JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

13.140.242.159

Recent Activity

Abuse confidence score ?

100% Critical

288 reports

223 reporters · latest 14 minutes ago

ISP	Contabo GmbH
Usage Type	Unknown
ASN	AS40021
Hostname(s)	vmi3681441.contaboserver.net
Domain Name	contabo.com
Country	🇺🇸 United States of America
City	Seattle, Washington

ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report Whois

Reports Activity

Example preview

Report Categories (Last 60 Days)

Example preview

Top Reporter Countries (Last 60 Days)

Example preview

Account required for the enhanced features Log in Sign up

IP Abuse Reports for 13.140.242.159

Export CSV

This IP address has been reported a total of 288 times from 223 distinct sources. 13.140.242.159 was first reported on October 20th 2026, and the most recent report was 14 minutes ago. In the last 60 days, the top reporter locations were: Germany with 73 reports; United States of America with 52 reports; France with 33 reports. The most common categories in these recent reports were: Web App Attack 144 times; Brute-Force 107 times; SSH 71 times; Hacking 69 times; Port Scan 63 times; Other 79 times.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇫🇷 sthoyer.de	2026-10-24 01:42:55 (14 minutes ago)	13.140.242.159 - - [24/Oct/2026:03:42:52 +0200] "POST /cgi-bin/%%32%65%%32%65/%%32%65%%32%65/%%32%65 ... show more 13.140.242.159 - - [24/Oct/2026:03:42:52 +0200] "POST /cgi-bin/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/bin/sh HTTP/1.1" 302 794 "-" "libredtail-http" 13.140.242.159 - - [24/Oct/2026:03:42:53 +0200] "POST /hello.world?%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 302 794 "-" "libredtail-http" 13.140.242.159 - - [24/Oct/2026:03:42:53 +0200] "POST /?%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 200 331 "-" "libredtail-http" ... show less	Web App Attack
🇨🇭 copestack	2026-10-24 01:30:06 (27 minutes ago)	Honeypot hit on ov-9acb4e (fail2ban jail: roridula-feed)	Port Scan
🇩🇪 Tsumugi Kotobuki	2026-10-24 01:25:41 (32 minutes ago)	Port Scan on Honeypot \| Ports: 2222/SSH-alt \| Proto: TCP(1) \| Flags: all SYN \| TTL: 49 \| Len: 44B \| ... show more Port Scan on Honeypot \| Ports: 2222/SSH-alt \| Proto: TCP(1) \| Flags: all SYN \| TTL: 49 \| Len: 44B \| Win: 65535(1) \| rDNS: vmi3681441.contaboserver.net \| F2B/ufw-honeypot@2026-10-24T01:25:41Z show less	Port Scan Hacking
🇫🇷 AmStaff	2026-10-24 01:20:19 (37 minutes ago)	Honeypot: web exploitation attempts. Targeted ports: HTTP.	Web App Attack
🇬🇧 andypiper	2026-10-24 01:01:05 (56 minutes ago)	CrowdSec ban for AbuseIPDB Top List	Brute-Force Web App Attack
🇺🇸 Carltonfsck	2026-10-24 00:48:53 (1 hour ago)	Oct 24 00:48:22 ssh sshd-session[52550]: Invalid user admin from 13.140.242.159 port 53682 Oct 24 00 ... show more Oct 24 00:48:22 ssh sshd-session[52550]: Invalid user admin from 13.140.242.159 port 53682 Oct 24 00:48:22 ssh sshd-session[52550]: Connection closed by invalid user admin 13.140.242.159 port 53682 [preauth] Oct 24 00:48:52 ssh sshd-session[52553]: Invalid user user from 13.140.242.159 port 39240 ... show less	Brute-Force SSH
🇮🇳 shax	2026-10-24 00:48:17 (1 hour ago)	Honeypot observed completed TCP application interaction; target=tcp/443; service=model-gateway-tls; ... show more Honeypot observed completed TCP application interaction; target=tcp/443; service=model-gateway-tls; method=POST; route=/cgi-bin/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/bin/sh; classification=exploit-pattern:../; UTC=2026-10-24T00:48:17.312+00:00; payload_sha256=d271048e4568512552cb38f66c78cb9f2fb93e56198962e354e3ec795b7622bf. Raw payload, credentials, prompts, and URL query omitted. show less	Hacking Web App Attack
