JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

159.26.109.59

Recent Activity

Abuse confidence score ?

100% Critical

70 reports

46 reporters · latest 2 hours ago

ISP	PV-SL-HOSTED-Vienna-Network
Usage Type	Data Center/Web Hosting/Transit
ASN	AS208172
Domain Name	ip.me
Country	🇦🇹 Austria
City	Vienna, Vienna

ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report Whois

Reports Activity

Example preview

Report Categories (Last 60 Days)

Example preview

Top Reporter Countries (Last 60 Days)

Example preview

Account required for the enhanced features Log in Sign up

IP Abuse Reports for 159.26.109.59

Export CSV

This IP address has been reported a total of 70 times from 46 distinct sources. 159.26.109.59 was first reported on April 28th 2026, and the most recent report was 2 hours ago. In the last 60 days, the top reporter locations were: United States of America with 16 reports; Germany with 11 reports; Netherlands with 10 reports. The most common categories in these recent reports were: Web App Attack 52 times; Bad Web Bot 27 times; Brute-Force 22 times; Hacking 19 times; Port Scan 8 times; Other 6 times.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇩🇪 loveprod	2026-10-13 09:55:06 (2 hours ago)	159.26.109.59 - - [13/Oct/2026:12:55:03 +0300] "GET /.env HTTP/2.0" 403 553 "-" "Mozilla/5.0 (iPhone ... show more 159.26.109.59 - - [13/Oct/2026:12:55:03 +0300] "GET /.env HTTP/2.0" 403 553 "-" "Mozilla/5.0 (iPhone; CPU iPhone OS 10_3 like Mac OS X) AppleWebKit/602.1.50 (KHTML, like Gecko) CriOS/56.0.2924.75 Mobile/14E5239e YisouSpider/5.0 Safari/602." 159.26.109.59 - - [13/Oct/2026:12:55:04 +0300] "GET /.env.example HTTP/2.0" 403 375 "-" "Mozilla/5.0 (iPhone; CPU iPhone OS 10_3 like Mac OS X) AppleWebKit/602.1.50 (KHTML, like Gecko) CriOS/56.0.2924.75 Mobile/14E5239e YisouSpider/5.0 Safari/602." ... show less	Bad Web Bot
🇫🇷 ingroscart.it	2026-10-12 21:19:26 (15 hours ago)	(mod_security) mod_security triggered on hostname [redacted])	SQL Injection
Anonymous	2026-10-12 19:07:34 (17 hours ago)	http scanning for .env files ...	Hacking Web App Attack
🇺🇸 FreeMyIP	2026-10-12 18:14:02 (18 hours ago)	Automated fail2ban report: web application attack / scanning for exploitable paths.	Bad Web Bot Web App Attack
🇵🇱 Budyn	2026-10-12 15:45:04 (20 hours ago)	Automated threat detected by Budyn Honeypot Sinkhole. Attack type: Enterprise & Framework Recon Scan ... show more Automated threat detected by Budyn Honeypot Sinkhole. Attack type: Enterprise & Framework Recon Scanner. Malicious scanner triggered a security trap targeting emulated vulnerabilities. Evidence: HOST: shop.dont-eat-the-pudding.xyz \| URI: /.env \| UA: Mozilla/5.0 (X11; Linux i686; rv:128.0) Gecko/20100101 Firefox/128.0 \| BODY: [Empty / GET Request] show less	Bad Web Bot Web App Attack
🇳🇱 Alt255	2026-10-12 14:19:35 (22 hours ago)	[cb-15al] Web exploit scanning: 1 suspicious requests detected by fail2ban jail apache-scanner. Exam ... show more [cb-15al] Web exploit scanning: 1 suspicious requests detected by fail2ban jail apache-scanner. Example: 159.26.109.59 - - [12/Oct/2026:16:19:31 +0200] "GET /.env.example HTTP/2.0" 404 51615 "-" "Mozilla/5.0 (Linux; Android 10; VOG-L29) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.6998.135 Mobile Safari/537.36 OPR/76.2.4027.73374" ... show less	Bad Web Bot Web App Attack
🇳🇱 BlueWire Hosting	2026-10-12 12:05:17 (1 day ago)	High-confidence malicious configuration/VCS probe	Web App Attack
🇺🇸 Starburst SysOp Team	2026-10-12 11:15:20 (1 day ago)	Restricted File Access Attempt. Matched phrase ".env" at REQUEST_FILENAME. (930130-mnz6-1)	Hacking Web App Attack
🇺🇸 TPI-Abuse	2026-10-12 11:02:29 (1 day ago)	(mod_security) mod_security (id:210492) triggered by 159.26.109.59 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:210492) triggered by 159.26.109.59 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Oct 12 07:02:22.961692 2026] [security2:error] [pid 13608:tid 13608] [client 159.26.109.59:0] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "demondomain.com"] [uri "/.env.example"] [unique_id "asy-PgZuJ-F1rEk98LlDSAAAAAY"] show less	Brute-Force Bad Web Bot Web App Attack
🇩🇪 tsZero	2026-10-12 06:52:00 (1 day ago)	Scan example: path=/.env status=404	Hacking
🇨🇦 Sakusen	2026-10-12 04:31:20 (1 day ago)	Automated web attack: 2 reqs, 2 paths probed; probed: 2 .env	Hacking Web App Attack
🇺🇸 Vano Ganzzz	2026-10-11 23:29:45 (1 day ago)	Triggered Cloudflare WAF (firewallCustom) from AT. Action taken: BLOCK ASN: 208172 (Proton AG) Proto ... show more Triggered Cloudflare WAF (firewallCustom) from AT. Action taken: BLOCK ASN: 208172 (Proton AG) Protocol: HTTP/2 (GET method) Endpoint: /.env.example Timestamp: 2026-10-11T23:29:45Z Ray ID: a491a6133d7bd8dc UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.1958 show less	Bad Web Bot
🇬🇧 pinguin	2026-10-11 21:25:49 (1 day ago)	Triggered Cloudflare WAF (firewallManaged) from AT. Action taken: BLOCK Protocol: HTTP/2 (GET method ... show more Triggered Cloudflare WAF (firewallManaged) from AT. Action taken: BLOCK Protocol: HTTP/2 (GET method) Endpoint: /.env UA: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:136.0) Gecko/20100101 Firefox/136.0 This report was generated by: https://github.com/sefinek/Cloudflare-WAF-To-AbuseIPDB show less	Bad Web Bot
🇳🇱 e.fierstra	2026-10-11 17:37:14 (1 day ago)	ModSecurity hits exceeded	Bad Web Bot Web App Attack
Anonymous	2026-10-11 16:35:25 (1 day ago)	Failed login attempt detected by Fail2Ban in plesk-modsecurity jail	Exploited Host

Showing 1 to 15 of 70 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇯🇴 176.29.161.231

🇲🇽 201.149.53.243

🇺🇸 188.215.127.140

🇺🇸 162.216.149.55

🇰🇷 112.161.64.234

🇺🇦 94.131.219.185

🇨🇦 85.217.149.72

🇸🇪 217.60.121.102

🇲🇽 216.28.132.7

🇸🇬 193.37.32.214

🇩🇪 172.69.151.205

🇦🇷 149.107.233.150

🇺🇸 103.146.52.157

🇬🇧 35.203.211.34

🇺🇸 34.73.33.160

🇳🇱 34.12.242.15

🇺🇸 20.65.202.124

🇨🇴 206.84.81.185

🇮🇩 202.51.214.99

🇳🇱 185.2.80.253