JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 139.99.125.80

139.99.125.80

Recent Activity

196 reports found in our database

100% ▲ ▲ ▲ Critical

Abuse confidence score ?

ISP

OVH Singapore PTE. LTD

Usage Type

Data Center/Web Hosting/Transit

ASN

AS16276

Hostname(s)

ns568396.ip-139-99-125.net

Domain Name

ovh.net

Country

🇸🇬 Singapore

City

Singapore

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report Whois

Top Reporter Countries (Last 60 Days)

Example preview

Report Categories (Last 60 Days)

Example preview

Reports Activity

Example preview

Account required for the enhanced features Log in Sign up

IP Abuse Reports for 139.99.125.80:

This IP address has been reported a total of 196 times from 149 distinct sources. 139.99.125.80 was first reported on September 4th 2026, and the most recent report was 2 minutes ago. In the last 60 days, the top reporter locations were: United States of America with 54 reports; Germany with 36 reports; France with 16 reports. The most common categories in these recent reports were: Brute-Force 124 times; SSH 97 times; Web App Attack 60 times; Bad Web Bot 29 times; Port Scan 24 times; Other 28 times.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇺🇸 TPI-Abuse	2026-09-05 13:35:11 (2 minutes ago)	(mod_security) mod_security (id:218420) triggered by 139.99.125.80 (ns568396.ip-139-99-125.net): 1 i ... show more (mod_security) mod_security (id:218420) triggered by 139.99.125.80 (ns568396.ip-139-99-125.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Sep 05 09:35:01.833367 2026] [security2:error] [pid 5984:tid 5984] [client 139.99.125.80:41434] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i)php://(std(in\|out\|err)\|(in\|out)put\|fd\|memory\|temp\|filter)" at ARGS_NAMES:\\xadd allow_url_include=1 \\xadd auto_prepend_file=php://input. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/21_PHP_PHPGen.conf"] [line "22"] [id "218420"] [rev "2"] [msg "COMODO WAF: PHP Injection Attack: I/O Stream Found\|\|192.64.150.244:80\|F\|2"] [data "Matched Data: php://input found within ARGS_NAMES:\\x5cxadd allow_url_include=1 \\x5cxadd auto_prepend_file=php://input: \\xadd allow_url_include=1 \\xadd auto_prepend_file=php://input"] [severity "CRITICAL"] [tag "CWAF"] [tag "PHPGen"] [hostname "192.64.150.244"] [uri "/hello.world"] [unique_id "apwahepKTnRBZGUiJlMiZAAAABA"] show less	Brute-Force Bad Web Bot Web App Attack
Anonymous	2026-09-05 13:23:54 (13 minutes ago)	fail2ban_an apache-modsecurity [msg "Inbound Anomaly Score Exceeded (Total Score: 28)"] [uri "/hello ... show more fail2ban_an apache-modsecurity [msg "Inbound Anomaly Score Exceeded (Total Score: 28)"] [uri "/hello.world"] show less	Bad Web Bot Web App Attack
Anonymous	2026-09-05 12:57:47 (39 minutes ago)	apache-auth	Brute-Force Web App Attack
🇩🇪 8legz.net	2026-09-05 12:36:14 (1 hour ago)	[Sat Sep 05 13:36:05.813947 2026] [php:error] [pid 2329988] [client 139.99.125.80:47150] script '/va ... show more [Sat Sep 05 13:36:05.813947 2026] [php:error] [pid 2329988] [client 139.99.125.80:47150] script '/var/www/html/index.php' not found or unable to stat [Sat Sep 05 13:36:06.185551 2026] [php:error] [pid 2329988] [client 139.99.125.80:47150] script '/var/www/html/index.php' not found or unable to stat [Sat Sep 05 13:36:13.482925 2026] [php:error] [pid 2329988] [client 139.99.125.80:47150] script '/var/www/html/index.php' not found or unable to stat ... show less	Brute-Force
🇸🇪 cybertailor	2026-09-05 12:25:08 (1 hour ago)	139.99.125.80 - - [05/Sep/2026:17:25:04 +0500] "POST /cgi-bin/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2 ... show more 139.99.125.80 - - [05/Sep/2026:17:25:04 +0500] "POST /cgi-bin/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/bin/sh HTTP/1.1" 400 150 "-" "-" 139.99.125.80 - - [05/Sep/2026:17:25:04 +0500] "POST /cgi-bin/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/bin/sh HTTP/1.1" 400 150 "-" "-" 139.99.125.80 - - [05/Sep/2026:17:25:05 +0500] "POST /hello.world?%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 404 146 "-" "libredtail-http" 139.99.125.80 - - [05/Sep/2026:17:25:05 +0500] "POST /?%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 404 146 "-" "libredtail-http" 139.99.125.80 - - [05/Sep/2026:17:25:05 +0500] "POST /index.php?%25ADd+allow_url_include%3D1+%25ADd+auto_prepend_file%3Dphp://input HTTP/1.1" 404 146 "-" "libredtail-http" ... show less	Port Scan
