JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 194.127.166.139

194.127.166.139 was found in our database!

This IP was reported 27 times. Confidence of Abuse is 100%: ?

100%

ISP	Owl Limited
Usage Type	Data Center/Web Hosting/Transit
ASN	AS23959
Domain Name	owl.net
Country	🇯🇵 Japan
City	Osaka, Osaka

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 194.127.166.139

Whois 194.127.166.139

IP Abuse Reports for 194.127.166.139:

This IP address has been reported a total of 27 times from 24 distinct sources. 194.127.166.139 was first reported on October 25th 2026, and the most recent report was 15 hours ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇫🇷 tecnicorioja	2026-10-26 23:01:22 (15 hours ago)	(Mod_security)	Web App Attack Brute-Force Bad Web Bot
🇫🇮 oh.mg	2026-10-26 05:50:48 (1 day ago)	[Mon Oct 26 06:50:46.337862 2026] [security2:error] [pid 3579132:tid 3579150] [client 194.127.166.13 ... show more [Mon Oct 26 06:50:46.337862 2026] [security2:error] [pid 3579132:tid 3579150] [client 194.127.166.139:57596] [client 194.127.166.139] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:blocking_inbound_anomaly_score. [file "/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "233"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 8)"] [ver "OWASP_CRS/4.10.0-dev"] [tag "anomaly-evaluation"] [tag "OWASP_CRS"] [hostname "95.216.72.247"] [uri "/.env"] [unique_id "at7qNlplp1SU70wNv3xm5AAAANA"] [Mon Oct 26 06:50:47.797242 2026] [security2:error] [pid 3645648:tid 3645667] [client 194.127.166.139:64286] [client 194.127.166.139] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:blocking_inbound_anomaly_score. [file "/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "233"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 8)"] [ver "OWASP_CRS/4.10.0-dev" ... show less	Web App Attack Bad Web Bot
🇿🇦 conure.sh	2026-10-26 05:43:18 (1 day ago)	csagent: score 19.9: secrets grab x2; 1 domain(s) in 6s	Web App Attack
🇩🇪 BlueWire Hosting	2026-10-26 05:41:29 (1 day ago)	High-confidence malicious configuration/VCS probe	Web App Attack
🇫🇮 paissangroup	2026-10-26 05:26:54 (1 day ago)	Multiple WAF Violations	Web App Attack
Anonymous	2026-10-26 04:42:04 (1 day ago)	[ns19.kdns.gr] httpd-config-scan: sites=global; logs=/var/log/httpd/access_log; samples=/.env \| fast ... show more [ns19.kdns.gr] httpd-config-scan: sites=global; logs=/var/log/httpd/access_log; samples=/.env \| fast_lane=true kernel_at=2026-10-26T04:41:46+00:00 \| requests=1 show less	Hacking Web App Attack
🇩🇪 BlueWire Hosting	2026-10-26 04:34:11 (1 day ago)	Modsecurity: probe or injection attempt	SQL Injection Web App Attack
🇫🇷 Coco Bongo	2026-10-26 04:28:22 (1 day ago)	194.127.166.139 [redacted] (23959-Owl Limited Japan Osaka) - - [26/Oct/2026:05:28:06 +0100] "POST / ... show more 194.127.166.139 [redacted] (23959-Owl Limited Japan Osaka) - - [26/Oct/2026:05:28:06 +0100] "POST / HTTP/1.1" 405 552 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_1) AppleWebK ... show less	Bad Web Bot Web App Attack
Anonymous	2026-10-26 04:02:28 (1 day ago)	apache-auth	Brute-Force Web App Attack
