JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 138.16.161.225

138.16.161.225 was found in our database!

This IP was reported 61 times. Confidence of Abuse is 100%: ?

100%

ISP	Hosting technology LTD
Usage Type	Data Center/Web Hosting/Transit
ASN	AS48282
Hostname(s)	v3186186.hosted-by-vdsina.ru
Domain Name	vdsina.ru
Country	🇷🇺 Russian Federation
City	Moscow, Moscow

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 138.16.161.225

Whois 138.16.161.225

IP Abuse Reports for 138.16.161.225:

This IP address has been reported a total of 61 times from 51 distinct sources. 138.16.161.225 was first reported on July 21st 2026, and the most recent report was 6 hours ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇦🇺 CalmBrain	2026-07-25 16:00:50 (6 hours ago)	This IP was detected by CrowdSec triggering crowdsecurity/http-cve-2021-41773	Web App Attack Hacking
Anonymous	2026-07-22 08:15:47 (3 days ago)	Apache HTTP Server Directory Traversal.	Web App Attack
🇩🇪 fleckenbase	2026-07-22 08:11:53 (3 days ago)	apache-noscript ...	Brute-Force Web App Attack
🇺🇸 TPI-Abuse	2026-07-22 08:02:33 (3 days ago)	(mod_security) mod_security (id:218420) triggered by 138.16.161.225 (v3186186.hosted-by-vdsina.ru): ... show more (mod_security) mod_security (id:218420) triggered by 138.16.161.225 (v3186186.hosted-by-vdsina.ru): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jul 22 04:02:26.136791 2026] [security2:error] [pid 537081:tid 537081] [client 138.16.161.225:49782] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i)php://(std(in\|out\|err)\|(in\|out)put\|fd\|memory\|temp\|filter)" at ARGS_NAMES:\\xadd allow_url_include=1 \\xadd auto_prepend_file=php://input. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/21_PHP_PHPGen.conf"] [line "38"] [id "218420"] [rev "2"] [msg "COMODO WAF: PHP Injection Attack: I/O Stream Found\|\|192.64.151.37:80\|F\|2"] [data "Matched Data: php://input found within ARGS_NAMES:\\x5cxadd allow_url_include=1 \\x5cxadd auto_prepend_file=php://input: \\xadd allow_url_include=1 \\xadd auto_prepend_file=php://input"] [severity "CRITICAL"] [tag "CWAF"] [tag "PHPGen"] [hostname "192.64.151.37"] [uri "/hello.world"] [unique_id "amB5Ej9-QuxohHyMCu9ZrQAAAAo"] show less	Brute-Force Bad Web Bot Web App Attack
🇩🇪 langenkamp-media	2026-07-22 07:33:11 (3 days ago)	Fail2Ban: Banned from jail nginx-badbots on 3dausdu.de	Bad Web Bot
🇩🇪 NewGastroline	2026-07-22 07:14:58 (3 days ago)	Malicious request blocked by CrowdSec on gastro-prod1.boreus.de	Bad Web Bot Web App Attack
🇺🇸 RAP	2026-07-22 07:05:12 (3 days ago)	2026-07-22 07:05:12 UTC Unauthorized activity to TCP port 23. Telnet	Port Scan
🇯🇵 Hydrated8853	2026-07-22 06:02:22 (3 days ago)	2026-07-22T14:01:24.950654+08:00 jp4-20260416220303fc0b1b sshd[867235]: Invalid user orangepi from 1 ... show more 2026-07-22T14:01:24.950654+08:00 jp4-20260416220303fc0b1b sshd[867235]: Invalid user orangepi from 138.16.161.225 port 56208 2026-07-22T14:01:24.962483+08:00 jp4-20260416220303fc0b1b sshd[867235]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=138.16.161.225 2026-07-22T14:01:26.961506+08:00 jp4-20260416220303fc0b1b sshd[867235]: Failed password for invalid user orangepi from 138.16.161.225 port 56208 ssh2 2026-07-22T14:02:21.191221+08:00 jp4-20260416220303fc0b1b sshd[867250]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=138.16.161.225 user=root 2026-07-22T14:02:22.682820+08:00 jp4-20260416220303fc0b1b sshd[867250]: Failed password for root from 138.16.161.225 port 35822 ssh2 ... show less	Brute-Force SSH
🇮🇳 evicky2002	2026-07-22 06:00:00 (3 days ago)	Confirmed malicious by STILWaters CTI platform (score=100, sources=1)	Hacking Brute-Force SSH
