JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 193.29.139.207

193.29.139.207 was found in our database!

This IP was reported 55 times. Confidence of Abuse is 61%: ?

61%

ISP	Greenhost BV
Usage Type	Data Center/Web Hosting/Transit
ASN	AS47172
Domain Name	greenhost.nl
Country	🇳🇱 Netherlands
City	Lelystad, Flevoland

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 193.29.139.207

Whois 193.29.139.207

IP Abuse Reports for 193.29.139.207:

This IP address has been reported a total of 55 times from 33 distinct sources. 193.29.139.207 was first reported on October 17th 2025, and the most recent report was 1 day ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇩🇪 Paul Smith	2026-06-21 20:16:59 (1 day ago)	Email Auth Brute force attack 2/1 in last day	Brute-Force
🇩🇪 4server	2026-06-19 18:49:23 (3 days ago)	[FriJun1920:49:19.3249702026][security2:error][pid2406918:tid2407003][client193.29.139.207:0]ModSecu ... show more [FriJun1920:49:19.3249702026][security2:error][pid2406918:tid2407003][client193.29.139.207:0]ModSecurity:Accessdeniedwithcode403\(phase2\).OperatorGEmatched5atTX:anomaly_score.[file\"/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf\"][line\"94\"][id\"949110\"][msg\"InboundAnomalyScoreExceeded\(TotalScore:5\)\"][severity\"CRITICAL\"][ver\"OWASP_CRS/3.3.9\"][tag\"application-multi\"][tag\"language-multi\"][tag\"platform-multi\"][tag\"attack-generic\"][hostname\"mail.wildpferde.ch\"][uri\"/.netrc\"][unique_id\"ajWPL45-1gPvLRbirtDzawAAAJg\"] show less	Port Scan Brute-Force Web App Attack
🇲🇳 Public CSIRT/CC of Mongolia	2026-06-19 16:02:53 (3 days ago)	Honeypot hit: Incoming HTTP traffic on port 81	Web App Attack Bad Web Bot
🇪🇸 librebit	2026-06-19 14:10:57 (3 days ago)	Brute force	Brute-Force
🇺🇸 TPI-Abuse	2026-06-19 11:57:52 (4 days ago)	(mod_security) mod_security (id:210492) triggered by 193.29.139.207 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210492) triggered by 193.29.139.207 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jun 19 07:57:47.311308 2026] [security2:error] [pid 25730:tid 25730] [client 193.29.139.207:21686] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.garyandthegroove.com"] [uri "/.env.staging"] [unique_id "ajUuuxHCoMCTD-5ZnQ6YRgAAAB4"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-06-19 07:49:11 (4 days ago)	(mod_security) mod_security (id:210492) triggered by 193.29.139.207 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210492) triggered by 193.29.139.207 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jun 19 03:49:04.284843 2026] [security2:error] [pid 14087:tid 14087] [client 193.29.139.207:36296] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.qxoticdivas.postermodelsworldwideinc.com"] [uri "/.env.backup"] [unique_id "ajT0cGsoqkd2fbsKVbzg1AAAAA0"] show less	Brute-Force Bad Web Bot Web App Attack
Anonymous	2026-06-19 05:19:41 (4 days ago)	Automated report (2026-06-19T01:19:41-04:00). Caught probing for exposed Firebase configuration.	Hacking Web App Attack
🇩🇪 4server	2026-06-17 12:09:43 (6 days ago)	[WedJun1714:09:39.6496672026][security2:error][pid2757566:tid2757666][client193.29.139.207:0]ModSecu ... show more [WedJun1714:09:39.6496672026][security2:error][pid2757566:tid2757666][client193.29.139.207:0]ModSecurity:Accessdeniedwithcode403\(phase2\).Stringmatchwithin\".asa/.asax/.ascx/.backup/.bak/.bat/.cdx/.cer/.cfg/.cmd/.com/.config/.conf/.cs/.csproj/.csr/.dat/.db/.dbf/.dll/.dos/.htr/.htw/.ida/.idc/.idq/.inc/.ini/.key/.licx/.lnk/.log/.mdb/.old/.pass/.pdb/.pol/.printer/.pwd/.rdb/.resources/.resx/.sql/.swp/.sys/.vb/.vbs/.vbproj/.vsdisco/.webinfo/.xsx/\"atTX:extension.[file\"/etc/apache2/conf.d/modsec_rules/00_asl_zz_strict.conf\"][line\"91\"][id\"390716\"][rev\"2\"][msg\"Atomicorp.comWAFRules:URLfileextensionisrestrictedbypolicy\"][data\".db\"][severity\"ERROR\"][hostname\"mail.wildpferde.ch\"][uri\"/telegram_messages.db\"][unique_id\"ajKOg2I2ALKVufv3EtooNQAAARU\"] show less	Port Scan Brute-Force Web App Attack
