JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 39.99.248.143

39.99.248.143 was found in our database!

This IP was reported 138 times. Confidence of Abuse is 63%: ?

63%

ISP	Aliyun Computing Co., LTD
Usage Type	Data Center/Web Hosting/Transit
ASN	AS37963
Domain Name	alibabacloud.com
Country	🇨🇳 China
City	Beijing, Beijing

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 39.99.248.143

Whois 39.99.248.143

IP Abuse Reports for 39.99.248.143:

This IP address has been reported a total of 138 times from 17 distinct sources. 39.99.248.143 was first reported on August 28th 2026, and the most recent report was 5 hours ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇸🇮 administrator	2026-10-22 22:05:48 (5 hours ago)	2026-10-19 11:19:52,579 fail2ban.actions [1165]: NOTICE [apache-fakegooglebot] Ban 39.99.248 ... show more 2026-10-19 11:19:52,579 fail2ban.actions [1165]: NOTICE [apache-fakegooglebot] Ban 39.99.248.143 2026-10-19 11:19:52,579 fail2ban.actions [1165]: NOTICE [apache-fakegooglebot] Ban 39.99.248.143 2026-10-19 11:19:52,579 fail2ban.actions [1165]: NOTICE [apache-fakegooglebot] Ban 39.99.248.143 ... show less	Bad Web Bot Web Spam Email Spam Blog Spam Port Scan Brute-Force Web App Attack
🇦🇺 FireGuard Server	2026-10-21 21:40:40 (1 day ago)	Blocked by os-abuseipdb; 4 hits, proto=tcp, ports=587	Port Scan Hacking
🇨🇿 lp	2026-10-20 16:30:50 (2 days ago)	Email account brute force: 1 attempts were recorded from 39.99.248.143 2026-10-20T18:07:06+0200 warn ... show more Email account brute force: 1 attempts were recorded from 39.99.248.143 2026-10-20T18:07:06+0200 warning: unknown[39.99.248.143]: SASL authentication failed show less	Brute-Force
🇺🇸 mnsf	2026-10-20 16:05:05 (2 days ago)	Abuse Detected (9)	Brute-Force Web App Attack
🇩🇪 LRob	2026-10-18 19:43:05 (4 days ago)	Web exploit attempt \| method: GET \| path: /wp-login.php \| ua: Mozilla/5.0 (Windows NT 6.3; Win64; x6 ... show more Web exploit attempt \| method: GET \| path: /wp-login.php \| ua: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.0.0 Safari/537.36 \| 2026-10-18 19:43 UTC show less	Hacking Web App Attack
🇩🇪 ITcloud	2026-10-18 18:44:30 (4 days ago)	Automated credential attack against a legacy web authentication flow: 3588 matching requests observe ... show more Automated credential attack against a legacy web authentication flow: 3588 matching requests observed between 2026-10-18T09:15:00+00:00 and 2026-10-18T18:44:30+00:00 UTC. show less	Brute-Force Web App Attack
🇩🇪 ITcloud	2026-10-17 03:25:27 (5 days ago)	Credential brute-force against a web authentication endpoint: 1034 failed login attempts observed be ... show more Credential brute-force against a web authentication endpoint: 1034 failed login attempts observed between 2026-10-15T23:49:59+00:00 and 2026-10-17T03:25:27+00:00 UTC. show less	Brute-Force Web App Attack
Anonymous	2026-09-17 06:07:34 (1 month ago)	Invalid user support from 39.99.248.143 port 37734	Brute-Force SSH
Anonymous	2026-09-17 06:07:34 (1 month ago)	Invalid user support from 39.99.248.143 port 37734	Brute-Force SSH
🇬🇧 consul.to	2026-09-17 01:58:40 (1 month ago)	Web attack/malicious scanning detected	Web App Attack
🇫🇷 smtp.com.es	2026-09-16 19:42:33 (1 month ago)	Brute force attempt.	Brute-Force Email Spam
