JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 139.162.157.112

139.162.157.112 was found in our database!

This IP was reported 28 times. Confidence of Abuse is 100%: ?

100%

ISP	139.162.0.0/16
Usage Type	Data Center/Web Hosting/Transit
ASN	AS63949
Hostname(s)	139-162-157-112.ip.linodeusercontent.com
Domain Name	linode.com
Country	🇩🇪 Germany
City	Frankfurt am Main, Hesse

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 139.162.157.112

Whois 139.162.157.112

IP Abuse Reports for 139.162.157.112:

This IP address has been reported a total of 28 times from 24 distinct sources. 139.162.157.112 was first reported on June 11th 2022, and the most recent report was 47 minutes ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇳🇱 e.fierstra	2026-07-09 22:42:03 (47 minutes ago)	ModSecurity hits exceeded	Bad Web Bot Web App Attack
🇩🇪 igerman	2026-07-09 19:55:49 (3 hours ago)	caddy probes: cloud-creds: GET /.aws/credentials(DROP) \| env-probe: GET /.env.development(DROP), GET ... show more caddy probes: cloud-creds: GET /.aws/credentials(DROP) \| env-probe: GET /.env.development(DROP), GET /.env.local(DROP), GET /.env.prod(DROP), GET /.env.production(DROP) \| git-repo: GET /.git/config(DROP) \| web: GET /.docker/config.json(DROP), GET /.gitconfig(DROP), GET /.github/workflows/*.yml(DROP), GET /.travis.yml(DROP), GET /application.yml(DROP), GET /appsettings.Development.json(DROP), GET /appsettings.json(DROP), GET /aws_config.php(DROP), GET /config.yml(DROP), GET /config/database.yml(DROP), GET /database.sql.gz(DROP), GET /database.yml(DROP), GET /db.sql(DROP), GET /db.sql.gz(DROP), GET /docker-compose.prod.yml(DROP), GET /docker-compose.yml(DROP), GET /phpinfo(DROP), GET /settings.py(DROP), GET /web.config(DROP) show less	Web App Attack
🇩🇪 juutis	2026-07-09 19:50:51 (3 hours ago)	Multiple WAF abuses - IP blocked	Hacking Brute-Force Web App Attack
🇪🇸 alferez	2026-07-09 19:41:17 (3 hours ago)	Searching .(env\|sql\|zip\|tar\|rar) files	Hacking Exploited Host Web App Attack
🇦🇺 paulshipley.com.au	2026-07-09 19:31:06 (3 hours ago)	[Fri Jul 10 05:31:05.616835 2026] [security2:error] [pid 552048] [client 139.162.157.112:52718] [cli ... show more [Fri Jul 10 05:31:05.616835 2026] [security2:error] [pid 552048] [client 139.162.157.112:52718] [client 139.162.157.112] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/modsecurity/crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.4"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "paulshipley.com.au"] [uri "/app.log"] [unique_id "ak_2-egd4acs6zCxk5wvkgAAAAY"] ... show less	Web App Attack
🇧🇪 voormedia	2026-07-08 23:41:04 (23 hours ago)	Accessed trap at '/.env'	Web App Attack
