This IP address has been reported a total of
7
times from
7 distinct
sources.
108.239.15.148 was first reported on
July 31st 2025 , and the most recent report was
2 days ago Germany
with 2
reports;
Switzerland
with 1
report;
Netherlands
with 1
report.
The most common categories in these recent reports were:
Brute-Force
4
times;
Web App Attack
1
time;
Port Scan
1
time;
Bad Web Bot
1
time.
Recent Reports
We have received reports of abusive activity from this IP address within the last week. It is
potentially still actively engaged in abusive activities.
Reporter
IoA Timestamp (UTC)
Comment
Categories
🇩🇪
30p87
2026-10-23 06:04:28
(2 days ago)
2026-10-23T08:04:27.397099+02:00 30p87-server dovecot[4871]: imap-login: Login aborted: Logged out ( ...
show more
2026-10-23T08:04:27.397099+02:00 30p87-server dovecot[4871]: imap-login: Login aborted: Logged out (auth failed, 2 attempts in 9 secs) (auth_failed): user=<[email protected] >, method=PLAIN, rip=108.239.15.148, lip=192.168.178.20, TLS, session=<RxIkwHtedqFs7w+U>
...
show less
Brute-Force
🇺🇸
TPI-Abuse
2026-10-05 12:00:53
(2 weeks ago)
(mod_security) mod_security (id:212280) triggered by 108.239.15.148 (108-239-15-148.lightspeed.sndgc ...
show more
(mod_security) mod_security (id:212280) triggered by 108.239.15.148 (108-239-15-148.lightspeed.sndgca.sbcglobal.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Oct 05 08:00:47.055127 2026] [security2:error] [pid 8649:tid 8649] [client 108.239.15.148:57562] ModSecurity: Access denied with code 403 (phase 2). Pattern match "<i?frame" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/07_XSS_XSS.conf"] [line "44"] [id "212280"] [rev "4"] [msg "COMODO WAF: Cross-site Scripting (XSS) Attack||www.verdeprofundo.net|F|2"] [data "Matched Data: <iframe found within REQUEST_URI: /palos-y-hormigas-bien-merecen-una-ed/salpas3/\\x22>salpas3</a></blockquote><iframe"] [severity "CRITICAL"] [tag "CWAF"] [tag "XSS"] [hostname "www.verdeprofundo.net"] [uri "/palos-y-hormigas-bien-merecen-una-ed/salpas3/">Salpas3</a></blockquote><iframe"] [unique_id "asORb9JFOBF_EGXuY5Rj0gAAABk"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇨🇭
Peter-Johann Sarbach
2026-09-29 23:31:50
(3 weeks ago)
2026-09-29T03:32:03.524383+02:00 "xxx" postfix/submission/smtpd[3788085]: connect from 108-239-15-14 ...
show more
2026-09-29T03:32:03.524383+02:00 "xxx" postfix/submission/smtpd[3788085]: connect from 108-239-15-148.lightspeed.sndgca.sbcglobal.net[108.239.15.148] 2026-09-29T03:32:05.070807+02:00 "xxx" postfix/submission/smtpd[3788085]: Anonymous TLS connection established from 108-239-15-148.lightspeed.sndgca.sbcglobal.net[108.239.15.148]: TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (secp384r1) server-digest SHA384 2026-09-29T03:32:10.140115+02:00 "xxx" postfix/submission/smtpd[3788085]: warning: 108-239-15-148.lightspeed.sndgca.sbcglobal.net[108.239.15.148]: SASL LOGIN authentication failed: (reason unavailable), sasl_username=info 2026-09-29T03:32:10.493408+02:00 "xxx" postfix/submission/smtpd[3788085]: lost connection after AUTH from 108-239-15-148.lightspeed.sndgca.sbcglobal.net[108.239.15.148] 2026-09-29T03:32:10.493653+02:00 "xxx" postfix/submission/smtpd[3788085]: disconnect from 108-239-15-148.lightspeed.sndgca.sbcglobal.net[108.239.15.148] ehlo=2 start...
show less
Port Scan
🇩🇪
it-ngo.com
2026-09-27 00:56:21
(4 weeks ago)
RdpGuard detected brute-force attempt on IMAP
Brute-Force
🇳🇱
maxxsense
2026-09-22 19:03:16
(1 month ago)
108.239.15.148 (US/United States/108-239-15-148.lightspeed.sndgca.sbcglobal.net), 12 distributed ima ...
show more
108.239.15.148 (US/United States/108-239-15-148.lightspeed.sndgca.sbcglobal.net), 12 distributed imapd attacks on account [redacted]
show less
Brute-Force
2026-04-26 19:21:00
(5 months ago)
Multiple Violations by Bot
Port Scan
Web App Attack
🇩🇪
CommanderRoot
2025-07-31 06:08:58
(1 year ago)
AI Bot crawler
DDoS Attack
Web Spam
Showing 1 to
7
of 7 reports