🇺🇸 TPI-Abuse	2026-09-16 17:33:55 (1 month ago)	(mod_security) mod_security (id:225170) triggered by 39.99.248.143 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:225170) triggered by 39.99.248.143 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Sep 16 13:33:51.728367 2026] [security2:error] [pid 1670:tid 1670] [client 39.99.248.143:56968] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)\|\|nnrentacar.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "nnrentacar.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aqrS_wzUhQAZ7ruMRbtSZwAAABE"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 mnogoweb	2026-09-16 14:42:30 (1 month ago)	(smtpauth) Failed SMTP AUTH login from 39.99.248.143 (CN/China/-): 5 in the last 3600 secs; Ports: * ... show more (smtpauth) Failed SMTP AUTH login from 39.99.248.143 (CN/China/-): 5 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_SMTPAUTH; Logs: 2026-09-16 08:20:00 login authenticator failed for (45.74.31.30) [39.99.248.143]: 535 Incorrect authentication data ([email protected]) 2026-09-16 08:25:55 login authenticator failed for (45.74.31.30) [39.99.248.143]: 535 Incorrect authentication data ([email protected]) 2026-09-16 08:31:04 login authenticator failed for (45.74.31.30) [39.99.248.143]: 535 Incorrect authentication data ([email protected]) 2026-09-16 08:34:27 login authenticator failed for (45.74.31.42) [39.99.248.143]: 535 Incorrect authentication data ([email protected]) 2026-09-16 08:39:40 login authenticator failed for (45.74.31.30) [39.99.248.143]: 535 Incorrect authentication data ([email protected]) show less	Port Scan
🇺🇸 mnogoweb	2026-09-16 14:00:07 (1 month ago)	(smtpauth) Failed SMTP AUTH login from 39.99.248.143 (CN/China/-): 5 in the last 3600 secs; Ports: * ... show more (smtpauth) Failed SMTP AUTH login from 39.99.248.143 (CN/China/-): 5 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_SMTPAUTH; Logs: 2026-09-16 07:34:49 login authenticator failed for (45.74.31.42) [39.99.248.143]: 535 Incorrect authentication data ([email protected]) 2026-09-16 07:40:07 login authenticator failed for (45.74.31.30) [39.99.248.143]: 535 Incorrect authentication data ([email protected]) 2026-09-16 07:43:43 login authenticator failed for (45.74.31.42) [39.99.248.143]: 535 Incorrect authentication data ([email protected]) 2026-09-16 07:47:07 login authenticator failed for (45.74.31.30) [39.99.248.143]: 535 Incorrect authentication data ([email protected]) 2026-09-16 08:00:05 login authenticator failed for (45.74.31.42) [39.99.248.143]: 535 Incorrect authentication data ([email protected]) show less	Port Scan
🇺🇸 mnogoweb	2026-09-16 13:11:44 (1 month ago)	(smtpauth) Failed SMTP AUTH login from 39.99.248.143 (CN/China/-): 5 in the last 3600 secs; Ports: * ... show more (smtpauth) Failed SMTP AUTH login from 39.99.248.143 (CN/China/-): 5 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_SMTPAUTH; Logs: 2026-09-16 06:42:22 login authenticator failed for (45.74.31.42) [39.99.248.143]: 535 Incorrect authentication data 2026-09-16 06:51:13 login authenticator failed for (45.74.31.42) [39.99.248.143]: 535 Incorrect authentication data 2026-09-16 06:58:14 login authenticator failed for (45.74.31.42) [39.99.248.143]: 535 Incorrect authentication data ([email protected]) 2026-09-16 07:11:20 plain authenticator failed for (mail.net-zero.biz) [39.99.248.143]: 535 Incorrect authentication data ([email protected]) 2026-09-16 07:11:40 login authenticator failed for (45.74.31.30) [39.99.248.143]: 535 Incorrect authentication data ([email protected]) show less	Port Scan

Showing 1 to 15 of 138 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇸🇷 186.179.163.206

🇮🇩 182.253.79.194

🇰🇷 175.213.102.205

🇮🇹 151.95.23.125

🇮🇳 66.116.253.71

🇩🇪 45.137.203.60

🇺🇸 23.95.72.132

🇺🇸 216.180.246.131

🇧🇪 207.175.92.23

🇨🇱 201.223.238.59

🇺🇸 185.238.231.22

🇳🇱 165.22.205.203

🇮🇩 163.7.11.126

🇺🇸 162.216.149.82

🇵🇰 153.117.55.27

🇺🇸 129.121.123.80

🇻🇳 103.241.43.193

🇮🇩 103.197.94.135

🇫🇷 91.196.152.203

🇨🇦 85.217.149.67