🇺🇸 Shouddy Tarano	2026-07-08 00:11:08 (1 day ago)	[Tue Jul 07 18:11:06.695208 2026] [authz_core:error] [pid 4100273:tid 139792276756224] [client 139.1 ... show more [Tue Jul 07 18:11:06.695208 2026] [authz_core:error] [pid 4100273:tid 139792276756224] [client 139.162.157.112:36256] AH01630: client denied by server configuration: /var/www/html/ [Tue Jul 07 18:11:06.703278 2026] [authz_core:error] [pid 4100273:tid 139792276756224] [client 139.162.157.112:36256] AH01630: client denied by server configuration: /usr/share/httpd/noindex/index.html [Tue Jul 07 18:11:07.006485 2026] [authz_core:error] [pid 36504:tid 139792335439616] [client 139.162.157.112:36260] AH01630: client denied by server configuration: /var/www/html/ [Tue Jul 07 18:11:07.009943 2026] [authz_core:error] [pid 36504:tid 139792335439616] [client 139.162.157.112:36260] AH01630: client denied by server configuration: /usr/share/httpd/noindex/index.html [Tue Jul 07 18:11:07.186900 2026] [authz_core:error] [pid 36504:tid 139792301868800] [client 139.162.157.112:36260] AH01630: client denied by server configuration: /var/www/html/.env ... show less	DDoS Attack Web Spam Brute-Force Web App Attack
🇺🇸 antlac1	2026-07-07 22:52:55 (2 days ago)	crowdsecurity/http-sensitive-files	Brute-Force Web App Attack
🇩🇪 dbmwebdesign	2026-07-07 17:10:19 (2 days ago)	WAF repeated trigger detected by Fail2Ban in plesk-modsecurity jail	Web App Attack
🇫🇷 masterguru	2026-07-06 10:58:06 (3 days ago)	(modsec_5015) ModSec 5015: Suspicious User-Agent from 139.162.157.112 (DE/Germany/139-162-157-112.ip ... show more (modsec_5015) ModSec 5015: Suspicious User-Agent from 139.162.157.112 (DE/Germany/139-162-157-112.ip.linodeusercontent.com): 1 in the last 3600 secs (0-195) show less	Hacking
🇫🇮 23p02732	2026-07-06 01:13:38 (3 days ago)	Mailserver and mailaccount attacks	Brute-Force Bad Web Bot Exploited Host Web App Attack
🇺🇸 kuroneko_omu	2026-07-05 22:38:04 (4 days ago)	Fail2Ban <webattack> jail detected 5 attempts against 139.162.157.112.	DDoS Attack Hacking Brute-Force Web App Attack
🇧🇪 voormedia	2026-07-05 18:16:37 (4 days ago)	Accessed trap at '/docker-compose.yml'	Web App Attack
🇩🇪 tentwentyfour	2026-07-05 15:10:54 (4 days ago)	Blocked for probing for sensitive web application components	Brute-Force Web App Attack
🇫🇮 Daniel Baer	2026-07-04 20:35:01 (5 days ago)	CrowdSec local HTTP alert scenario: crowdsecurity/http-probing alert_id: 374 events: 11 created_at: ... show more CrowdSec local HTTP alert scenario: crowdsecurity/http-probing alert_id: 374 events: 11 created_at: 2026-07-04T20:31:51Z message: Ip 139.162.157.112 performed 'crowdsecurity/http-probing' (11 events over 1.976982567s) at 2026-07-04 20:31:50.775273976 +0000 UTC target_uri: ["/docker-compose.yml","/app.log","/wp-config.php","/Dockerfile","/_admin","/app/","/api/auth","/angular","/config.py","/debug/","/_test"] method: ["GET"] status: ["404"] user_agent: ["Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36"] show less	Bad Web Bot Web App Attack

Showing 1 to 15 of 28 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇬🇧 195.206.169.200

🇺🇸 165.232.143.119

🇭🇰 123.58.210.86

🇨🇳 120.193.9.169

🇭🇰 104.208.108.166

🇨🇱 45.170.102.202

🇳🇱 45.156.128.54

🇳🇱 34.187.68.199

🇩🇪 2a04:4e40:e000:0:489:407:fcf8:a501

🇨🇳 221.229.220.180

🇧🇩 202.4.122.181

🇨🇳 180.76.183.185

🇸🇬 47.128.112.23

🇳🇱 178.16.54.74

🇭🇰 156.225.1.87

🇸🇬 128.199.138.138

🇦🇹 109.70.100.11

🇨🇳 101.126.143.152

🇳🇱 45.148.10.200

🇬🇧 35.203.210.37