JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 138.68.105.164

138.68.105.164 was found in our database!

This IP was reported 19 times. Confidence of Abuse is 55%: ?

55%

ISP	DigitalOcean, LLC
Usage Type	Data Center/Web Hosting/Transit
ASN	AS14061
Domain Name	digitalocean.com
Country	🇩🇪 Germany
City	Frankfurt am Main, Hesse

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 138.68.105.164

Whois 138.68.105.164

IP Abuse Reports for 138.68.105.164:

This IP address has been reported a total of 19 times from 15 distinct sources. 138.68.105.164 was first reported on January 26th 2025, and the most recent report was 1 hour ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇵🇱 Budyn	2026-10-22 14:27:38 (1 hour ago)	Automated threat detected by Budyn Honeypot Sinkhole. Attack type: Unknown Bot / General Web Recon. ... show more Automated threat detected by Budyn Honeypot Sinkhole. Attack type: Unknown Bot / General Web Recon. Malicious scanner triggered a security trap targeting emulated vulnerabilities. Evidence: HOST: beta.astropot.tech \| URI: /wp-json/batch/v1 \| UA: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 \| BODY: [Empty / GET Request] \| HEADERS: {"X-Forwarded-Proto":"https","Cf-Visitor":"{\"scheme\":\"https\"}","Cf-Ipcountry":"DE","Cf-Connecting-Ip":"138.68.105.164","Cdn-Loop":"cloudflare; loops=1","Cf-Ray":"a4e92f14df5e54eb-FRA","Connection":"Keep-Alive","Accept-Encoding":"gzip, br","X-Forwarded-For":"138.68.105.164"} show less	Bad Web Bot Web App Attack
🇩🇪 lolyay	2026-10-22 13:03:49 (2 hours ago)	138.68.105.164 - - [22/Oct/2026:13:03:48 +0000] "POST /wp-json/batch/v1 HTTP/1.1" 200 4 "-" "Mozilla ... show more 138.68.105.164 - - [22/Oct/2026:13:03:48 +0000] "POST /wp-json/batch/v1 HTTP/1.1" 200 4 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36" 138.68.105.164 - - [22/Oct/2026:13:03:48 +0000] "POST /wp-json/batch/v1 HTTP/1.1" 200 4 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36" ... show less	Web App Attack Bad Web Bot
🇸🇪 vaia.cloud	2026-10-22 11:50:04 (3 hours ago)	crowdsecurity/http-cve-probing	Brute-Force Web App Attack
Anonymous	2026-10-22 11:30:05 (4 hours ago)	CrowdSec decision: crowdsecurity/http-cve-probing (origin: crowdsec)	Port Scan
🇵🇱 Budyn	2026-10-22 11:25:33 (4 hours ago)	Automated threat detected by Budyn Honeypot Sinkhole. Attack type: Unknown Bot / General Web Recon. ... show more Automated threat detected by Budyn Honeypot Sinkhole. Attack type: Unknown Bot / General Web Recon. Malicious scanner triggered a security trap targeting emulated vulnerabilities. Evidence: HOST: sql.budyn.xyz \| URI: /wp-json/batch/v1 \| UA: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 \| BODY: [Empty / GET Request] \| HEADERS: {"X-Forwarded-Proto":"https","Cf-Visitor":"{\"scheme\":\"https\"}","Cf-Ipcountry":"DE","Cf-Connecting-Ip":"138.68.105.164","Cdn-Loop":"cloudflare; loops=1","Cf-Ray":"a4e8245b7f89a062-FRA","Connection":"Keep-Alive","Accept-Encoding":"gzip, br","X-Forwarded-For":"138.68.105.164"} show less	Bad Web Bot Web App Attack
Anonymous	2026-10-22 10:00:04 (5 hours ago)	IP matched detection query 20 more in short time bad rqs.	Brute-Force Web App Attack Hacking
