JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 141.98.136.71

141.98.136.71 was found in our database!

This IP was reported 76 times. Confidence of Abuse is 100%: ?

100%

ISP	level66.network UG (haftungsbeschraenkt)
Usage Type	Data Center/Web Hosting/Transit
ASN	AS56381
Hostname(s)	nat64.level66.services
Domain Name	level66.network
Country	🇩🇪 Germany
City	Frankfurt am Main, Hesse

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 141.98.136.71

Whois 141.98.136.71

IP Abuse Reports for 141.98.136.71:

This IP address has been reported a total of 76 times from 34 distinct sources. 141.98.136.71 was first reported on May 24th 2025, and the most recent report was 1 day ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇳🇱 homeshowdomain.nl	2026-06-24 22:02:07 (1 day ago)	Auto-ban: single probe for restricted files (.env / backups / admin endpoints). Likely mass-scan on ... show more Auto-ban: single probe for restricted files (.env / backups / admin endpoints). Likely mass-scan on 2026-06-23. show less	Web App Attack SSH Hacking
🇩🇪 findlab	2026-06-24 21:40:01 (1 day ago)	Backdrop CMS module - malicious activity detected	Bad Web Bot Web App Attack
🇩🇪 FeG Deutschland	2026-06-24 21:21:12 (1 day ago)	Looking for CMS/PHP/SQL vulnerablilities/excessive crawling - 1247	Exploited Host Web App Attack
🇺🇸 agenciahypelab.com.br	2026-06-24 20:06:17 (1 day ago)	WordPress login brute-force detectado e bloqueado pelo CSF/LFD. Trigger: LF_TRIGGER	Brute-Force SSH
🇲🇾 Rizzy	2026-06-24 07:01:33 (2 days ago)	Multiple WAF Violations	Brute-Force Web App Attack
🇩🇪 gadix	2026-06-24 06:27:05 (2 days ago)	[24/Jun/2026:08:27:03.041955 +0200] ajt4t6FVHKCCTIiyOhZBkgAAAJI 141.98.136.71 60852 127.0.0.1 7080 [ ... show more [24/Jun/2026:08:27:03.041955 +0200] ajt4t6FVHKCCTIiyOhZBkgAAAJI 141.98.136.71 60852 127.0.0.1 7080 [24/Jun/2026:08:27:03.042709 +0200] ajt4t6FVHKCCTIiyOhZBlAAAAJM 141.98.136.71 60890 127.0.0.1 7080 [24/Jun/2026:08:27:04.869362 +0200] ajt4uEdOMlTqhyizsqHPuQAAAME 141.98.136.71 60916 127.0.0.1 7080 ... show less	Web App Attack
Anonymous	2026-06-24 05:55:06 (2 days ago)	Bot / scanning and/or hacking attempts: GET /.env.example HTTP/1.1, GET /.aws/credentials HTTP/1.1, ... show more Bot / scanning and/or hacking attempts: GET /.env.example HTTP/1.1, GET /.aws/credentials HTTP/1.1, GET /application.yml HTTP/1.1, GET /swagger.json HTTP/1.1 show less	Hacking Web App Attack
🇺🇸 TPI-Abuse	2026-06-24 04:40:05 (2 days ago)	(mod_security) mod_security (id:210492) triggered by 141.98.136.71 (nat64.level66.services): 1 in th ... show more (mod_security) mod_security (id:210492) triggered by 141.98.136.71 (nat64.level66.services): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jun 24 00:39:59.598685 2026] [security2:error] [pid 18619:tid 18619] [client 141.98.136.71:52598] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpcontacts.northernlightsbev.com"] [uri "/.env"] [unique_id "ajtfn2qA9t3KL45-MpzjOwAAABQ"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 mnsf	2026-06-24 02:32:55 (2 days ago)	Abuse Detected (2)	Brute-Force Web App Attack
🇬🇧 Oakley	2026-06-24 02:23:02 (2 days ago)	(confirmed_bot_sig) Confirmed bot	Hacking
🇺🇸 TPI-Abuse	2026-06-24 01:01:41 (2 days ago)	(mod_security) mod_security (id:210492) triggered by 141.98.136.71 (nat64.level66.services): 1 in th ... show more (mod_security) mod_security (id:210492) triggered by 141.98.136.71 (nat64.level66.services): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jun 23 21:01:36.917001 2026] [security2:error] [pid 12568:tid 12568] [client 141.98.136.71:50436] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "dinsbach.net"] [uri "/.env"] [unique_id "ajsscOwxW9PPChTkuV_lUgAAAAk"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 Matthew Ping	2026-06-24 00:45:18 (2 days ago)	ModSecurity rule 949110 triggered on wp2. Web application attack blocked by CSF/LFD.	Web App Attack Hacking
🇺🇸 TPI-Abuse	2026-06-24 00:26:18 (2 days ago)	(mod_security) mod_security (id:210492) triggered by 141.98.136.71 (nat64.level66.services): 1 in th ... show more (mod_security) mod_security (id:210492) triggered by 141.98.136.71 (nat64.level66.services): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jun 23 20:26:12.030029 2026] [security2:error] [pid 19080:tid 19080] [client 141.98.136.71:45530] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "andiamorun.com"] [uri "/.env.local"] [unique_id "ajskJI8XE1TNsylTXBD7DAAAAAI"] show less	Brute-Force Bad Web Bot Web App Attack
🇩🇪 mondor.ro	2026-06-23 22:37:15 (2 days ago)	Cluster member 148.251.176.225 (DE/Germany/antares.webyouridea.ro) said, DENY 141.98.136.71, Reason: ... show more Cluster member 148.251.176.225 (DE/Germany/antares.webyouridea.ro) said, DENY 141.98.136.71, Reason:[(mod_security) mod_security (id:210832) triggered by 141.98.136.71 (DE/Germany/nat64.level66.services): 3 in the last 3600 secs]; Ports: *; Direction: inout; Trigger: LF_CLUSTER; Logs: show less	Port Scan
🇺🇸 TPI-Abuse	2026-06-23 22:17:35 (2 days ago)	(mod_security) mod_security (id:210492) triggered by 141.98.136.71 (nat64.level66.services): 1 in th ... show more (mod_security) mod_security (id:210492) triggered by 141.98.136.71 (nat64.level66.services): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jun 23 18:17:31.188560 2026] [security2:error] [pid 9145:tid 9145] [client 141.98.136.71:57116] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "adamsclothiers.com"] [uri "/api/.env"] [unique_id "ajsF-_4XI1uBCPi_rlJT9AAAAAM"] show less	Brute-Force Bad Web Bot Web App Attack

Showing 1 to 15 of 76 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇳🇱 176.65.149.55

🇺🇸 104.152.52.131

🇸🇬 2402:1f00:8000:800::489e

🇯🇵 212.32.76.64

🇳🇱 176.65.139.219

🇺🇸 173.255.242.196

🇧🇷 170.80.38.162

🇬🇧 139.59.173.98

🇹🇼 111.70.23.238

🇺🇸 104.152.52.123

🇫🇮 80.223.198.246

🇹🇷 78.187.9.111

🇨🇳 61.191.145.123

🇨🇭 37.120.213.13

🇧🇷 20.226.81.217

🇨🇳 61.156.31.141

🇰🇷 59.20.85.112

🇬🇧 51.195.202.226

🇲🇾 49.124.151.16

🇩🇪 43.228.157.8