JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 39.105.154.249

39.105.154.249 was found in our database!

This IP was reported 110 times. Confidence of Abuse is 0%: ?

ISP	Aliyun Computing Co., LTD
Usage Type	Data Center/Web Hosting/Transit
ASN	AS37963
Domain Name	alibabacloud.com
Country	🇨🇳 China
City	Beijing, Beijing

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 39.105.154.249

Whois 39.105.154.249

IP Abuse Reports for 39.105.154.249:

This IP address has been reported a total of 110 times from 56 distinct sources. 39.105.154.249 was first reported on December 22nd 2025, and the most recent report was 4 months ago.

Old Reports: The most recent abuse report for this IP address is from 4 months ago . It is possible that this IP is no longer involved in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇷🇴 TerraCorp Global Solutions	2026-04-12 19:08:53 (4 months ago)	2026-04-12T22:08:52.339251+03:00 honeypot.mkwayexchange.com auth[28309]: pam_unix(dovecot:auth): aut ... show more 2026-04-12T22:08:52.339251+03:00 honeypot.mkwayexchange.com auth[28309]: pam_unix(dovecot:auth): authentication failure; logname= uid=0 euid=0 tty=dovecot [email protected] rhost=39.105.154.249 [email protected] ... show less	Phishing Hacking Brute-Force Exploited Host Web App Attack SSH
Anonymous	2026-04-11 16:22:27 (4 months ago)	Apr 11 16:22:26 imap-login: Info: Disconnected: Connection closed (no auth attempts in 127 secs): us ... show more Apr 11 16:22:26 imap-login: Info: Disconnected: Connection closed (no auth attempts in 127 secs): user=<>, rip=39.105.154.249, lip=X.X.X.X, TLS handshaking: Connection closed, session=<rZDDpzFPMqgnaZr5> ... show less	Brute-Force
🇷🇴 TerraCorp Global Solutions	2026-04-10 12:52:08 (4 months ago)	2026-04-10T15:52:07.932747+03:00 honeypot.mkwayexchange.com auth[40361]: pam_unix(dovecot:auth): aut ... show more 2026-04-10T15:52:07.932747+03:00 honeypot.mkwayexchange.com auth[40361]: pam_unix(dovecot:auth): authentication failure; logname= uid=0 euid=0 tty=dovecot [email protected] rhost=39.105.154.249 [email protected] ... show less	Phishing Hacking Brute-Force Exploited Host Web App Attack SSH
Anonymous	2026-04-09 10:41:03 (4 months ago)	Apr 09 07:48:27 imap-login: Info: Disconnected: Connection closed: read(size=569) failed: Connection ... show more Apr 09 07:48:27 imap-login: Info: Disconnected: Connection closed: read(size=569) failed: Connection reset by peer (no auth attempts in 133 secs): user=<>, rip=39.105.154.249, lip=X.X.X.X, TLS handshaking: read(size=569) failed: Connection reset by peer, session=<knblPQJP/pQnaZr5> Apr 09 10:41:02 imap-login: Info: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=39.105.154.249, lip=X.X.X.X, TLS handshaking: Connection closed, session=<hisepwRPGsInaZr5> ... show less	Brute-Force
🇫🇷 smtp.com.es	2026-04-08 09:08:50 (4 months ago)	Brute force attempt.	Brute-Force Email Spam
Anonymous	2026-04-08 06:12:41 (4 months ago)	Apr 08 00:23:10 imap-login: Info: Disconnected: Connection closed (no auth attempts in 6 secs): user ... show more Apr 08 00:23:10 imap-login: Info: Disconnected: Connection closed (no auth attempts in 6 secs): user=<>, rip=39.105.154.249, lip=X.X.X.X, TLS handshaking: Connection closed, session=<3USf5+dO2swnaZr5> Apr 08 03:15:30 imap-login: Info: Disconnected: Connection closed: read(size=569) failed: Connection reset by peer (no auth attempts in 27 secs): user=<>, rip=39.105.154.249, lip=X.X.X.X, TLS handshaking: read(size=569) failed: Connection reset by peer, session=<8ZHyT+pOrIsnaZr5> Apr 08 06:12:40 imap-login: Info: Disconnected: Connection closed: read(size=569) failed: Connection reset by peer (no auth attempts in 4 secs): user=<>, rip=39.105.154.249, lip=X.X.X.X, TLS handshaking: read(size=569) failed: Connection reset by peer, session=<XziJyexO1LgnaZr5> ... show less	Brute-Force
