JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 162.158.6.139

162.158.6.139 was found in our database!

This IP was reported 157 times. Confidence of Abuse is 0%: ?

ISP	Cloudflare, Inc.
Usage Type	Data Center/Web Hosting/Transit
ASN	AS13335
Domain Name	cloudflare.com
Country	🇮🇪 Ireland
City	Dublin, Leinster

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Important Note: 162.158.6.139 is an IP address from within our whitelist belonging to the subnet 162.158.0.0/15, which we identify as: "Cloudflare Reverse Proxy".

Whitelisted netblocks are typically owned by trusted entities, such as Google or Microsoft who may use them for search engine spiders. However, these same entities sometimes also provide cloud servers and mail services which are easily abused. Pay special attention when trusting or distrusting these IPs.

Report 162.158.6.139

Whois 162.158.6.139

IP Abuse Reports for 162.158.6.139:

This IP address has been reported a total of 157 times from 26 distinct sources. 162.158.6.139 was first reported on August 6th 2024, and the most recent report was 1 month ago.

Old Reports: The most recent abuse report for this IP address is from 1 month ago . It is possible that this IP is no longer involved in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇿🇦 agentics	2026-06-10 02:58:44 (1 month ago)	162.158.6.139 is one of many (potentially hijacked) hosts in a botnet. This attack is a large scale ... show more 162.158.6.139 is one of many (potentially hijacked) hosts in a botnet. This attack is a large scale industrial operation attempting unrelenting brute-force login attempts for months on end - between all CIDR ranges in the botnet, our servers receive over 800 authentication attempts per minute on smtp, imap and relative mail ports, as well as ssh, and other protocols. IP INFO: - IP 162.158.6.139 - Anycast false - City N/A - Region N/A - Region Code N/A - Country N/A (N/A) - Continent N/A (N/A) - Range N/A - Provider N/A - Organisation N/A - Proxy N/A - Type N/A show less	Port Scan
🇺🇸 TPI-Abuse	2026-05-16 04:39:15 (1 month ago)	(mod_security) mod_security (id:210492) triggered by 162.158.6.139 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:210492) triggered by 162.158.6.139 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat May 16 00:39:06.628043 2026] [security2:error] [pid 11086:tid 11086] [client 162.158.6.139:9888] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "stevedemers.com"] [uri "/.env"] [unique_id "agf06sgw53YGI7Nyo-bieAAAABo"] show less	Brute-Force Bad Web Bot Web App Attack
🇳🇱 homeshowdomain.nl	2026-05-13 22:03:38 (2 months ago)	Auto-ban: >3000 req/min op 2026-05-13	Web App Attack SSH Hacking
🇺🇸 wimaxnz	2026-05-02 02:05:42 (2 months ago)	Automated report from 247 Guardian: repeated malicious activity detected. \| reason=nginx_badpath	Brute-Force SSH Port Scan
🇵🇱 SwiftServer	2026-04-01 04:22:01 (3 months ago)	162.158.6.139 - - [01/Apr/2026:07:22:00 +0300] "GET /core/app/.env HTTP/1.1" 403 195 "-" "Mozilla/5. ... show more 162.158.6.139 - - [01/Apr/2026:07:22:00 +0300] "GET /core/app/.env HTTP/1.1" 403 195 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 162.158.6.139 - - [01/Apr/2026:07:22:00 +0300] "GET /core/Datavase/.env HTTP/1.1" 403 195 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 162.158.6.139 - - [01/Apr/2026:07:22:00 +0300] "GET /database/.env HTTP/1.1" 403 195 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 162.158.6.139 - - [01/Apr/2026:07:22:00 +0300] "GET /config/.env HTTP/1.1" 403 195 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 162.158.6.139 - - [01/Apr/2026:07:22:00 +0300] "GET /assets/.env HTTP/1.1" 403 195 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" ... show less	Brute-Force Web App Attack