🇧🇷 isaias.cravo	2026-10-24 00:42:17 (1 hour ago)	[Fri Oct 23 21:42:07.010156 2026] [php:error] [pid 280556] [client 13.140.242.159:44582] script '/va ... show more [Fri Oct 23 21:42:07.010156 2026] [php:error] [pid 280556] [client 13.140.242.159:44582] script '/var/www/html/index.php' not found or unable to stat [Fri Oct 23 21:42:07.541020 2026] [php:error] [pid 280556] [client 13.140.242.159:44582] script '/var/www/html/index.php' not found or unable to stat [Fri Oct 23 21:42:16.114940 2026] [php:error] [pid 280556] [client 13.140.242.159:44582] script '/var/www/html/index.php' not found or unable to stat [Fri Oct 23 21:42:16.518165 2026] [php:error] [pid 280556] [client 13.140.242.159:44582] script '/var/www/html/index.php' not found or unable to stat [Fri Oct 23 21:42:16.707713 2026] [php:error] [pid 280556] [client 13.140.242.159:44582] script '/var/www/html/index.php' not found or unable to stat ... show less	Brute-Force SSH
🇧🇾 lns.bz	2026-10-24 00:29:54 (1 hour ago)	Too many 404 requests [BY]	Web App Attack
🇺🇸 legionMCCXV	2026-10-24 00:21:39 (1 hour ago)	SSH brute-force / unauthorized login attempts.	Brute-Force SSH
🇩🇪 snhosting	2026-10-24 00:15:07 (1 hour ago)	13.140.242.159 - - [24/Oct/2026:02:14:56 +0200] "POST /hello.world?%ADd+allow_url_include%3d1+%ADd+a ... show more 13.140.242.159 - - [24/Oct/2026:02:14:56 +0200] "POST /hello.world?%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 404 0 "-" "libredtail-http" 13.140.242.159 - - [24/Oct/2026:02:14:56 +0200] "POST /?%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 404 0 "-" "libredtail-http" 13.140.242.159 - - [24/Oct/2026:02:14:56 +0200] "POST /index.php?%25ADd+allow_url_include%3D1+%25ADd+auto_prepend_file%3Dphp://input HTTP/1.1" 404 0 "-" "libredtail-http" 13.140.242.159 - - [24/Oct/2026:02:14:57 +0200] "POST /test.hello?%25ADd+allow_url_include%3D1+%25ADd+auto_prepend_file%3Dphp://input HTTP/1.1" 404 0 "-" "libredtail-http" 13.140.242.159 - - [24/Oct/2026:02:14:57 +0200] "POST /index.php?-d+allow_url_include%3don+-d+auto_prepend_file%3dphp%3a//input HTTP/1.1" 404 0 "-" "libredtail-http" ... show less	DNS Compromise DNS Poisoning Phishing Email Spam Brute-Force Web App Attack SSH
🇹🇼 kk_it_man	2026-10-24 00:01:10 (1 hour ago)		Hacking
🇷🇺 dnsbd.tech	2026-10-23 23:57:01 (2 hours ago)	nftables: Port scan (TCP:2222) [srv1]	Port Scan Hacking
Anonymous	2026-10-23 23:34:00 (2 hours ago)	IP banned by Fail2Ban	Brute-Force SSH
🇩🇪 giata	2026-10-23 23:21:22 (2 hours ago)	2026-10-23T23:20:47.812882 upload sshd-session[324315]: pam_unix(sshd:auth): authentication failure; ... show more 2026-10-23T23:20:47.812882 upload sshd-session[324315]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=13.140.242.159 2026-10-23T23:20:49.845988 upload sshd-session[324315]: Failed password for invalid user admin from 13.140.242.159 port 42476 ssh2 2026-10-23T23:21:21.593409 upload sshd-session[324327]: Invalid user user from 13.140.242.159 port 38902 ... show less	Brute-Force SSH

Showing 1 to 15 of 288 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇨🇱 201.219.233.217

🇬🇧 193.176.29.6

🇩🇪 167.94.146.50

🇺🇸 107.150.96.71

🇨🇳 101.96.224.241

🇩🇪 94.183.174.95

🇺🇸 91.230.168.135

🇻🇪 38.248.174.58

🇰🇷 218.236.58.204

🇺🇸 205.243.121.66

🇦🇷 190.96.127.50

🇨🇴 190.24.21.245

🇨🇳 175.30.48.172

🇫🇮 170.168.98.160

🇺🇸 170.106.179.18

🇳🇬 154.68.195.210

🇨🇱 152.173.238.13

🇻🇳 118.70.125.152

🇰🇷 115.68.208.117

🇰🇷 112.163.135.28