JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 87.99.139.140

87.99.139.140 was found in our database!

This IP was reported 19 times. Confidence of Abuse is 87%: ?

87%

ISP	Hetzner Online GmbH
Usage Type	Data Center/Web Hosting/Transit
ASN	AS213230
Hostname(s)	static.140.139.99.87.clients.your-server.de
Domain Name	hetzner.com
Country	🇺🇸 United States of America
City	Ashburn, Virginia

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 87.99.139.140

Whois 87.99.139.140

IP Abuse Reports for 87.99.139.140:

This IP address has been reported a total of 19 times from 15 distinct sources. 87.99.139.140 was first reported on July 30th 2026, and the most recent report was 18 hours ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇬🇧 thetomtaylor.co.uk	2026-07-30 23:06:02 (18 hours ago)	Fail2Ban - [RECIDIVE]Repeat offender across multiple jails on recidive ... [ice01]	Brute-Force Bad Web Bot Exploited Host Web App Attack
🇬🇧 thetomtaylor.co.uk	2026-07-30 22:08:01 (19 hours ago)	Fail2Ban - [WEB]Exploit attempts (SQLi, RCE, path traversal) on webexploits ... [ice02,wa01,wa02]	Hacking SQL Injection Web App Attack
Anonymous	2026-07-30 20:20:04 (21 hours ago)	suspicious request in access.log	Web App Attack
🇺🇸 TPI-Abuse	2026-07-30 20:12:16 (21 hours ago)	(mod_security) mod_security (id:210492) triggered by 87.99.139.140 (static.140.139.99.87.clients.you ... show more (mod_security) mod_security (id:210492) triggered by 87.99.139.140 (static.140.139.99.87.clients.your-server.de): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jul 30 16:12:12.255920 2026] [security2:error] [pid 718505:tid 718505] [client 87.99.139.140:43442] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "unified-dispatch.com"] [uri "/.git/config"] [unique_id "amuwHEl4cPzbC1QoOeQ2uwAAABQ"] show less	Brute-Force Bad Web Bot Web App Attack
🇮🇩 Burayot	2026-07-30 20:00:06 (21 hours ago)	LF_MODSEC: (mod_security) mod_security (id:1000001) triggered by 87.99.139.140 (US/United States/sta ... show more LF_MODSEC: (mod_security) mod_security (id:1000001) triggered by 87.99.139.140 (US/United States/static.140.139.99.87.clients.your-server.de): 1 in the last 3600 secs show less	Web App Attack
🇨🇦 internetworld	2026-07-30 19:59:02 (21 hours ago)	87.99.139.140 - - [30/Jul/2026:19:59:01 +0000] "GET /.git/config HTTP/1.1" 200 513 "-" "Mozilla/5.0 ... show more 87.99.139.140 - - [30/Jul/2026:19:59:01 +0000] "GET /.git/config HTTP/1.1" 200 513 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 Chrome/131.0.0.0" ... show less	Bad Web Bot Web App Attack
🇺🇸 Starburst SysOp Team	2026-07-30 19:54:10 (21 hours ago)	Restricted File Access Attempt. Matched phrase ".git/" at REQUEST_FILENAME. (930130-stl2-14)	Hacking Web App Attack
🇬🇧 consul.to	2026-07-30 19:50:15 (21 hours ago)	Web attack/malicious scanning detected	Web App Attack
🇺🇦 URAN Publishing Service	2026-07-30 19:49:15 (21 hours ago)	87.99.139.140 - - [30/Jul/2026:22:49:14 +0300] "GET /.git/config HTTP/1.1" 301 586 "-" "Mozilla/5.0 ... show more 87.99.139.140 - - [30/Jul/2026:22:49:14 +0300] "GET /.git/config HTTP/1.1" 301 586 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 Safari/604.1" ... show less	Web App Attack