🇨🇭 Boxis.net NOC	2026-07-22 05:46:30 (3 days ago)	(sshd) Failed SSH login from 138.16.161.225 (US/United States/v3186186.hosted-by-vdsina.ru): 5 in th ... show more (sshd) Failed SSH login from 138.16.161.225 (US/United States/v3186186.hosted-by-vdsina.ru): 5 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_SSHD; Logs: Jul 22 07:30:32 da057 sshd[448049]: Invalid user orangepi from 138.16.161.225 port 49608 Jul 22 07:35:57 da057 sshd[459713]: Invalid user test from 138.16.161.225 port 41304 Jul 22 07:36:41 da057 sshd[460808]: Invalid user user from 138.16.161.225 port 42116 Jul 22 07:39:00 da057 sshd[464258]: Invalid user cirros from 138.16.161.225 port 52604 Jul 22 07:46:18 da057 sshd[479000]: Invalid user user1 from 138.16.161.225 port 33780 show less	Port Scan
🇩🇪 gadix	2026-07-22 05:44:34 (3 days ago)	[22/Jul/2026:07:44:32.783862 +0200] amBYwNea8fbC0HpynD0JywAAAFM 138.16.161.225 43180 127.0.0.1 7081 ... show more [22/Jul/2026:07:44:32.783862 +0200] amBYwNea8fbC0HpynD0JywAAAFM 138.16.161.225 43180 127.0.0.1 7081 [22/Jul/2026:07:44:33.050581 +0200] amBYwbHeTby0QpgxjWl9lgAAABU 138.16.161.225 43186 127.0.0.1 7081 [22/Jul/2026:07:44:33.161857 +0200] amBYwdea8fbC0HpynD0JzAAAAEY 138.16.161.225 43202 127.0.0.1 7081 ... show less	Web App Attack
🇳🇱 antikirra	2026-07-22 05:40:37 (3 days ago)	SSH Authentication Brute-Force	Brute-Force SSH
🇮🇳 Parth Maniar	2026-07-22 05:06:14 (3 days ago)	This IP address carried out 4 port scanning attempts on 21-07-2026. For more information or to repor ... show more This IP address carried out 4 port scanning attempts on 21-07-2026. For more information or to report interesting / incorrect findings, give me a shoutout @parthmaniar on Twitter. show less	Port Scan SSH
🇮🇳 Parth Maniar	2026-07-22 04:26:22 (3 days ago)	This IP address carried out 1 SSH credential attack (attempts) on 21-07-2026. For more information o ... show more This IP address carried out 1 SSH credential attack (attempts) on 21-07-2026. For more information or to report interesting / incorrect findings, give me a shoutout @parthmaniar on Twitter. show less	Brute-Force SSH
🇬🇧 blik2108	2026-07-22 04:23:06 (3 days ago)	138.16.161.225 - - [22/Jul/2026:04:23:04 +0000] "GET /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin ... show more 138.16.161.225 - - [22/Jul/2026:04:23:04 +0000] "GET /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1" 404 8954 "-" "libredtail-http" "-" 138.16.161.225 - - [22/Jul/2026:04:23:04 +0000] "GET /vendor/phpunit/phpunit/Util/PHP/eval-stdin.php HTTP/1.1" 404 8948 "-" "libredtail-http" "-" 138.16.161.225 - - [22/Jul/2026:04:23:05 +0000] "GET /vendor/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1" 404 8944 "-" "libredtail-http" "-" 138.16.161.225 - - [22/Jul/2026:04:23:05 +0000] "GET /vendor/phpunit/Util/PHP/eval-stdin.php HTTP/1.1" 404 8938 "-" "libredtail-http" "-" 138.16.161.225 - - [22/Jul/2026:04:23:05 +0000] "GET /vendor/phpunit/phpunit/LICENSE/eval-stdin.php HTTP/1.1" 404 8945 "-" "libredtail-http" "-" 138.16.161.225 - - [22/Jul/2026:04:23:05 +0000] "GET /vendor/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1" 404 8963 "-" "libredtail-http" "-" 138.16.161.225 - - [22/Jul/2026:04:23:05 +0000] "GET /phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1" 404 8945 "-" " ... show less	Web App Attack

Showing 1 to 15 of 61 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇩🇪 104.164.223.72

🇳🇱 45.148.10.147

🇯🇵 43.165.177.143

🇸🇦 2.90.115.222

🇨🇳 1.80.145.115

🇨🇳 183.252.196.153

🇧🇪 130.211.71.233

🇨🇳 106.13.39.89

🇺🇸 104.194.192.99

🇨🇳 101.126.91.34

🇸🇪 94.255.255.26

🇷🇴 86.124.127.130

🇭🇰 199.45.154.146

🇦🇪 198.38.94.67

🇵🇪 161.132.53.68

🇬🇧 149.34.191.39

🇫🇮 95.217.109.26

🇧🇬 79.124.40.106

🇺🇸 20.83.167.28

🇨🇦 138.197.137.54