JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 184.154.139.61

184.154.139.61 was found in our database!

This IP was reported 38 times. Confidence of Abuse is 30%: ?

30%

ISP	Internap Holding LLC
Usage Type	Data Center/Web Hosting/Transit
ASN	AS32475
Hostname(s)	placeholder.sitelock.com
Domain Name	horizoniq.com
Country	🇺🇸 United States of America
City	Chicago, Illinois

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 184.154.139.61

Whois 184.154.139.61

IP Abuse Reports for 184.154.139.61:

This IP address has been reported a total of 38 times from 11 distinct sources. 184.154.139.61 was first reported on July 10th 2025, and the most recent report was 1 day ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇧🇪 cmbplf	2026-06-26 02:07:07 (1 day ago)	130 querystring crawling (29m59s)	Brute-Force Bad Web Bot
🇺🇸 TPI-Abuse	2026-06-25 09:47:35 (2 days ago)	(mod_security) mod_security (id:210730) triggered by 184.154.139.61 (placeholder.sitelock.com): 1 in ... show more (mod_security) mod_security (id:210730) triggered by 184.154.139.61 (placeholder.sitelock.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jun 25 05:47:27.784777 2026] [security2:error] [pid 14589:tid 14589] [client 184.154.139.61:44384] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy\|\|www.barkoskieelectric.com\|F\|2"] [data ".com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.barkoskieelectric.com"] [uri "/mailto:[email protected]"] [unique_id "ajz5L2htBhlUBy-dc9geKwAAAAA"] show less	Brute-Force Bad Web Bot Web App Attack
🇦🇺 2000cn.com.au	2026-06-24 14:20:48 (2 days ago)	This IP was detected by CrowdSec triggering crowdsecurity/http-bad-user-agent	Web App Attack Bad Web Bot
🇫🇷 masterguru	2026-06-23 17:38:21 (3 days ago)	Found User-Agent associated with security scanner. Matched phrase "sitelockspider" at REQUEST_HEADER ... show more Found User-Agent associated with security scanner. Matched phrase "sitelockspider" at REQUEST_HEADERS:User-Agent. (913100-197) show less	Hacking Bad Web Bot
🇫🇷 masterguru	2026-06-05 17:57:16 (3 weeks ago)	Found User-Agent associated with security scanner. Matched phrase "sitelockspider" at REQUEST_HEADER ... show more Found User-Agent associated with security scanner. Matched phrase "sitelockspider" at REQUEST_HEADERS:User-Agent. (913100-197) show less	Hacking Bad Web Bot
🇺🇸 TPI-Abuse	2026-04-23 02:07:54 (2 months ago)	(mod_security) mod_security (id:225170) triggered by 184.154.139.61 (placeholder.sitelock.com): 1 in ... show more (mod_security) mod_security (id:225170) triggered by 184.154.139.61 (placeholder.sitelock.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Apr 22 22:07:46.640739 2026] [security2:error] [pid 3930794:tid 3930794] [client 184.154.139.61:47132] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)\|\|www.texaslawman.net\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "www.texaslawman.net"] [uri "/wp-json/wp/v2/users/1"] [unique_id "ael-8mNCDSwJVMjixZIvugAAAAU"], referer: http://www.google.com/url?url=www.texaslawman.net&yahoo.com show less	Brute-Force Bad Web Bot Web App Attack
🇫🇷 masterguru	2026-04-14 17:52:52 (2 months ago)	Found User-Agent associated with security scanner. Matched phrase "sitelockspider" at REQUEST_HEADER ... show more Found User-Agent associated with security scanner. Matched phrase "sitelockspider" at REQUEST_HEADERS:User-Agent. (913100-197) show less	Hacking Bad Web Bot
