JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 138.59.9.249

138.59.9.249 was found in our database!

This IP was reported 18 times. Confidence of Abuse is 29%: ?

29%

ISP	DISTRIBUIDORA OFIC TECH DE VENEZUELA C.A.
Usage Type	Fixed Line ISP
ASN	AS269788
Domain Name	fonet.com.ve
Country	🇻🇪 Venezuela (Bolivarian Republic of)
City	Valencia, Carabobo

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 138.59.9.249

Whois 138.59.9.249

IP Abuse Reports for 138.59.9.249:

This IP address has been reported a total of 18 times from 14 distinct sources. 138.59.9.249 was first reported on July 24th 2025, and the most recent report was 1 week ago.

Old Reports: The most recent abuse report for this IP address is from 1 week ago . It is possible that this IP is no longer involved in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇬🇧 Birdo	2026-06-04 14:53:13 (1 week ago)	[Birdo SMB Honeypot] SMB unauthorized attempt	Exploited Host Brute-Force Port Scan Hacking
Anonymous	2026-05-31 01:54:37 (2 weeks ago)	Attack Signature Blocked: /wishlist/index/add/product/11107/form_key/YAqbvQeu7DAVemB4/ \| UA: Mozilla ... show more Attack Signature Blocked: /wishlist/index/add/product/11107/form_key/YAqbvQeu7DAVemB4/ \| UA: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/4.0) \| (Magento Site) (Botnet activity attributed to: Angara Technologies Group / mikhail-smirnov-798... show less	Web App Attack Bad Web Bot
🇩🇪 SMARTNET	2026-05-27 06:03:53 (2 weeks ago)	Aisuru(Mirai variant) DDoS \| Incident ID: 1c72ea9a-d634-4668-a8aa-89a786da95ec	DDoS Attack
🇦🇹 urnilxfgbez	2026-05-25 22:45:00 (3 weeks ago)	Last 24 Hours suspicious: (DPT=445\|DPT=3389\|DPT=22\|DPT=3306\|DPT=8080\|DPT=23\|DPT=5900\|DPT=1433)	Port Scan
🇺🇸 TPI-Abuse	2026-05-17 07:21:33 (4 weeks ago)	(mod_security) mod_security (id:217210) triggered by 138.59.9.249 (-): 1 in the last 300 secs; Ports ... show more (mod_security) mod_security (id:217210) triggered by 138.59.9.249 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun May 17 03:21:25.923380 2026] [security2:error] [pid 27404:tid 27404] [client 138.59.9.249:55848] ModSecurity: Access denied with code 403 (phase 2). Match of "rx ^(?i:(?:[a-z]{3,10}\\\\s+(?:\\\\w{3,7}?://[\\\\w\\\\-\\\\./](?::\\\\d+)?)?/[^?#](?:\\\\?[^#\\\\s])?(?:#[\\\\S])?\|connect (?:\\\\d{1,3}\\\\.){3}\\\\d{1,3}\\\\.?(?::\\\\d+)?\|options \\\\)\\\\s+[\\\\w\\\\./]+\|get /[^?#](?:\\\\?[^#\\\\s])?(?:#[\\\\S]*)?)$" against "REQUEST_LINE" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "114"] [id "217210"] [rev "1"] [msg "COMODO WAF: Invalid HTTP Request Line\|\|moon7environmentss.shop\|F\|4"] [data "GET http://moon7environmentss.shop HTTP/1.1"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "moon7environmentss.shop"] [uri "/"] [unique_id "aglsdaEmmkbve5RWp9YJCgAAAAU"] show less	Brute-Force Bad Web Bot Web App Attack
Anonymous	2026-05-01 22:59:38 (1 month ago)	Unauthorized connection attempt on Port 2323	Port Scan Hacking Exploited Host
🇨🇦 polycoda	2026-02-04 09:57:56 (4 months ago)	🥶 Part of massive botnet scraping campaign that nearly turned into a DDoS on 2025-11-27	DDoS Attack
🇩🇪 FeG Deutschland	2026-02-04 03:52:03 (4 months ago)	Mail: - login with unknown user - bruteforce	Brute-Force
🇺🇸 TPI-Abuse	2026-01-20 15:31:57 (4 months ago)	(mod_security) mod_security (id:210730) triggered by 138.59.9.249 (-): 1 in the last 300 secs; Ports ... show more (mod_security) mod_security (id:210730) triggered by 138.59.9.249 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jan 20 10:31:50.467547 2026] [security2:error] [pid 3341:tid 3341] [client 138.59.9.249:51758] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy\|\|cameronsol.com.worldchat.global\|F\|2"] [data ".skreebee.com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "cameronsol.com.worldchat.global"] [uri "/www.skreebee.com"] [unique_id "aW-f5n3vsNdPMSwSCM17MgAAAAU"], referer: https://cameronsol.com.worldchat.global/ show less	Brute-Force Bad Web Bot Web App Attack
🇦🇺 MAGIC	2026-01-18 02:23:41 (4 months ago)	VM1 Bad user agents ignoring web crawling rules. Draing bandwidth	DDoS Attack Bad Web Bot
🇦🇺 Block Rockin' Beats	2026-01-17 07:10:03 (4 months ago)	Attempted connection to TCP port 23	Port Scan
🇺🇸 FreeMyIP	2025-12-10 02:40:59 (6 months ago)	Dec 9 21:40:58 dns-1 postfix/smtpd[2571082]: warning: unknown[138.59.9.249]: SASL PLAIN authenticat ... show more Dec 9 21:40:58 dns-1 postfix/smtpd[2571082]: warning: unknown[138.59.9.249]: SASL PLAIN authentication failed: authentication failure ... show less	Brute-Force
Anonymous	2025-11-17 16:25:05 (6 months ago)	scanning http requests from known botnet	Web App Attack
Anonymous	2025-11-16 21:25:49 (7 months ago)	scanning http requests from known botnet	Web App Attack
🇸🇪 KIDOS	2025-10-13 02:13:18 (8 months ago)	malicious activity, botnet	Web App Attack

Showing 1 to 15 of 18 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇨🇳 211.101.233.7

🇨🇭 209.99.188.148

🇧🇷 205.210.31.209

🇺🇸 172.208.25.111

🇫🇷 158.220.121.160

🇨🇳 58.23.69.251

🇺🇸 45.3.36.106

🇫🇮 34.88.219.138

🇺🇸 2600:8806:918e:9000:49c1:e53d:dbd2:5440

🇨🇳 223.111.161.82

🇬🇧 213.166.84.34

🇩🇪 194.88.98.87

🇻🇳 103.241.43.193

🇬🇧 89.37.172.137

🇺🇸 47.251.105.228

🇳🇱 45.156.87.204

🇳🇱 45.148.10.67

🇺🇸 44.215.219.236

🇺🇸 195.184.76.112

🇺🇸 192.178.115.211