🇵🇱 Budyn	2026-07-30 19:47:30 (21 hours ago)	Automated threat detected by Budyn Honeypot Sinkhole. Attack type: CRITICAL: ModSecurity WAF Exploit ... show more Automated threat detected by Budyn Honeypot Sinkhole. Attack type: CRITICAL: ModSecurity WAF Exploit Block. Malicious scanner triggered a security trap targeting emulated vulnerabilities. Evidence: HOST: goblinpot.site \| URI: /.git/config \| UA: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 Chrome/131.0.0.0 \| BODY: [Empty / GET Request] show less	Hacking Web App Attack
🇺🇸 TPI-Abuse	2026-07-30 19:46:28 (21 hours ago)	(mod_security) mod_security (id:210492) triggered by 87.99.139.140 (static.140.139.99.87.clients.you ... show more (mod_security) mod_security (id:210492) triggered by 87.99.139.140 (static.140.139.99.87.clients.your-server.de): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jul 30 15:46:19.903995 2026] [security2:error] [pid 989479:tid 989479] [client 87.99.139.140:32884] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "pappakotis.com"] [uri "/.git/config"] [unique_id "amuqC2d407HeM6ysrSQlxwAAAA8"] show less	Brute-Force Bad Web Bot Web App Attack
🇫🇷 masterguru	2026-07-30 19:45:48 (21 hours ago)	Restricted File Access Attempt. Matched phrase ".git/" at REQUEST_FILENAME. (930130-201)	Hacking Web App Attack
🇩🇪 4server	2026-07-30 18:42:35 (22 hours ago)	[ThuJul3020:42:30.6569422026][security2:error][pid3304012:tid3304108][client87.99.139.140:0]ModSecur ... show more [ThuJul3020:42:30.6569422026][security2:error][pid3304012:tid3304108][client87.99.139.140:0]ModSecurity:Accessdeniedwithcode403\(phase2\).OperatorGEmatched5atTX:anomaly_score.[file\"/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf\"][line\"94\"][id\"949110\"][msg\"InboundAnomalyScoreExceeded\(TotalScore:5\)\"][severity\"CRITICAL\"][ver\"OWASP_CRS/3.3.10\"][tag\"application-multi\"][tag\"language-multi\"][tag\"platform-multi\"][tag\"attack-generic\"][hostname\"autoconfig.ksmstudio.ch\"][uri\"/.git/config\"][unique_id\"amubFiSO6bJ6UhDcrG-zzQAAAJU\"] show less	Port Scan Brute-Force Web App Attack
🇩🇪 on-com	2026-07-30 18:42:22 (22 hours ago)	URL scan	Brute-Force Web App Attack
🇺🇦 URAN Publishing Service	2026-07-30 18:40:24 (22 hours ago)	87.99.139.140 - - [30/Jul/2026:21:40:23 +0300] "GET /.git/config HTTP/1.1" 301 580 "-" "Mozilla/5.0 ... show more 87.99.139.140 - - [30/Jul/2026:21:40:23 +0300] "GET /.git/config HTTP/1.1" 301 580 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 Safari/604.1" 87.99.139.140 - - [30/Jul/2026:21:40:23 +0300] "GET /.git/config HTTP/1.1" 404 4648 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 Safari/604.1" ... show less	Web App Attack

Showing 1 to 15 of 19 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇺🇸 104.28.205.82

🇱🇹 91.224.92.159

🇺🇦 46.172.197.98

🇨🇭 20.203.133.142

🇻🇳 14.187.128.148

🇳🇱 213.176.26.37

🇵🇰 202.59.13.168

🇨🇳 139.227.161.212

🇫🇷 82.127.132.221

🇵🇱 37.190.134.211

🇭🇰 13.70.25.162

🇸🇪 4.223.65.51

🇩🇪 212.132.123.30

🇰🇷 211.106.137.135

🇧🇷 177.81.113.24

🇳🇱 91.92.40.151

🇺🇦 78.158.205.252

🇺🇸 77.36.112.8

🇺🇸 71.6.134.204

🇩🇪 51.116.175.137