🇳🇱 homeshowdomain.nl	2026-04-01 22:00:43 (4 months ago)	Auto-ban: single probe for restricted files (.env / backups / admin endpoints). Likely mass-scan on ... show more Auto-ban: single probe for restricted files (.env / backups / admin endpoints). Likely mass-scan on 2026-03-31. show less	Web App Attack SSH Hacking
🇩🇪 Marc	2026-04-01 06:05:22 (5 months ago)		Brute-Force FTP Brute-Force
🇳🇱 jjnxpct	2026-04-01 03:51:25 (5 months ago)	Automated security incident from hosting server. ModSecurity blocked suspicious request targeting UR ... show more Automated security incident from hosting server. ModSecurity blocked suspicious request targeting URI: /env/.env (Rule ID: 930130) - Restricted File Access Attempt [Suspicious: .env found within REQUEST_FILENAME: /env/.env] show less	Web App Attack Hacking
🇫🇷 masterguru	2026-04-01 00:37:32 (5 months ago)	BAD BOT - Detected and Blocked.. Matched phrase "go-http-client" at REQUEST_HEADERS:User-Agent. (110 ... show more BAD BOT - Detected and Blocked.. Matched phrase "go-http-client" at REQUEST_HEADERS:User-Agent. (1100000-197) show less	Bad Web Bot
🇩🇪 LRob	2026-03-31 22:30:08 (5 months ago)	FTP brute-force attack detected by Fail2Ban in plesk-proftpd jail	FTP Brute-Force
🇸🇪 SkyDancer	2026-03-31 17:30:00 (5 months ago)	Multiple intrusion attempts via http/https on known vulnerable url offsets. Attack automatically blo ... show more Multiple intrusion attempts via http/https on known vulnerable url offsets. Attack automatically blocked by SkyDancer Ai(web-X). show less	Hacking Brute-Force
🇺🇸 TPI-Abuse	2026-03-31 10:07:30 (5 months ago)	(mod_security) mod_security (id:210492) triggered by 39.105.154.249 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210492) triggered by 39.105.154.249 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Mar 31 06:07:24.010934 2026] [security2:error] [pid 24201:tid 24209] [client 39.105.154.249:35040] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "dubarch.com"] [uri "/env/.env"] [unique_id "acuc3PBwKAw737cVbkXzOgAAAMY"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-03-31 09:10:36 (5 months ago)	(mod_security) mod_security (id:210492) triggered by 39.105.154.249 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210492) triggered by 39.105.154.249 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Mar 31 05:10:30.922036 2026] [security2:error] [pid 22462:tid 22462] [client 39.105.154.249:52148] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "frickandfracks.com"] [uri "/env/.env"] [unique_id "acuPhkSU6VUKGvu4Q_NPZQAAAD0"] show less	Brute-Force Bad Web Bot Web App Attack
🇩🇪 Marc	2026-03-31 00:01:33 (5 months ago)		Brute-Force FTP Brute-Force

Showing 1 to 15 of 110 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇮🇳 103.70.40.36

🇲🇲 103.23.135.183

🇸🇮 102.220.160.113

🇰🇷 210.222.26.181

🇧🇬 193.24.211.204

🇮🇳 154.221.35.72

🇩🇪 95.90.214.31

🇹🇷 94.154.43.73

🇩🇪 87.158.14.83

🇨🇳 82.156.34.74

🇷🇴 80.94.92.234

🇺🇸 35.224.119.82

🇨🇳 27.22.79.33

🇮🇳 210.212.136.3

🇺🇸 162.216.150.77

🇩🇪 152.53.185.81

🇽🇰 94.100.63.26

🇸🇪 34.51.177.67

🇺🇸 20.65.146.142

🇺🇸 13.218.165.217