🇫🇮 Daniel Baer	2026-09-05 11:55:01 (1 hour ago)	CrowdSec local HTTP alert scenario: crowdsecurity/http-cve-2021-42013 alert_id: 6372 events: 1 creat ... show more CrowdSec local HTTP alert scenario: crowdsecurity/http-cve-2021-42013 alert_id: 6372 events: 1 created_at: 2026-09-05T11:52:57Z message: Ip 139.99.125.80 performed 'crowdsecurity/http-cve-2021-42013' (1 events over 0s) at 2026-09-05 11:52:57.645178057 +0000 UTC target_uri: ["/cgi-bin/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/bin/sh"] method: ["POST"] status: ["400"] user_agent: ["libredtail-http"] show less	Bad Web Bot Web App Attack
Anonymous	2026-09-05 11:52:01 (1 hour ago)	Blocked by ModSec and CSF	Port Scan
🇩🇪 ghostwarriors	2026-09-05 11:50:26 (1 hour ago)	Webpage scraping	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-09-05 11:39:51 (1 hour ago)	(mod_security) mod_security (id:218420) triggered by 139.99.125.80 (ns568396.ip-139-99-125.net): 1 i ... show more (mod_security) mod_security (id:218420) triggered by 139.99.125.80 (ns568396.ip-139-99-125.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Sep 05 07:39:45.488619 2026] [security2:error] [pid 12458:tid 12458] [client 139.99.125.80:60816] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i)php://(std(in\|out\|err)\|(in\|out)put\|fd\|memory\|temp\|filter)" at ARGS_NAMES:\\xadd allow_url_include=1 \\xadd auto_prepend_file=php://input. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/21_PHP_PHPGen.conf"] [line "22"] [id "218420"] [rev "2"] [msg "COMODO WAF: PHP Injection Attack: I/O Stream Found\|\|192.64.150.45:443\|F\|2"] [data "Matched Data: php://input found within ARGS_NAMES:\\x5cxadd allow_url_include=1 \\x5cxadd auto_prepend_file=php://input: \\xadd allow_url_include=1 \\xadd auto_prepend_file=php://input"] [severity "CRITICAL"] [tag "CWAF"] [tag "PHPGen"] [hostname "192.64.150.45"] [uri "/hello.world"] [unique_id "apv_gc81g5VRfRJNZvQ7UgAAAAA"] show less	Brute-Force Bad Web Bot Web App Attack
🇧🇬 pa4080	2026-09-05 11:31:45 (2 hours ago)	Detected by ModSecurity. Request URI: /?%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://in ... show more Detected by ModSecurity. Request URI: /?%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input show less	Hacking Web App Attack
🇧🇷 Halux	2026-09-05 11:30:58 (2 hours ago)	139.99.125.80 Probing protected path or service	Web App Attack
🇪🇸 masterguru	2026-09-05 11:30:45 (2 hours ago)	COMODO WAF: PHP Injection Attack: I/O Stream Found. Pattern match "(?i)php://(std(in\|out\|err)\|(in\|ou ... show more COMODO WAF: PHP Injection Attack: I/O Stream Found. Pattern match "(?i)php://(std(in\|out\|err)\|(in\|out)put\|fd\|memory\|temp\|filter)" at ARGS_NAMES:\\xadd allow_url_include=1 \\xadd auto_prepend_file=php://input. (218420-159) show less	Hacking
🇩🇪 gadix	2026-09-05 11:28:11 (2 hours ago)	[05/Sep/2026:13:28:08.051349 +0200] apv8yAmmgOwB87QxC8sangAAAAk 139.99.125.80 55566 127.0.0.1 7081 [ ... show more [05/Sep/2026:13:28:08.051349 +0200] apv8yAmmgOwB87QxC8sangAAAAk 139.99.125.80 55566 127.0.0.1 7081 [05/Sep/2026:13:28:08.246114 +0200] apv8yJ61MzCSMql-U2ZvZgAAAFQ 139.99.125.80 55580 127.0.0.1 7081 [05/Sep/2026:13:28:08.424179 +0200] apv8yJ61MzCSMql-U2ZvZwAAAEY 139.99.125.80 55592 127.0.0.1 7081 ... show less	Web App Attack
🇩🇪 bescared	2026-09-05 10:59:09 (2 hours ago)	F2B - Malicious activity detected. URL Probing. -151302cd-	Hacking Bad Web Bot Web App Attack
🇱🇹 Selckie	2026-09-05 10:56:11 (2 hours ago)	fail2ban: NGINX unusual impact	Web App Attack

Showing 1 to 15 of 196 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇻🇳 123.24.143.250

🇮🇳 103.214.63.127

🇮🇩 103.187.215.237

🇮🇩 103.113.171.119

🇮🇹 95.210.105.202

🇳🇱 77.91.71.66

🇩🇪 46.4.66.249

🇳🇱 45.148.10.119

🇷🇺 195.24.255.60

🇵🇱 185.233.25.226

🇵🇸 185.225.116.70

🇸🇬 152.42.221.98

🇨🇳 117.156.229.133

🇻🇳 116.110.156.95

🇳🇱 45.129.232.225

🇺🇸 34.106.0.236

🇺🇸 18.190.15.50

🇧🇷 187.85.19.99

🇨🇳 183.201.208.25

🇺🇸 147.185.132.17