	2026-07-03 12:32:22 (1 month ago)	(mod_security) mod_security (id:212620) triggered by 45.91.20.139 (-): 1 in the last 300 secs; Ports ... show more (mod_security) mod_security (id:212620) triggered by 45.91.20.139 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jul 03 08:32:17.104491 2026] [security2:error] [pid 19926:tid 19926] [client 45.91.20.139:50315] ModSecurity: Access denied with code 403 (phase 2). Pattern match "<script\\\\b" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/07_XSS_XSS.conf"] [line "65"] [id "212620"] [rev "4"] [msg "COMODO WAF: Cross-site Scripting (XSS) Attack\|\|www.madrigalscripts.com\|F\|2"] [data "Matched Data: <script found within REQUEST_URI: /index.php?main_page=\\x22><script>alert(string.fromcharcode(88,83,83))</script>&cpath=574&products_id=3110"] [severity "CRITICAL"] [tag "CWAF"] [tag "XSS"] [hostname "www.madrigalscripts.com"] [uri "/index.php"] [unique_id "aker0cAbYzWBbGsvnx0PfAAAAAc"], referer: https://www.madrigalscripts.com/index.php?main_page="><script >alert(String.fromCharCode(88,83,83))</script>&cPath=574&products_id=3110 show less	Brute-Force Bad Web Bot Web App Attack
Anonymous	2026-06-30 11:27:27 (1 month ago)	45.91.20.139 - - [30/Jun/2026:13:27:18 +0200] "POST /xmlrpc.php HTTP/1.1" 200 3106 "-" "Mozilla/5.0 ... show more 45.91.20.139 - - [30/Jun/2026:13:27:18 +0200] "POST /xmlrpc.php HTTP/1.1" 200 3106 "-" "Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36" 45.91.20.139 - - [30/Jun/2026:13:27:18 +0200] "POST /xmlrpc.php HTTP/1.1" 200 2915 "-" "Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36" 45.91.20.139 - - [30/Jun/2026:13:27:22 +0200] "POST /xmlrpc.php HTTP/1.1" 200 368 "-" "Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36" 45.91.20.139 - - [30/Jun/2026:13:27:23 +0200] "POST /xmlrpc.php HTTP/1.1" 200 178 "-" "Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36" 45.91.20.139 - - [30/Jun/2026:13:27:26 +0200] "POST /xmlrpc.php HTTP/1.1" 200 14594 "-" "Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36" ... show less	Brute-Force Web App Attack
🇫🇷 Octopuce	2026-06-28 17:13:30 (1 month ago)	Aggressive web search of vulnerable pages: /wp-content/plugins/so-pinyin-slugs/inc/main_json.php /wp ... show more Aggressive web search of vulnerable pages: /wp-content/plugins/so-pinyin-slugs/inc/main_json.php /wp-content/plugins/filester/assets/css/404.ph ... show less	Web App Attack
🇬🇧 consul.to	2026-06-28 09:23:20 (1 month ago)	Web attack/malicious scanning detected	Web App Attack
🇬🇧 consul.to	2026-06-24 06:38:18 (1 month ago)	Web attack/malicious scanning detected	Web App Attack
🇬🇧 consul.to	2026-06-15 10:34:31 (2 months ago)	Web attack/malicious scanning detected	Web App Attack
🇺🇦 URAN Publishing Service	2026-06-15 00:37:55 (2 months ago)	45.91.20.139 - - [15/Jun/2026:03:37:54 +0300] "GET /wp-content/plugins/SecurityFin/SecurityFin.php H ... show more 45.91.20.139 - - [15/Jun/2026:03:37:54 +0300] "GET /wp-content/plugins/SecurityFin/SecurityFin.php HTTP/1.1" 404 722 "-" "Go-http-client/1.1" 45.91.20.139 - - [15/Jun/2026:03:37:54 +0300] "GET /wp-content/plugins/file-upload-types/assets/css/403x.php HTTP/1.1" 404 722 "-" "Go-http-client/1.1" ... show less	Web App Attack
🇬🇧 consul.to	2026-06-13 06:35:16 (2 months ago)	Web attack/malicious scanning detected	Web App Attack

Showing 1 to 15 of 98 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇮🇹 172.253.13.156

🇧🇬 79.124.49.70

🇷🇴 2.57.122.209

🇺🇸 2001:470:1:fb5::48

🇱🇹 213.176.26.72

🇱🇹 213.176.26.62

🇺🇬 196.216.81.126

🇬🇧 193.163.125.18

🇺🇸 66.132.186.190

🇨🇭 62.169.136.29

🇬🇧 35.203.211.30

🇷🇺 5.227.27.175

🇨🇳 218.9.233.30

🇺🇸 162.216.150.27

🇮🇳 154.29.229.225

🇭🇰 154.12.89.140

🇰🇷 121.189.127.248

🇨🇳 106.37.72.234

🇧🇩 103.86.198.253

🇩🇪 80.137.115.247