🇩🇪 LRob	2026-10-22 09:44:24 (5 hours ago)	Vulnerability scanning \| method: GET \| path: / \| ua: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537 ... show more Vulnerability scanning \| method: GET \| path: / \| ua: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 \| 2026-10-22 09:44 UTC show less	Port Scan Web App Attack
🇩🇪 mravb	2026-10-22 08:53:27 (6 hours ago)	138.68.105.164 - - [22/Oct/2026:11:53:27 +0300] "GET /wp-login.php HTTP/1.1" 444 0 "-" "Mozilla/5.0" ... show more 138.68.105.164 - - [22/Oct/2026:11:53:27 +0300] "GET /wp-login.php HTTP/1.1" 444 0 "-" "Mozilla/5.0" ... show less	Web App Attack Hacking
🇵🇱 Budyn	2026-10-22 08:43:50 (6 hours ago)	Automated threat detected by Budyn Honeypot Sinkhole. Attack type: WP Path Scanning (Recon). Malicio ... show more Automated threat detected by Budyn Honeypot Sinkhole. Attack type: WP Path Scanning (Recon). Malicious scanner triggered a security trap targeting emulated vulnerabilities. Evidence: HOST: sql.budyn.xyz \| URI: /wp-login.php \| UA: Mozilla/5.0 \| BODY: [Empty / GET Request] \| HEADERS: {"X-Forwarded-Proto":"https","Cf-Visitor":"{\"scheme\":\"https\"}","Cf-Ipcountry":"DE","Cf-Connecting-Ip":"138.68.105.164","Cdn-Loop":"cloudflare; loops=1","Cf-Ray":"a4e737788870dbd4-FRA","Connection":"Keep-Alive","Accept":"\/","Accept-Encoding":"gzip, br","X-Forwarded-For":"138.68.105.164"} show less	Bad Web Bot Web App Attack
🇩🇪 LRob	2026-10-22 08:37:45 (6 hours ago)	Not following 301 redirects — wasted requests \| host: meteo-centre-val-de-loire.fr \| method: GET \| p ... show more Not following 301 redirects — wasted requests \| host: meteo-centre-val-de-loire.fr \| method: GET \| path: /wp-login.php \| ua: Mozilla/5.0 \| src_port: 50670 show less	Bad Web Bot
🇧🇪 voormedia	2026-10-22 08:37:37 (6 hours ago)	Accessed trap at '/wp-login.php'	Web App Attack
🇩🇪 hidemail.app	2026-10-22 08:33:01 (7 hours ago)	Automated scan for exposed config/secret files and known web exploits (e.g. /.env, RCE probes); auto ... show more Automated scan for exposed config/secret files and known web exploits (e.g. /.env, RCE probes); auto-banned by fail2ban. show less	Web App Attack Hacking
🇺🇸 MPL	2025-10-21 00:58:15 (1 year ago)	tcp/8089 (2 or more attempts)	Port Scan
🇺🇸 MPL	2025-10-21 00:58:15 (1 year ago)	tcp/8089	Port Scan
🇧🇾 hbars.by	2025-10-21 00:39:17 (1 year ago)	2025-10-21T03:39:16.643134+03:00 radionet dovecot: pop3-login: Disconnected: Disconnected: Too many ... show more 2025-10-21T03:39:16.643134+03:00 radionet dovecot: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=138.68.105.164, lip=192.168.3.3, TLS, session=<G8QEbqBBUsKKRGmk> 2025-10-21T03:39:16.778962+03:00 radionet dovecot: pop3-login: Disconnected: Connection closed: read(size=599) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=138.68.105.164, lip=192.168.3.3, TLS handshaking: read(size=599) failed: Connection reset by peer, session=<E9YGbqBBWsKKRGmk> show less	Brute-Force

Showing 1 to 15 of 19 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇳🇱 195.178.110.228

🇧🇷 170.247.7.180

🇩🇪 162.158.111.8

🇺🇸 157.245.85.173

127.0.0.1

🇮🇳 122.183.45.63

🇪🇬 105.198.238.186

🇧🇩 103.143.35.218

🇭🇺 89.134.198.210

🇺🇸 76.18.43.134

🇫🇷 51.75.253.68

🇸🇬 47.79.13.21

🇹🇼 36.238.174.167

🇨🇳 8.148.226.5

🇨🇭 209.99.185.195

🇧🇷 209.14.12.251

🇺🇸 195.184.76.114

🇲🇽 189.234.134.125

🇨🇴 181.49.8.57

🇻🇳 180.93.54.135