Neutral Activity
There is no recent abuse activity, or the IP address is whitelisted.
Whitelisted Subnet
Whitelisted netblocks are typically owned by trusted entities, such as Google or Microsoft who
may use them for search engine spiders. However, these same entities sometimes also provide cloud
servers and mail services which are easily abused. Pay special attention when trusting or
distrusting these IPs.
This IP address has been reported a total of
20
times from
10 distinct
sources.
139.87.112.140 was first reported on
, and the most recent report was
.
In the last 60 days, the top reporter locations were:
Germany
with 2
reports;
Panama
with 1
report.
The most common categories in these recent reports were:
Web App Attack
3
times;
Bad Web Bot
2
times.
Old Reports
The most recent abuse report for this IP address is from
. It is possible that this IP is no
longer involved in abusive activities.
Vulnerability scanner: probed 554 unique paths against nginx vserver adsproxycsp1-1.ssl207, ~1163 re ...
show moreVulnerability scanner: probed 554 unique paths against nginx vserver adsproxycsp1-1.ssl207, ~1163 requests, all returned 403. Same scan signature as 139.87.112.69 (same /24, same probe set): /system/login, /status/ path-traversal variants (%c0%ae, %e0%80%ae, %f0%80%80%ae overlong UTF-8 encodings), /metrics, /system/database/drivers/mssql/index.html, /rest/api/latest/repos (Bitbucket API probe).
show less
Automated web-application vulnerability scan against our reverse-proxy edge node adsproxycsp1-1.sor2 ...
show moreAutomated web-application vulnerability scan against our reverse-proxy edge node adsproxycsp1-1.sor225 (Oregon DC) on 2026-09-05: 142 requests covering 71 unique probe paths targeting known CMS/admin-panel fingerprints (e.g. /sap/public/bc/ur/Login/assets/corbu/sap_logo.png, /templates/advancedThemeWbFlat/images/user.png, /media/users/admin/faceyourmanga_admin_girl.png, /include/SugarCharts/swf/pieChart.swf, /theme/eldy/img/object_company.png). Same probe set as concurrent scans from 139.87.112.72 and 139.87.112.48 against sibling hosts, all part of one coordinated sweep from the 139.87.112.0/24 range. All requests returned HTTP 404. Identified via nginx access/error log analysis.
show less
Bad Web Bot
Web App Attack
Anonymous
Automated vulnerability scanning and sensitive file probing against a secured web server. Attempted ...
show moreAutomated vulnerability scanning and sensitive file probing against a secured web server. Attempted access to sensitive configuration files and common vulnerability paths.
show less
Brute-Force
Web App Attack
Anonymous
Automated vulnerability scanning and sensitive file probing against a secured web server. Attempted ...
show moreAutomated vulnerability scanning and sensitive file probing against a secured web server. Attempted access to sensitive configuration files and common vulnerability paths.
show less
{"level":"info","ts":1767693551.452612,"logger":"http.log.access.log1","msg":"handled request","requ ...
show more{"level":"info","ts":1767693551.452612,"logger":"http.log.access.log1","msg":"handled request","request":{"remote_ip":"139.87.112.140","remote_port":"35276","client_ip":"139.87.112.140","proto":"HTTP/1.1","method":"GET","host":"159.89.98.98","uri":"/","headers":{"Connection":["Keep-Alive"],"User-Agent":["QualysGuard"],"Qualys-Scan":["VM"]}},"bytes_read":0,"user_id":"","duration":0.0000605,"size":0,"status":308,"resp_headers":{"Server":["Caddy"],"Connection":["close"],"Location":["https://159.89.98.98/"],"Content-Type":[]}}
{"level":"info","ts":1767693671.037363,"logger":"http.log.access.log1","msg":"handled request","request":{"remote_ip":"139.87.112.140","remote_port":"35716","client_ip":"139.87.112.140","proto":"HTTP/1.1","method":"GET","host":"159.89.98.98","uri":"/","headers":{}},"bytes_read":0,"user_id":"","duration":0.00005667,"size":0,"status":308,"resp_headers":{"Server":["Caddy"],"Connection":["close"],"Location":["https://159.89.98.98/"],"Content-Type":[]}}
{"level":"info","t
...
show less
blocked for webapp attack | path requested: /console/css/%252E%252E%252Fconsole.portlet | seen at 20 ...
show moreblocked for webapp attack | path requested: /console/css/%252E%252E%252Fconsole.portlet | seen at 2025-12-15 14:49:19.806 |
show less
{"level":"info","ts":1762330065.7212,"logger":"http.log.access.log1","msg":"handled request","reques ...
show more{"level":"info","ts":1762330065.7212,"logger":"http.log.access.log1","msg":"handled request","request":{"remote_ip":"139.87.112.140","remote_port":"52704","client_ip":"139.87.112.140","proto":"HTTP/1.1","method":"GET","host":"159.89.98.98","uri":"/","headers":{}},"bytes_read":0,"user_id":"","duration":0.00004702,"size":0,"status":308,"resp_headers":{"Content-Type":[],"Server":["Caddy"],"Connection":["close"],"Location":["https://159.89.98.98/"]}}
{"level":"info","ts":1762330066.600105,"logger":"http.log.access.log1","msg":"handled request","request":{"remote_ip":"139.87.112.140","remote_port":"52936","client_ip":"139.87.112.140","proto":"HTTP/1.1","method":"GET","host":"159.89.98.98","uri":"/DeviceInformation","headers":{}},"bytes_read":0,"user_id":"","duration":0.00005681,"size":0,"status":308,"resp_headers":{"Connection":["close"],"Location":["https://159.89.98.98/DeviceInformation"],"Content-Type":[],"Server":["Caddy"]}}
{"level":"info","ts":1762330066.883944,"logger":"http.log.acce
...
show less