🇩🇪 ps-center	2026-03-10 07:15:15 (4 months ago)	SS1: Web Attack GET /wp-content/admin.php GET //wp-includes/js/tinymce/themes/inlite/	Web Spam Hacking Bad Web Bot Web App Attack
🇩🇪 ps-center	2026-03-02 16:35:56 (4 months ago)	SS1: Web Attack GET /wp-content/plugins/hellopress/wp_filemanager.php	Web Spam Hacking Bad Web Bot Web App Attack
🇩🇪 ps-center	2026-02-23 14:20:25 (4 months ago)	SS1: Web Attack GET /wp-content/plugins/hellopress/wp_filemanager.php	Web Spam Hacking Bad Web Bot Web App Attack
🇧🇾 lns.bz	2026-02-19 03:28:21 (4 months ago)	Too many 404 requests [BY]	Web App Attack
🇳🇱 wolfemium	2026-02-04 06:27:47 (5 months ago)	162.158.6.139 - - [04/Feb/2026:08:27:30 +0200] "GET /wp-content/plugins/hellopress/wp_filemanager.ph ... show more 162.158.6.139 - - [04/Feb/2026:08:27:30 +0200] "GET /wp-content/plugins/hellopress/wp_filemanager.php HTTP/1.1" 502 150 "-" "-" 162.158.6.139 - - [04/Feb/2026:08:27:45 +0200] "GET /qasu.php HTTP/1.1" 502 150 "-" "-" 162.158.6.139 - - [04/Feb/2026:08:27:45 +0200] "GET /Gi8.php HTTP/1.1" 502 150 "-" "-" 162.158.6.139 - - [04/Feb/2026:08:27:45 +0200] "GET /admiin.php HTTP/1.1" 502 150 "-" "-" 162.158.6.139 - - [04/Feb/2026:08:27:45 +0200] "GET /ol.php HTTP/1.1" 502 150 "-" "-" 162.158.6.139 - - [04/Feb/2026:08:27:46 +0200] "GET /jmfi2.php HTTP/1.1" 502 150 "-" "-" ... show less	DDoS Attack
🇫🇷 Campus France	2026-02-04 02:21:42 (5 months ago)	[Wed Feb 04 03:21:42.142548 2026] [php:error] [pid 2572431] [client 162.158.6.139:12461] script '/va ... show more [Wed Feb 04 03:21:42.142548 2026] [php:error] [pid 2572431] [client 162.158.6.139:12461] script '/var/www/html/click.php' not found or unable to stat [Wed Feb 04 03:21:42.174327 2026] [php:error] [pid 2572431] [client 162.158.6.139:12461] script '/var/www/html/install.php' not found or unable to stat [Wed Feb 04 03:21:42.208954 2026] [php:error] [pid 2572431] [client 162.158.6.139:12461] script '/var/www/html/lv.php' not found or unable to stat [Wed Feb 04 03:21:42.243099 2026] [php:error] [pid 2572431] [client 162.158.6.139:12461] script '/var/www/html/simple.php' not found or unable to stat [Wed Feb 04 03:21:42.279117 2026] [php:error] [pid 2572431] [client 162.158.6.139:12461] script '/var/www/html/css.php' not found or unable to stat ... show less	Brute-Force Web App Attack
🇫🇷 PacketFilter	2025-11-30 01:53:20 (7 months ago)	Fail2Ban	Hacking Web App Attack
🇫🇷 PacketFilter	2025-11-21 09:51:32 (7 months ago)	Fail2Ban	Hacking Web App Attack
🇫🇷 PacketFilter	2025-11-08 19:22:54 (8 months ago)	Fail2Ban	Hacking Web App Attack
🇩🇪 swk	2025-11-08 16:00:27 (8 months ago)	162.158.6.139 - - [09/Nov/2025:00:00:12 +0800] "GET /wp-content/plugins/hellopress/wp_filemanager.ph ... show more 162.158.6.139 - - [09/Nov/2025:00:00:12 +0800] "GET /wp-content/plugins/hellopress/wp_filemanager.php HTTP/1.1" 301 162 "-" "-" 162.158.6.139 - - [09/Nov/2025:00:00:17 +0800] "GET /wp-includes/theme-compat/chosen.php HTTP/1.1" 301 162 "-" "-" 162.158.6.139 - - [09/Nov/2025:00:00:17 +0800] "GET /w.php HTTP/1.1" 301 162 "-" "-" ... show less	Hacking Web App Attack

Showing 1 to 15 of 157 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇺🇸 173.239.240.98

🇧🇷 200.219.200.16

🇳🇱 193.176.31.240

🇸🇬 124.243.147.64

🇱🇹 81.30.98.44

🇱🇹 62.60.130.219

🇳🇱 5.45.94.204

🇵🇱 194.180.48.139

🇳🇱 193.176.31.200

🇳🇱 188.166.66.19

🇮🇳 185.100.212.141

🇭🇰 165.154.4.92

🇺🇸 107.175.66.41

🇩🇪 46.225.62.66

🇱🇹 45.227.254.170

🇨🇳 36.135.107.57

🇺🇸 20.55.214.64

🇰🇷 211.253.9.49

🇲🇽 187.141.71.166

🇺🇸 162.35.174.244