JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 159.255.34.139

159.255.34.139 was found in our database!

This IP was reported 61 times. Confidence of Abuse is 100%: ?

100%

ISP	FIRST SERVER, SOCIEDAD LIMITADA
Usage Type	Data Center/Web Hosting/Transit
ASN	AS200740
Hostname(s)	vm3206548.firstbyte.club
Domain Name	first-server.net
Country	🇪🇸 Spain
City	Madrid, Madrid

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 159.255.34.139

Whois 159.255.34.139

IP Abuse Reports for 159.255.34.139:

This IP address has been reported a total of 61 times from 46 distinct sources. 159.255.34.139 was first reported on July 10th 2026, and the most recent report was 45 minutes ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇺🇸 TPI-Abuse	2026-07-11 08:30:57 (45 minutes ago)	(mod_security) mod_security (id:218420) triggered by 159.255.34.139 (vm3206548.firstbyte.club): 1 in ... show more (mod_security) mod_security (id:218420) triggered by 159.255.34.139 (vm3206548.firstbyte.club): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Jul 11 04:30:52.253643 2026] [security2:error] [pid 19005:tid 19005] [client 159.255.34.139:58698] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i)php://(std(in\|out\|err)\|(in\|out)put\|fd\|memory\|temp\|filter)" at ARGS_NAMES:\\xadd allow_url_include=1 \\xadd auto_prepend_file=php://input. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/21_PHP_PHPGen.conf"] [line "22"] [id "218420"] [rev "2"] [msg "COMODO WAF: PHP Injection Attack: I/O Stream Found\|\|192.64.150.212:80\|F\|2"] [data "Matched Data: php://input found within ARGS_NAMES:\\x5cxadd allow_url_include=1 \\x5cxadd auto_prepend_file=php://input: \\xadd allow_url_include=1 \\xadd auto_prepend_file=php://input"] [severity "CRITICAL"] [tag "CWAF"] [tag "PHPGen"] [hostname "192.64.150.212"] [uri "/hello.world"] [unique_id "alH_PEs2FOyDckR_E2UR_QAAAA8"] show less	Brute-Force Bad Web Bot Web App Attack
🇪🇸 elcruzado.es	2026-07-11 08:09:27 (1 hour ago)	159.255.34.139 (ES/Spain/vm3206548.firstbyte.club), 8 distributed sshd attacks on account [redacted]	Brute-Force SSH
🇩🇪 psauxit	2026-07-11 07:53:38 (1 hour ago)	Fail2Ban - NGINX bad requests 400-401-403-404-444, high level vulnerability scanning, commonly xmlrp ... show more Fail2Ban - NGINX bad requests 400-401-403-404-444, high level vulnerability scanning, commonly xmlrpc_attack, wp-login brute force, excessive crawling/scraping show less	Web App Attack Hacking
Anonymous	2026-07-11 07:35:33 (1 hour ago)	SSH BruteForce attack	SSH
Anonymous	2026-07-11 07:34:03 (1 hour ago)	Bot / scanning and/or hacking attempts: POST /cgi-bin/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/. ... show more Bot / scanning and/or hacking attempts: POST /cgi-bin/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e show less	Hacking Web App Attack
Anonymous	2026-07-11 06:41:50 (2 hours ago)	Repeated unauthorized connection attempts to restricted service observed.	Port Scan Hacking Bad Web Bot Web App Attack
🇨🇦 canine.tools	2026-07-11 06:07:22 (3 hours ago)	[fail2ban Auto Report] 2026-07-11T06:07:22.337117+00:00 omega sshd[893267]: Invalid user admin from ... show more [fail2ban Auto Report] 2026-07-11T06:07:22.337117+00:00 omega sshd[893267]: Invalid user admin from 159.255.34.139 port 44468 ... show less	Brute-Force SSH
🇿🇦 antman	2026-07-11 05:41:14 (3 hours ago)	csagent: score 23.8: 404 noise floor x3, phpunit eval-stdin RCE x2, php 404 x2; 1 domain(s) in 0s	Web App Attack
Anonymous	2026-07-11 05:15:12 (4 hours ago)	unsolicited connect TCP dport 22 (sport 52485)	Hacking
🇺🇸 TPI-Abuse	2026-07-11 05:05:41 (4 hours ago)	(mod_security) mod_security (id:218420) triggered by 159.255.34.139 (vm3206548.firstbyte.club): 1 in ... show more (mod_security) mod_security (id:218420) triggered by 159.255.34.139 (vm3206548.firstbyte.club): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Jul 11 01:05:34.576661 2026] [security2:error] [pid 28611:tid 28611] [client 159.255.34.139:56540] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i)php://(std(in\|out\|err)\|(in\|out)put\|fd\|memory\|temp\|filter)" at ARGS_NAMES:\\xadd allow_url_include=1 \\xadd auto_prepend_file=php://input. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/21_PHP_PHPGen.conf"] [line "22"] [id "218420"] [rev "2"] [msg "COMODO WAF: PHP Injection Attack: I/O Stream Found\|\|192.64.150.58:80\|F\|2"] [data "Matched Data: php://input found within ARGS_NAMES:\\x5cxadd allow_url_include=1 \\x5cxadd auto_prepend_file=php://input: \\xadd allow_url_include=1 \\xadd auto_prepend_file=php://input"] [severity "CRITICAL"] [tag "CWAF"] [tag "PHPGen"] [hostname "192.64.150.58"] [uri "/hello.world"] [unique_id "alHPHsTWNNlmpjHsLP2XIgAAAAg"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 MPL	2026-07-11 04:30:35 (4 hours ago)	tcp ports: 22,2375 (6 or more attempts)	Port Scan
🇩🇪 andorin	2026-07-11 04:05:06 (5 hours ago)	SSH/Telnet honeypot (endlessh) on habith.eu: 1 connection attempts trapped, total tarpit time 20s. A ... show more SSH/Telnet honeypot (endlessh) on habith.eu: 1 connection attempts trapped, total tarpit time 20s. Automated report. show less	Port Scan Brute-Force SSH
🇫🇷 pm33	2026-07-11 03:40:46 (5 hours ago)	Probing for resource vulnerabilities HTTP(S)	Web App Attack
🇺🇸 xmission.com	2026-07-11 03:19:54 (5 hours ago)	Blocked by UFW (TCP on 80) Source port: 48775 TTL: 46 Packet length: 40 TOS: 0x08 This report (for ... show more Blocked by UFW (TCP on 80) Source port: 48775 TTL: 46 Packet length: 40 TOS: 0x08 This report (for 159.255.34.139) was generated by: https://github.com/sefinek/UFW-AbuseIPDB-Reporter show less	Port Scan Web App Attack
🇺🇸 RAP	2026-07-11 03:16:56 (5 hours ago)	2026-07-11 03:16:56 UTC Unauthorized activity to TCP port 23. Telnet	Port Scan

Showing 1 to 15 of 61 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇦🇲 178.160.211.25

🇺🇸 172.253.198.154

🇮🇳 124.123.150.65

🇲🇽 187.189.110.205

🇺🇸 172.212.201.77

🇳🇬 165.154.10.201

🇺🇸 162.217.100.196

🇺🇸 67.241.132.98

🇬🇧 35.203.210.22

🇧🇪 198.235.24.174

🇸🇬 172.217.32.155

🇱🇹 45.227.254.170

🇭🇰 194.5.83.71

🇻🇳 103.195.239.165

🇮🇹 88.147.30.59

🇳🇱 82.27.0.184

🇬🇧 82.13.71.207

🇳🇱 46.151.178.13

🇳🇱 45.148.10.157

🇳🇱 45.142.193.35