JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 185.139.138.158

185.139.138.158 was found in our database!

This IP was reported 67 times. Confidence of Abuse is 56%: ?

56%

ISP	Uzbektelecom JSC
Usage Type	Mobile ISP
ASN	AS201767
Domain Name	noctelecom.uz
Country	🇺🇿 Uzbekistan
City	Tashkent, Tashkent

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 185.139.138.158

Whois 185.139.138.158

IP Abuse Reports for 185.139.138.158:

This IP address has been reported a total of 67 times from 39 distinct sources. 185.139.138.158 was first reported on November 4th 2023, and the most recent report was 3 days ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇩🇪 Vegascosmetics	2026-09-27 06:41:41 (3 days ago)	Kingcopy.org AI-IDS (Vegas Cosmetics shop): auto-blocked after high AbuseIPDB reputation + local blo ... show more Kingcopy.org AI-IDS (Vegas Cosmetics shop): auto-blocked after high AbuseIPDB reputation + local block policy. Evidence: High Abuse + Suspicion (63, Abuse: 57) show less	Hacking Exploited Host Web App Attack
🇺🇸 TPI-Abuse	2026-09-26 05:07:05 (4 days ago)	(mod_security) mod_security (id:210350) triggered by 185.139.138.158 (-): 1 in the last 300 secs; Po ... show more (mod_security) mod_security (id:210350) triggered by 185.139.138.158 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Sep 26 01:06:58.507044 2026] [security2:error] [pid 19092:tid 19092] [client 185.139.138.158:31500] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close\|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close\|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found\|\|missingfilm.com\|F\|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "missingfilm.com"] [uri "/"] [unique_id "ardS8hHhVCXYVeDqm3ZkCwAAAAE"], referer: https://bulkbacklinklookup.site/dir/high-dr-backlinks-137669 show less	Brute-Force Bad Web Bot Web App Attack
Anonymous	2026-09-26 01:46:51 (4 days ago)	denied Telnet access attempt. destination port 23.	Port Scan Brute-Force
🇺🇸 鬼影233	2026-09-18 14:05:53 (1 week ago)	Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Sa ... show more Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36 Edg/144.0.0.0 show less	Bad Web Bot
🇩🇪 hbrks	2026-09-17 07:32:41 (1 week ago)	PMG Antispam: Postscreen PREGREET violation	Email Spam
🇺🇸 TPI-Abuse	2026-09-16 10:58:43 (2 weeks ago)	(mod_security) mod_security (id:210350) triggered by 185.139.138.158 (-): 1 in the last 300 secs; Po ... show more (mod_security) mod_security (id:210350) triggered by 185.139.138.158 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Sep 16 06:58:38.097195 2026] [security2:error] [pid 16145:tid 16145] [client 185.139.138.158:31049] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close\|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close\|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found\|\|swiss-pac.com\|F\|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "swiss-pac.com"] [uri "/"] [unique_id "aqp2Xlv0wGd3IwYQU5baowAAAAw"], referer: https://five.co.in/redirect.php?ref_host=mdaconsultancy.co.uk show less	Brute-Force Bad Web Bot Web App Attack
🇦🇺 FireGuard Server	2026-09-16 03:10:12 (2 weeks ago)	Blocked by os-abuseipdb; 3 hits, proto=tcp, ports=25	Port Scan Hacking
🇺🇸 鬼影233	2026-09-15 22:24:36 (2 weeks ago)	Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Sa ... show more Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 show less	Bad Web Bot
🇩🇰 powerhostingdk	2026-09-15 16:19:05 (2 weeks ago)	[mailserver] CrowdSec detected crowdsecurity/postscreen-rbl (1 events). Automated abuse report.	Email Spam Brute-Force
🇫🇮 notelseit	2026-09-15 14:24:32 (2 weeks ago)	2026-09-15T16:22:25.314349+02:00 mail postfix/smtpd[1531246]: NOQUEUE: reject: RCPT from unknown[185 ... show more 2026-09-15T16:22:25.314349+02:00 mail postfix/smtpd[1531246]: NOQUEUE: reject: RCPT from unknown[185.139.138.158]: 450 4.7.25 Client host rejected: cannot find your hostname, [185.139.138.158]; from=<[email protected]> to=<[email protected]> proto=ESMTP helo=<[185.139.138.158]> 2026-09-15T16:22:25.485031+02:00 mail postfix/smtpd[1531246]: lost connection after RCPT from unknown[185.139.138.158] 2026-09-15T16:24:31.961208+02:00 mail postfix/smtpd[1531246]: NOQUEUE: reject: RCPT from unknown[185.139.138.158]: 450 4.7.25 Client host rejected: cannot find your hostname, [185.139.138.158]; from=<[email protected]> to=<[email protected]> proto=ESMTP helo=<[185.139.138.158]> ... show less	Brute-Force Email Spam
🇨🇭 Origon	2026-09-15 12:54:09 (2 weeks ago)	NOQUEUE - IP: 185.139.138.158 - Sep 15 14:54:09 plesk postfix/smtpd[2560401]: NOQUEUE: reject: RCPT ... show more NOQUEUE - IP: 185.139.138.158 - Sep 15 14:54:09 plesk postfix/smtpd[2560401]: NOQUEUE: reject: RCPT from unknown[185.139.138.158]: 554 5.7.1 Service unavailable; Client host [185.139.138.158] blocked using dnsbl-1.uceprotect.net; IP 185.139.138.158 is UCEPROTECT-Level 1 listed. See http://www.uceprotect.net/rblcheck.php?ipr=185.139.138.158; from=<REDACTED@REDACTED> to=<REDACTED@REDACTED> proto=ESMTP helo=<[92.63.205.190]> show less	Email Spam
🇩🇰 powerhostingdk	2026-09-13 12:48:14 (2 weeks ago)	[mailserver] CrowdSec detected crowdsecurity/postscreen-rbl (1 events). Automated abuse report.	Email Spam Brute-Force
🇺🇸 鬼影233	2026-09-04 04:12:27 (3 weeks ago)	Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Sa ... show more Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36 Edg/144.0.0.0 show less	Bad Web Bot
🇺🇸 鬼影233	2026-08-30 07:16:49 (1 month ago)	Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Sa ... show more Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 show less	Bad Web Bot
🇳🇱 soverin	2026-08-27 18:16:02 (1 month ago)	spam	Email Spam

Showing 1 to 15 of 67 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇺🇸 146.190.66.231

🇺🇸 103.4.250.224

🇷🇴 92.118.39.14

🇭🇺 87.229.103.177

🇵🇱 77.91.122.12

🇲🇽 187.249.120.197

🇧🇷 177.170.55.25

🇻🇳 115.76.117.142

🇺🇸 50.6.152.190

🇳🇱 45.148.10.141

🇵🇱 2a03:cfc0:8000:2d::c122:d60e

🇨🇴 190.145.192.106

🇺🇸 186.241.107.84

🇨🇳 183.252.199.17

🇨🇳 180.76.112.91

🇨🇲 154.70.102.114

🇨🇳 61.160.221.153

🇺🇸 20.127.185.37

🇵🇭 210.5.117.238

🇺🇸 205.210.31.59