🇺🇸 TPI-Abuse	2026-06-17 09:09:47 (6 days ago)	(mod_security) mod_security (id:210730) triggered by 193.29.139.207 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210730) triggered by 193.29.139.207 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jun 17 05:09:39.237146 2026] [security2:error] [pid 6621:tid 6621] [client 193.29.139.207:48444] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy\|\|www.construction.bonefrog.com\|F\|2"] [data ".db"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.construction.bonefrog.com"] [uri "/one-api.db"] [unique_id "ajJkUyIVuWHmAw6Do2iC1AAAAAk"] show less	Brute-Force Bad Web Bot Web App Attack
🇲🇳 Public CSIRT/CC of Mongolia	2026-06-17 08:28:03 (6 days ago)	Honeypot hit: Incoming HTTP traffic on port 81	Web App Attack Bad Web Bot
🇺🇸 TPI-Abuse	2026-06-15 17:42:15 (1 week ago)	(mod_security) mod_security (id:210492) triggered by 193.29.139.207 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210492) triggered by 193.29.139.207 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jun 15 13:42:09.651542 2026] [security2:error] [pid 11455:tid 11462] [client 193.29.139.207:55948] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "richardleeweatherman.com"] [uri "/.env.test"] [unique_id "ajA5cYhocQ2Yer48Av6sjQAAAAU"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-06-15 16:22:54 (1 week ago)	(mod_security) mod_security (id:210492) triggered by 193.29.139.207 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210492) triggered by 193.29.139.207 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jun 15 12:22:50.249025 2026] [security2:error] [pid 369:tid 482] [client 193.29.139.207:14594] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "coloradomohs.aafm.us"] [uri "/.env.local"] [unique_id "ajAm2i-ffj300-_6BbFO-QAAAAY"] show less	Brute-Force Bad Web Bot Web App Attack
🇲🇳 Public CSIRT/CC of Mongolia	2026-06-15 15:36:35 (1 week ago)	Honeypot hit: Incoming HTTP traffic on port 81	Web App Attack Bad Web Bot
🇨🇿 lp	2026-06-12 19:55:24 (1 week ago)	Email account brute force: 2 attempts were recorded from 193.29.139.207 2026-06-12T21:22:17+02:00 wa ... show more Email account brute force: 2 attempts were recorded from 193.29.139.207 2026-06-12T21:22:17+02:00 warning: unknown[193.29.139.207]: SASL PLAIN authentication failed: authentication failure, [email protected] 2026-06-12T21:22:17+02:00 warning: unknown[193.29.139.207]: SASL LOGIN authentication failed: authentication failure, [email protected] show less	Brute-Force
🇨🇿 Honzas	2026-06-08 22:35:33 (2 weeks ago)	Brute Force SMTP AUTH Attack	Brute-Force

Showing 1 to 15 of 55 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇩🇪 213.209.159.227

🇸🇬 47.84.66.216

🇮🇪 2a05:d018:10df:d401:4a47:9510:fefc:d3fd

🇺🇸 2607:f8b0:4002:c00::127

🇮🇳 223.235.103.98

🇺🇸 100.23.110.123

🇬🇧 81.19.219.202

🇸🇪 171.25.158.24

🇰🇷 119.204.60.250

🇺🇸 8.235.125.4

🇬🇧 193.163.125.225

🇲🇽 187.191.48.23

🇵🇭 180.194.203.109

🇸🇬 103.187.147.214

🇧🇩 103.91.234.129

🇧🇬 79.124.49.174

🇩🇪 69.5.169.224

🇳🇱 45.148.10.121

🇵🇪 38.25.98.49

🇫🇷 172.68.151.166