🇺🇸 TPI-Abuse	2026-04-14 10:26:38 (2 months ago)	(mod_security) mod_security (id:210730) triggered by 184.154.139.61 (placeholder.sitelock.com): 1 in ... show more (mod_security) mod_security (id:210730) triggered by 184.154.139.61 (placeholder.sitelock.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Apr 14 06:26:30.298563 2026] [security2:error] [pid 1906194:tid 1906194] [client 184.154.139.61:57008] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy\|\|www.barkoskieelectric.com\|F\|2"] [data ".com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.barkoskieelectric.com"] [uri "/mailto:[email protected]"] [unique_id "ad4WVqn5PzdcOYHEviYnNgAAAAE"] show less	Brute-Force Bad Web Bot Web App Attack
🇩🇪 expandmade.com	2026-03-11 06:42:18 (3 months ago)	trolling for resource vulnerabilities [11/Mar/2026:06:42:18 "GET //wp-content/plugins/jetpack/readme ... show more trolling for resource vulnerabilities [11/Mar/2026:06:42:18 "GET //wp-content/plugins/jetpack/readme.txt"] show less	Web App Attack
🇪🇸 gnom4ik	2026-02-21 11:49:52 (4 months ago)	ban-reviewer auto report; ip=184.154.139.61; scenario=http:scan; verdict=valid_ban; confidence=0.85; ... show more ban-reviewer auto report; ip=184.154.139.61; scenario=http:scan; verdict=valid_ban; confidence=0.85; categories=14,15,22; active_decisions=1; lookback_decisions=1; nginx_requests=0; appsec_matches=0; auth_events=0; kernel_events=0; signals=IP flagged for HTTP scanning activity; Decision made by CAPI with 7800m duration; AbuseIPDB category 14 (Port Scan) is applicable show less	Port Scan Hacking SSH
🇫🇷 masterguru	2026-02-10 19:43:40 (4 months ago)	Found User-Agent associated with security scanner. Matched phrase "sitelockspider" at REQUEST_HEADER ... show more Found User-Agent associated with security scanner. Matched phrase "sitelockspider" at REQUEST_HEADERS:User-Agent. (913100-197) show less	Hacking Bad Web Bot
🇫🇷 dynamix	2026-01-18 08:24:06 (5 months ago)	Multiple WAF Violations	Web App Attack
🇫🇷 masterguru	2026-01-15 18:58:07 (5 months ago)	Found User-Agent associated with security scanner. Matched phrase "sitelockspider" at REQUEST_HEADER ... show more Found User-Agent associated with security scanner. Matched phrase "sitelockspider" at REQUEST_HEADERS:User-Agent. (913100-197) show less	Hacking Bad Web Bot
🇫🇷 dynamix	2025-12-27 08:04:39 (6 months ago)	Multiple WAF Violations	Web App Attack
🇺🇸 TPI-Abuse	2025-12-14 11:15:13 (6 months ago)	(mod_security) mod_security (id:243420) triggered by 184.154.139.61 (placeholder.sitelock.com): 1 in ... show more (mod_security) mod_security (id:243420) triggered by 184.154.139.61 (placeholder.sitelock.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Dec 14 06:15:05.577209 2025] [security2:error] [pid 14374:tid 14374] [client 184.154.139.61:38328] ModSecurity: Access denied with code 403 (phase 3). Match of "validateByteRange 0-31" against "ARGS_NAMES:" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "6640"] [id "243420"] [rev "4"] [msg "COMODO WAF: Information disclosure vulnerability in Eclipse Jetty before 9.2.9.v20150224 (CVE-2015-2080)\|\|www.schonar.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "www.schonar.com"] [uri "/assets/shopping-cart/%=%20config.action%20%"] [unique_id "aT6cOTyJZWq7KUlVPxaC-QAAAAw"] show less	Brute-Force Bad Web Bot Web App Attack

Showing 1 to 15 of 38 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇵🇱 194.180.49.217

🇰🇷 121.135.119.71

🇨🇳 112.109.198.106

🇭🇰 199.45.155.79

🇵🇱 194.180.48.148

🇭🇰 193.176.211.210

🇺🇸 193.26.115.137

🇧🇷 189.50.54.135

🇰🇭 175.100.107.238

🇺🇸 147.185.132.128

🇺🇸 137.184.215.248

🇺🇸 104.207.42.141

🇿🇲 102.23.122.235

🇺🇸 91.230.168.78

🇧🇬 91.191.209.98

🇦🇺 45.132.224.107

🇬🇧 35.203.211.113

🇵🇱 20.215.211.204

🇺🇸 18.212.126.233

🇰🇷 222.109.73.135