JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

139.162.153.39

Activity Trending Down

Abuse Confidence Score

62% Elevated

15 reports

12 reporters · latest 1 week ago

ISP: 139.162.0.0/16
Usage Type: Data Center/Web Hosting/Transit
ASN: AS63949
Hostname(s): 139-162-153-39.ip.linodeusercontent.com
Domain Name: linode.com
Country: 🇩🇪 Germany
City: Frankfurt am Main, Hesse

ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report Whois

Example preview

Account required for the enhanced features Log in Sign up

Abuse Reports

Export reports CSV

Total reports

15 from 12 distinct reporters

First reported

October 18th 2026

Most recent report

1 week ago

Last 60 days

Top reporter locations 🇺🇸 United States of America 5 🇳🇱 Netherlands 3 🇧🇪 Belgium 2

Most common categories Web App Attack 10 Hacking 5 Bad Web Bot 5 Port Scan 3 Brute-Force 3

Old reports The most recent abuse report for this IP address is from 1 week ago. It is possible that this IP is no longer involved in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇳🇱 homeshowdomain.nl	2026-10-19 21:59:42 (1 week ago)	Auto-ban: single probe for restricted files (.env / backups / admin endpoints). Likely mass-scan on 2026-10-18.	Web App Attack SSH Hacking
🇺🇸 TPI-Abuse	2026-10-18 22:22:26 (1 week ago)	(mod_security) mod_security (id:210492) triggered by 139.162.153.39 (139-162-153-39.ip.linodeusercontent.com): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Oct 18 18:22:18.397247 2026] [security2:error] [pid 30461:ti ... show more (mod_security) mod_security (id:210492) triggered by 139.162.153.39 (139-162-153-39.ip.linodeusercontent.com): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Oct 18 18:22:18.397247 2026] [security2:error] [pid 30461:tid 30461] [client 139.162.153.39:62277] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "astoriaman.com"] [uri "/.env"] [unique_id "atVGmsoabK9m4P0jE08AIQAAAAc"] show less	Brute-Force Bad Web Bot Web App Attack
🇨🇭 YF	2026-10-18 22:07:16 (1 week ago)	404 errors Vulnerability scan	Web App Attack
🇳🇱 homeshowdomain.nl	2026-10-18 21:59:45 (1 week ago)	Auto-ban: >3000 req/min op 2026-10-18	Web App Attack SSH Hacking
Anonymous	2026-10-18 19:50:04 (1 week ago)	suspicious request in access.log	Web App Attack
🇧🇪 cmbplf	2026-10-18 17:42:33 (1 week ago)	287 requests with url.path *.env	Brute-Force Bad Web Bot
🇫🇷 Kejult	2026-10-18 17:40:31 (1 week ago)	Honeypot Finding: repeated HTTP/web-application probing captured by Tanner on TCP/80; 87 request event(s), 77 distinct path(s), 80 request(s) to suspicious path(s). Examples: /database/.env, /admin/.env, /api/.env, /core/.env, /laravel/.env.	Hacking Bad Web Bot Web App Attack
Anonymous	2026-10-18 15:33:16 (1 week ago)	IP matched detection query Detection of too many failed responses.	Brute-Force Bad Web Bot Hacking
Anonymous	2026-10-18 14:20:01 (1 week ago)	(caddyscan) Scanner path probe from 139.162.153.39 (DE/Germany/139-162-153-39.ip.linodeusercontent.com): 5 in the last 3600 secs; Ports: ; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: 207.148.6.135 200 2627 139.162.153.39 - - [18/Oct/2026:14:1 ... show more (caddyscan) Scanner path probe from 139.162.153.39 (DE/Germany/139-162-153-39.ip.linodeusercontent.com): 5 in the last 3600 secs; Ports: ; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: 207.148.6.135 200 2627 139.162.153.39 - - [18/Oct/2026:14:19:50 +0000] "GET /.env HTTP/1.1" 207.148.6.135 200 2627 139.162.153.39 - - [18/Oct/2026:14:19:51 +0000] "GET /207.148.6.135:443/.env HTTP/1.1" 207.148.6.135 200 2627 139.162.153.39 - - [18/Oct/2026:14:19:53 +0000] "GET /.env.www HTTP/1.1" 207.148.6.135 200 2627 139.162.153.39 - - [18/Oct/2026:14:19:54 +0000] "GET /207.148.6.135:443/.env HTTP/1.1" 207.148.6.135 200 2627 139.162.153.39 - - [18/Oct/2026:14:19:57 +0000] "GET /207.148.6.135:443/.env HTTP/1.1" show less	Port Scan
