JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 139.196.46.66

139.196.46.66 was found in our database!

This IP was reported 130 times. Confidence of Abuse is 0%: ?

ISP	Aliyun Computing Co., LTD
Usage Type	Data Center/Web Hosting/Transit
ASN	AS37963
Domain Name	alibabacloud.com
Country	🇨🇳 China
City	Shanghai, Shanghai

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 139.196.46.66

Whois 139.196.46.66

IP Abuse Reports for 139.196.46.66:

This IP address has been reported a total of 130 times from 58 distinct sources. 139.196.46.66 was first reported on March 19th 2024, and the most recent report was 1 year ago.

Old Reports: The most recent abuse report for this IP address is from 1 year ago . It is possible that this IP is no longer involved in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇩🇪 Packets-Decreaser.NET	2025-06-06 07:54:53 (1 year ago)	Incoming Layer 7 Flood Detected	DDoS Attack Web Spam
🇩🇪 paissangroup	2025-06-05 23:23:34 (1 year ago)	Multiple WAF Violations	Web App Attack
🇵🇱 jani.hu	2025-05-28 17:16:10 (1 year ago)	Hit on SSH honeypot at 2025-05-28 17:16:10 from 139.196.46.66 as user root with password pescator	Brute-Force SSH
🇦🇺 oncord	2025-05-28 16:48:28 (1 year ago)	Form spam	Web Spam
🇺🇸 TPI-Abuse	2025-05-22 20:47:55 (1 year ago)	(mod_security) mod_security (id:225170) triggered by 139.196.46.66 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:225170) triggered by 139.196.46.66 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu May 22 16:47:48.916032 2025] [security2:error] [pid 142877:tid 142877] [client 139.196.46.66:33517] [client 139.196.46.66] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)\|\|vanmeer.info\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "vanmeer.info"] [uri "/wp-json/wp/v2/users/"] [unique_id "aC-NdN8AnBRvU6en-UJC_QAAAAY"], referer: https://vanmeer.info/wp-json/wp/v2/users/ show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2025-05-20 17:37:50 (1 year ago)	(mod_security) mod_security (id:225170) triggered by 139.196.46.66 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:225170) triggered by 139.196.46.66 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue May 20 13:37:42.659727 2025] [security2:error] [pid 2466874:tid 2466874] [client 139.196.46.66:51942] [client 139.196.46.66] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)\|\|forwardti.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "forwardti.com"] [uri "/wp-json/wp/v2/users/"] [unique_id "aCy95qJvGtjiJq2E652wTAAAAA4"], referer: https://forwardti.com/wp-json/wp/v2/users/ show less	Brute-Force Bad Web Bot Web App Attack
🇬🇧 PulseServers	2025-05-17 00:16:40 (1 year ago)	SSH Brute-Force Attack on a server hosted by PulseServers.com - UK10 Honeypot ...	Brute-Force SSH
🇪🇸 librebit	2025-05-16 00:12:24 (1 year ago)	Brute force	Brute-Force
🇫🇮 paissangroup	2025-05-14 21:55:35 (1 year ago)	Multiple WAF Violations	Web App Attack
🇺🇸 TPI-Abuse	2025-05-12 02:27:30 (1 year ago)	(mod_security) mod_security (id:225170) triggered by 139.196.46.66 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:225170) triggered by 139.196.46.66 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun May 11 22:27:23.118339 2025] [security2:error] [pid 2115334:tid 2115334] [client 139.196.46.66:47091] [client 139.196.46.66] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)\|\|primacomm.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "primacomm.com"] [uri "/wp-json/wp/v2/users/"] [unique_id "aCFci0Or6tCrDak541824wAAAAM"], referer: https://primacomm.com/wp-json/wp/v2/users/ show less	Brute-Force Bad Web Bot Web App Attack
🇫🇷 adembaysal	2025-05-09 21:37:01 (1 year ago)	Rule : SMTP 05/10/25 00:33:58 1564 139.196.46.66 AUTH {blank} 535 Invalid Username or Password 34 10 ... show more Rule : SMTP 05/10/25 00:33:58 1564 139.196.46.66 AUTH {blank} 535 Invalid Username or Password 34 10 [email protected] show less	Email Spam Port Scan Spoofing
🇬🇧 Swiptly	2025-05-09 10:26:04 (1 year ago)	WordPress xmlrpc spam or enumeration ...	Web Spam Bad Web Bot Web App Attack
🇩🇪 LRob.fr	2025-05-09 00:01:19 (1 year ago)	Repeated requests on blocked xmlrpc.php, blocked by fail2ban in custom-503-xmlrpc jail	Bad Web Bot Web App Attack
🇩🇪 F242	2025-05-08 02:34:43 (1 year ago)	Wordpress Login or XMLRPC abuse	Web App Attack
🇫🇮 paissangroup	2025-05-03 21:55:37 (1 year ago)	Multiple WAF Violations	Web App Attack

Showing 1 to 15 of 130 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇬🇧 188.240.59.47

🇺🇸 150.107.38.189

🇨🇳 106.75.189.102

🇳🇱 45.148.10.157

🇸🇬 45.39.73.91

🇩🇪 31.220.0.26

🇳🇱 5.187.35.26

🇧🇷 177.37.141.36

🇺🇸 154.6.23.131

🇵🇰 139.135.59.131

🇺🇸 124.198.131.39

🇺🇸 104.43.242.4

🇵🇰 103.174.4.144

🇳🇱 91.92.40.19

🇷🇺 46.44.40.82

🇸🇬 43.133.32.159

🇬🇧 193.163.125.27

🇹🇷 185.148.240.112

🇧🇷 170.84.106.170

🇺🇸 147.182.218.213