🇦🇺 clapper	2026-10-26 03:50:27 (1 day ago)	(mod_security) mod_security (id:949110) triggered by 194.127.166.139 (JP/Japan/-): 5 in the last 600 ... show more (mod_security) mod_security (id:949110) triggered by 194.127.166.139 (JP/Japan/-): 5 in the last 600 secs; ID: rub show less	Brute-Force Bad Web Bot
🇩🇪 maxpower	2026-10-26 03:21:48 (1 day ago)	(exploit_critical) REGOLA 2 - Critical File Exploit Attempt 194.127.166.139 (JP/Japan/-): 1 in the l ... show more (exploit_critical) REGOLA 2 - Critical File Exploit Attempt 194.127.166.139 (JP/Japan/-): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: 194.127.166.139 - - [26/Oct/2026:04:21:43 +0100] "GET /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1" 200 12044 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36" "-" host=51.77.95.117 show less	Port Scan
🇫🇷 dwmp	2026-10-26 03:20:32 (1 day ago)	[26/Oct/2026:04:20:26.590499 +0100] at7G-gI6EoNIjYMKYjtX5gAAAIo 194.127.166.139 47922 38.242.227.117 ... show more [26/Oct/2026:04:20:26.590499 +0100] at7G-gI6EoNIjYMKYjtX5gAAAIo 194.127.166.139 47922 38.242.227.117 7080 [26/Oct/2026:04:20:28.977125 +0100] at7G_EVUP7GpkmN1-EZizwAAAEs 194.127.166.139 47938 38.242.227.117 7080 [26/Oct/2026:04:20:32.215011 +0100] at7HAEVUP7GpkmN1-EZi1AAAAEU 194.127.166.139 47952 38.242.227.117 7080 ... show less	Brute-Force SSH
🇳🇱 Alt255	2026-10-26 02:55:20 (1 day ago)	[ti-01sc] Web exploit scanning: 1 suspicious requests detected by fail2ban jail apache-scanner. Exam ... show more [ti-01sc] Web exploit scanning: 1 suspicious requests detected by fail2ban jail apache-scanner. Example: 194.127.166.139 - - [26/Oct/2026:03:55:08 +0100] "GET /.env HTTP/1.1" 404 7439 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36" ... show less	Bad Web Bot Web App Attack
🇩🇪 mzaiser12	2026-10-26 02:51:38 (1 day ago)	Web application probing: 19 requests to typical attack paths (/185.216.213.142/.env, /.env, /admin/. ... show more Web application probing: 19 requests to typical attack paths (/185.216.213.142/.env, /.env, /admin/.env, /vendor/.env) within 5 min. Reported automatically by a SIEM; contact via abuse mailbox of the reporting network. show less	Bad Web Bot Web App Attack
🇩🇪 Mein-ChatServer	2026-10-26 02:36:07 (1 day ago)	194.127.166.139 - - [26/Oct/2026:03:35:57 +0100] "GET /.env HTTP/1.1" 403 180 "-" "Mozilla/5.0 (Maci ... show more 194.127.166.139 - - [26/Oct/2026:03:35:57 +0100] "GET /.env HTTP/1.1" 403 180 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36" 194.127.166.139 - - [26/Oct/2026:03:36:02 +0100] "GET /.env HTTP/1.1" 403 180 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36" 194.127.166.139 - - [26/Oct/2026:03:36:07 +0100] "GET /168.119.6.46/.env HTTP/1.1" 403 180 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36" ... show less	Web App Attack Bad Web Bot

Showing 1 to 15 of 27 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇩🇪 2a01:4020:31:0:102::239

🇨🇳 219.159.79.49

🇨🇭 209.99.190.215

🇩🇪 165.232.120.203

🇫🇷 91.231.89.157

🇫🇷 51.254.103.32

🇩🇪 2a01:4020:31:0:102::33e

🇩🇪 2a01:4020:31:0:102::322

🇪🇨 181.211.35.45

🇧🇷 129.121.48.164

🇯🇵 124.18.182.99

🇮🇳 106.201.251.237

🇮🇷 94.101.184.248

🇨🇦 85.217.149.23

🇫🇮 80.223.200.184

🇪🇸 79.116.176.202

🇳🇱 64.205.72.17

🇺🇸 47.155.61.44

🇷🇴 2.57.121.112

🇺🇸 2600:1f18:fce:2d00:345c:d16b:f151:51c5