Neutral Activity
There is no recent abuse activity, or the IP address is whitelisted.
Whitelisted Subnet
Whitelisted netblocks are typically owned by trusted entities, such as Google or Microsoft who
may use them for search engine spiders. However, these same entities sometimes also provide cloud
servers and mail services which are easily abused. Pay special attention when trusting or
distrusting these IPs.
This IP address has been reported a total of
42
times from
13 distinct
sources.
139.87.112.17 was first reported on
, and the most recent report was
.
In the last 60 days, the top reporter locations were:
Israel
with 1
report;
Panama
with 1
report.
The most common categories in these recent reports were:
Web App Attack
2
times;
Hacking
1
time.
Old Reports
The most recent abuse report for this IP address is from
. It is possible that this IP is no
longer involved in abusive activities.
Automated vulnerability scanner hitting our nginx reverse proxy. 2543 requests across 1020 unique UR ...
show moreAutomated vulnerability scanner hitting our nginx reverse proxy. 2543 requests across 1020 unique URLs, all rejected with HTTP 403/405. Probed paths include /xmlrpc.php (WordPress), /geoserver/wms (GeoServer RCE), /system/login, /nf/auth/doAuthentication.do, /p/u/doAuthentication.do (admin/auth probes), guestbook_entries. Requests sent both to bare server IP and hostname. Not a legitimate client.
show less
{"level":"info","ts":1769580634.6884162,"logger":"http.log.access.log1","msg":"handled request","req ...
show more{"level":"info","ts":1769580634.6884162,"logger":"http.log.access.log1","msg":"handled request","request":{"remote_ip":"139.87.112.17","remote_port":"49186","client_ip":"139.87.112.17","proto":"HTTP/1.1","method":"GET","host":"159.89.98.98","uri":"/","headers":{"Connection":["Keep-Alive"],"User-Agent":["QualysGuard"],"Qualys-Scan":["VM"]}},"bytes_read":0,"user_id":"","duration":0.00005687,"size":0,"status":308,"resp_headers":{"Server":["Caddy"],"Connection":["close"],"Location":["https://159.89.98.98/"],"Content-Type":[]}}
{"level":"info","ts":1769580758.110445,"logger":"http.log.access.log1","msg":"handled request","request":{"remote_ip":"139.87.112.17","remote_port":"36612","client_ip":"139.87.112.17","proto":"HTTP/1.1","method":"GET","host":"159.89.98.98","uri":"/","headers":{}},"bytes_read":0,"user_id":"","duration":0.000050769,"size":0,"status":308,"resp_headers":{"Server":["Caddy"],"Connection":["close"],"Location":["https://159.89.98.98/"],"Content-Type":[]}}
{"level":"info","ts
...
show less
{"level":"info","ts":1760412095.8484185,"logger":"http.log.access.log1","msg":"handled request","req ...
show more{"level":"info","ts":1760412095.8484185,"logger":"http.log.access.log1","msg":"handled request","request":{"remote_ip":"139.87.112.17","remote_port":"48812","client_ip":"139.87.112.17","proto":"HTTP/1.1","method":"GET","host":"159.89.98.98","uri":"/","headers":{}},"bytes_read":0,"user_id":"","duration":0.00005342,"size":0,"status":308,"resp_headers":{"Server":["Caddy"],"Connection":["close"],"Location":["https://159.89.98.98/"],"Content-Type":[]}}
{"level":"info","ts":1760412096.6875315,"logger":"http.log.access.log1","msg":"handled request","request":{"remote_ip":"139.87.112.17","remote_port":"49050","client_ip":"139.87.112.17","proto":"HTTP/1.1","method":"GET","host":"159.89.98.98","uri":"/DeviceInformation","headers":{}},"bytes_read":0,"user_id":"","duration":0.000053279,"size":0,"status":308,"resp_headers":{"Location":["https://159.89.98.98/DeviceInformation"],"Content-Type":[],"Server":["Caddy"],"Connection":["close"]}}
{"level":"info","ts":1760412096.9715025,"logger":"http.log.ac
...
show less
2025-09-18T02:05:46.439189+00:00 proxy sshd[152654]: Invalid user NoSuchUser from 139.87.112.17 port ...
show more2025-09-18T02:05:46.439189+00:00 proxy sshd[152654]: Invalid user NoSuchUser from 139.87.112.17 port 57960
...
show less
2025/09/18 01:41:33 [error] 120171#120171: *11956 user "admin" was not found in "/etc/nginx/sites-av ...
show more2025/09/18 01:41:33 [error] 120171#120171: *11956 user "admin" was not found in "/etc/nginx/sites-available/mpb.htpasswrd", client: 139.87.112.17, server: mpb.mulders.it, request: "GET /services HTTP/1.1", host: "138.2.135.56"
2025/09/18 01:41:35 [error] 120171#120171: *11965 user "admin" was not found in "/etc/nginx/sites-available/mpb.htpasswrd", client: 139.87.112.17, server: mpb.mulders.it, request: "GET /services HTTP/1.1", host: "138.2.135.56"
2025/09/18 01:48:33 [error] 120173#120173: *14454 user "admin" was not found in "/etc/nginx/sites-available/mpb.htpasswrd", client: 139.87.112.17, server: mpb.mulders.it, request: "GET / HTTP/1.1", host: "138.2.135.56"
2025/09/18 01:48:34 [error] 120173#120173: *14454 user "admin" was not found in "/etc/nginx/sites-available/mpb.htpasswrd", client: 139.87.112.17, server: mpb.mulders.it, request: "GET /passwd.cgi HTTP/1.1", host: "138.2.135.56"
2025/09/18 01:48:54 [error] 120171#120171: *14528 user "admin" was not found in "/etc/nginx/sites-
...
show less
Web App Attack
Anonymous
This IP was involved in a brute force and password spray attack.
