JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 39.154.6.140

39.154.6.140 was found in our database!

This IP was reported 14 times. Confidence of Abuse is 5%: ?

ISP	China Mobile Communications Corporation
Usage Type	Fixed Line ISP
ASN	AS9808
Domain Name	chinamobile.com
Country	🇨🇳 China
City	Hohhot, Inner Mongolia

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 39.154.6.140

Whois 39.154.6.140

IP Abuse Reports for 39.154.6.140:

This IP address has been reported a total of 14 times from 2 distinct sources. 39.154.6.140 was first reported on May 5th 2025, and the most recent report was 19 hours ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇺🇸 TPI-Abuse	2026-07-10 05:33:37 (19 hours ago)	(mod_security) mod_security (id:210831) triggered by 39.154.6.140 (-): 1 in the last 300 secs; Ports ... show more (mod_security) mod_security (id:210831) triggered by 39.154.6.140 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jul 10 01:33:23.814541 2026] [security2:error] [pid 27664:tid 27664] [client 39.154.6.140:1638] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url\|user-Agent\|www\\\\.weblogs\\\\.com\|(?:jakart\|vi)a\|(google\|i{0,1}explorer{0,1}\\\\.exe\|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)\|\\\\bdatacha0s\\\\b\|; widows\|\\\\\\\\r\|a(?: href=\|d(?:sarobot\|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler\|\|blairsmasterplan.com\|F\|4"] [data "User-Agent"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "blairsmasterplan.com"] [uri "/"] [unique_id "alCEIzUuaQ-0YF7y0Nl3oAAAAA0"], referer: http://blairsmasterplan.com/ show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-06-20 22:03:11 (2 weeks ago)	(mod_security) mod_security (id:210831) triggered by 39.154.6.140 (-): 1 in the last 300 secs; Ports ... show more (mod_security) mod_security (id:210831) triggered by 39.154.6.140 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Jun 20 18:03:00.588009 2026] [security2:error] [pid 5952:tid 5952] [client 39.154.6.140:11055] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url\|user-Agent\|www\\\\.weblogs\\\\.com\|(?:jakart\|vi)a\|(google\|i{0,1}explorer{0,1}\\\\.exe\|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)\|\\\\bdatacha0s\\\\b\|; widows\|\\\\\\\\r\|a(?: href=\|d(?:sarobot\|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler\|\|www.samuelpaley.com\|F\|4"] [data "User-Agent"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "www.samuelpaley.com"] [uri "/"] [unique_id "ajcOFJHNXmJwIdM9qammhQAAAFs"], referer: http://www.samuelpaley.com/ show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-06-04 21:46:18 (1 month ago)	(mod_security) mod_security (id:210831) triggered by 39.154.6.140 (-): 1 in the last 300 secs; Ports ... show more (mod_security) mod_security (id:210831) triggered by 39.154.6.140 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jun 04 17:46:05.244220 2026] [security2:error] [pid 8641:tid 8641] [client 39.154.6.140:10476] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url\|user-Agent\|www\\\\.weblogs\\\\.com\|(?:jakart\|vi)a\|(google\|i{0,1}explorer{0,1}\\\\.exe\|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)\|\\\\bdatacha0s\\\\b\|; widows\|\\\\\\\\r\|a(?: href=\|d(?:sarobot\|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler\|\|stantontownship.org\|F\|4"] [data "User-Agent"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "stantontownship.org"] [uri "/"] [unique_id "aiHyHUbgVIs9miyF5ulTmQAAABE"], referer: http://stantontownship.org/ show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-05-24 23:09:42 (1 month ago)	(mod_security) mod_security (id:210831) triggered by 39.154.6.140 (-): 1 in the last 300 secs; Ports ... show more (mod_security) mod_security (id:210831) triggered by 39.154.6.140 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun May 24 19:09:32.761146 2026] [security2:error] [pid 22124:tid 22124] [client 39.154.6.140:5758] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url\|user-Agent\|www\\\\.weblogs\\\\.com\|(?:jakart\|vi)a\|(google\|i{0,1}explorer{0,1}\\\\.exe\|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)\|\\\\bdatacha0s\\\\b\|; widows\|\\\\\\\\r\|a(?: href=\|d(?:sarobot\|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler\|\|www.i-slim.net\|F\|4"] [data "User-Agent"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "www.i-slim.net"] [uri "/"] [unique_id "ahOFLItzWRKzgmkXN5ThXwAAABg"], referer: http://www.i-slim.net/ show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-05-24 22:49:46 (1 month ago)	(mod_security) mod_security (id:210831) triggered by 39.154.6.140 (-): 1 in the last 300 secs; Ports ... show more (mod_security) mod_security (id:210831) triggered by 39.154.6.140 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun May 24 18:49:36.943978 2026] [security2:error] [pid 3088:tid 3088] [client 39.154.6.140:5708] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url\|user-Agent\|www\\\\.weblogs\\\\.com\|(?:jakart\|vi)a\|(google\|i{0,1}explorer{0,1}\\\\.exe\|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)\|\\\\bdatacha0s\\\\b\|; widows\|\\\\\\\\r\|a(?: href=\|d(?:sarobot\|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler\|\|www.rahjx.net\|F\|4"] [data "User-Agent"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "www.rahjx.net"] [uri "/"] [unique_id "ahOAgJeFpiHugfHi3-IEkwAAAAI"], referer: http://www.rahjx.net/ show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-05-20 06:58:19 (1 month ago)	(mod_security) mod_security (id:210831) triggered by 39.154.6.140 (-): 1 in the last 300 secs; Ports ... show more (mod_security) mod_security (id:210831) triggered by 39.154.6.140 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed May 20 02:58:09.346866 2026] [security2:error] [pid 3910:tid 3910] [client 39.154.6.140:5940] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url\|user-Agent\|www\\\\.weblogs\\\\.com\|(?:jakart\|vi)a\|(google\|i{0,1}explorer{0,1}\\\\.exe\|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)\|\\\\bdatacha0s\\\\b\|; widows\|\\\\\\\\r\|a(?: href=\|d(?:sarobot\|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler\|\|indie100.com\|F\|4"] [data "User-Agent"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "indie100.com"] [uri "/"] [unique_id "ag1bgZP3dD789dCcEu6VbwAAACw"], referer: https://indie100.com/ show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-04-23 08:11:13 (2 months ago)	(mod_security) mod_security (id:210831) triggered by 39.154.6.140 (-): 1 in the last 300 secs; Ports ... show more (mod_security) mod_security (id:210831) triggered by 39.154.6.140 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Apr 23 04:11:04.995056 2026] [security2:error] [pid 18768:tid 18768] [client 39.154.6.140:29655] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url\|user-Agent\|www\\\\.weblogs\\\\.com\|(?:jakart\|vi)a\|(google\|i{0,1}explorer{0,1}\\\\.exe\|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)\|\\\\bdatacha0s\\\\b\|; widows\|\\\\\\\\r\|a(?: href=\|d(?:sarobot\|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler\|\|envirotreecare.com\|F\|4"] [data "User-Agent"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "envirotreecare.com"] [uri "/"] [unique_id "aenUGD_zE1rgFEZIWVMVPgAAABI"], referer: http://envirotreecare.com/ show less	Brute-Force Bad Web Bot Web App Attack
🇨🇳 ThreatBook.io	2026-02-13 00:40:07 (4 months ago)	ThreatBook Intelligence: Zombie,Spam more details on https://threatbook.io/ip/39.154.6.140 2026-02-1 ... show more ThreatBook Intelligence: Zombie,Spam more details on https://threatbook.io/ip/39.154.6.140 2026-02-12 09:41:28 /robots.txt show less	Web App Attack
🇨🇳 ThreatBook.io	2025-11-13 00:04:31 (7 months ago)	ThreatBook Intelligence: Gateway more details on http://threatbook.io/ip/39.154.6.140 2025-11-12 04: ... show more ThreatBook Intelligence: Gateway more details on http://threatbook.io/ip/39.154.6.140 2025-11-12 04:34:56 /favicon.ico show less	Web App Attack
🇺🇸 TPI-Abuse	2025-09-13 00:44:09 (9 months ago)	(mod_security) mod_security (id:210350) triggered by 39.154.6.140 (-): 1 in the last 300 secs; Ports ... show more (mod_security) mod_security (id:210350) triggered by 39.154.6.140 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Sep 12 20:44:01.182118 2025] [security2:error] [pid 29121:tid 29121] [client 39.154.6.140:5766] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close\|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close\|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found\|\|www.renju.net\|F\|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.renju.net"] [uri "/game/114165/"] [unique_id "aMS-UQYZKImMYUqaLYulaAAAAAw"], referer: https://www.renju.net/game/114165 show less	Brute-Force Bad Web Bot Web App Attack
🇨🇳 ThreatBook.io	2025-09-05 00:07:12 (10 months ago)	ThreatBook Intelligence: Gateway more details on http://threatbook.io/ip/39.154.6.140 2025-09-04 02: ... show more ThreatBook Intelligence: Gateway more details on http://threatbook.io/ip/39.154.6.140 2025-09-04 02:06:44 / show less	Web App Attack
🇨🇳 ThreatBook.io	2025-07-23 00:02:03 (11 months ago)	ThreatBook Intelligence: Gateway more details on http://threatbook.io/ip/39.154.6.140 2025-07-22 06: ... show more ThreatBook Intelligence: Gateway more details on http://threatbook.io/ip/39.154.6.140 2025-07-22 06:27:41 /favicon.ico show less	Web App Attack
🇨🇳 ThreatBook.io	2025-07-18 23:57:47 (11 months ago)	ThreatBook Intelligence: Gateway more details on http://threatbook.io/ip/39.154.6.140 2025-07-18 20: ... show more ThreatBook Intelligence: Gateway more details on http://threatbook.io/ip/39.154.6.140 2025-07-18 20:04:55 /login.php?a=version show less	Web App Attack
🇨🇳 ThreatBook.io	2025-05-05 00:27:14 (1 year ago)	ThreatBook Intelligence: Gateway more details on http://threatbook.io/ip/39.154.6.140 2025-05-04 23: ... show more ThreatBook Intelligence: Gateway more details on http://threatbook.io/ip/39.154.6.140 2025-05-04 23:35:57 /sitemap.xml show less	Web App Attack

Showing 1 to 14 of 14 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇦🇷 190.19.197.221

🇺🇸 172.234.218.22

🇯🇵 161.33.14.212

🇺🇸 140.235.0.235

🇸🇬 101.47.14.46

🇩🇪 43.240.149.14

🇮🇩 203.145.63.139

🇬🇧 193.163.125.84

🇳🇱 185.223.235.19

🇺🇸 172.237.150.22

🇺🇸 162.216.150.89

🇺🇸 146.190.41.214

🇹🇷 94.154.43.30

🇳🇱 91.92.242.143

🇳🇱 89.21.67.154

🇫🇷 85.217.140.35

🇫🇷 85.217.140.25

🇸🇬 47.130.108.237

🇵🇰 39.52.54.232

🇦🇷 216.28.135.243