Anonymous	2026-10-18 13:04:20 (1 week ago)	(caddyscan) Scanner path probe from 139.162.153.39 (DE/Germany/139-162-153-39.ip.linodeusercontent.com): 5 in the last 3600 secs; Ports: ; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: 207.148.6.135 200 2627 139.162.153.39 - - [18/Oct/2026:13:0 ... show more (caddyscan) Scanner path probe from 139.162.153.39 (DE/Germany/139-162-153-39.ip.linodeusercontent.com): 5 in the last 3600 secs; Ports: ; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: 207.148.6.135 200 2627 139.162.153.39 - - [18/Oct/2026:13:04:10 +0000] "GET /.env HTTP/1.1" 207.148.6.135 200 2627 139.162.153.39 - - [18/Oct/2026:13:04:11 +0000] "GET /207.148.6.135:443/.env HTTP/1.1" 207.148.6.135 200 2627 139.162.153.39 - - [18/Oct/2026:13:04:12 +0000] "GET /.env.www HTTP/1.1" 207.148.6.135 200 2627 139.162.153.39 - - [18/Oct/2026:13:04:13 +0000] "GET /207.148.6.135:443/.env HTTP/1.1" 207.148.6.135 200 2627 139.162.153.39 - - [18/Oct/2026:13:04:16 +0000] "GET /207.148.6.135:443/.env HTTP/1.1" show less	Port Scan
🇺🇸 kosada.com	2026-10-18 06:16:16 (1 week ago)	Repeated requests for suspicious nonexistent URLs, for example: /.env.www (HTTP/1.1 port 443, user agent: "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safa ... show more Repeated requests for suspicious nonexistent URLs, for example: /.env.www (HTTP/1.1 port 443, user agent: "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36") show less	Web App Attack
🇩🇪 webanyone	2026-10-18 05:07:52 (1 week ago)	Secret file probe \| method: GET \| path: /.env \| ua: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36	Hacking Web App Attack
🇳🇱 Alt255	2026-10-18 02:26:01 (1 week ago)	[cb-05al] Web exploit scanning: 1 suspicious requests detected by fail2ban jail apache-scanner. Example: 139.162.153.39 - - [18/Oct/2026:04:25:43 +0200] "GET /.env HTTP/1.1" 403 6291 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_1 ... show more [cb-05al] Web exploit scanning: 1 suspicious requests detected by fail2ban jail apache-scanner. Example: 139.162.153.39 - - [18/Oct/2026:04:25:43 +0200] "GET /.env HTTP/1.1" 403 6291 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36" ... show less	Bad Web Bot Web App Attack
Anonymous	2026-10-18 00:51:56 (1 week ago)	(caddyscan) Scanner path probe from 139.162.153.39 (DE/Germany/139-162-153-39.ip.linodeusercontent.com): 5 in the last 3600 secs; Ports: ; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: 207.148.6.135 200 2627 139.162.153.39 - - [18/Oct/2026:00:5 ... show more (caddyscan) Scanner path probe from 139.162.153.39 (DE/Germany/139-162-153-39.ip.linodeusercontent.com): 5 in the last 3600 secs; Ports: ; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: 207.148.6.135 200 2627 139.162.153.39 - - [18/Oct/2026:00:51:48 +0000] "GET /.env HTTP/1.1" 207.148.6.135 200 2627 139.162.153.39 - - [18/Oct/2026:00:51:49 +0000] "GET /207.148.6.135:443/.env HTTP/1.1" 207.148.6.135 200 2627 139.162.153.39 - - [18/Oct/2026:00:51:50 +0000] "GET /.env.www HTTP/1.1" 207.148.6.135 200 2627 139.162.153.39 - - [18/Oct/2026:00:51:51 +0000] "GET /207.148.6.135:443/.env HTTP/1.1" 207.148.6.135 200 2627 139.162.153.39 - - [18/Oct/2026:00:51:54 +0000] "GET /207.148.6.135:443/.env HTTP/1.1" show less	Port Scan
🇧🇪 voormedia	2026-10-18 00:43:14 (1 week ago)	Accessed trap at '/.env'	Web App Attack

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown

Recently Reported IPs:

🇦🇲 176.32.193.16

🇨🇴 69.6.234.27

🇵🇱 51.38.129.169

🇸🇬 47.84.130.19

🇬🇧 35.203.210.3

🇺🇸 195.184.76.143

🇺🇸 149.165.154.103

🇰🇷 112.164.239.83

🇵🇰 111.68.98.152

🇨🇭 107.189.29.61

🇮🇹 93.51.102.38

🇺🇦 91.198.249.113

🇷🇸 77.105.37.219

🇳🇱 77.91.71.36

🇺🇸 66.132.186.175

🇬🇧 64.227.40.241

🇮🇷 62.60.134.210

🇱🇹 62.60.130.91

🇮🇳 20.193.140.218

🇧🇷 16.5.0.228