JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 138.68.105.22

138.68.105.22 was found in our database!

This IP was reported 32 times. Confidence of Abuse is 40%: ?

40%

ISP	DigitalOcean, LLC
Usage Type	Data Center/Web Hosting/Transit
ASN	AS14061
Domain Name	digitalocean.com
Country	🇩🇪 Germany
City	Frankfurt am Main, Hesse

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 138.68.105.22

Whois 138.68.105.22

IP Abuse Reports for 138.68.105.22:

This IP address has been reported a total of 32 times from 27 distinct sources. 138.68.105.22 was first reported on November 21st 2021, and the most recent report was 4 days ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇳🇱 Ike57	2026-09-15 07:36:53 (4 days ago)	Detected activity: Proxycheck.io Risk score: 33%; Blacklisted user agent; Abuse Confidence score ove ... show more Detected activity: Proxycheck.io Risk score: 33%; Blacklisted user agent; Abuse Confidence score over set treshold; Blocked by web application firewall; Datacenter IP detected; Is also listed in DNSBL: (Uceprotect) \| User-Agent: Apache-HttpClient/5.3.1 (Java/25.0.4) show less	Bad Web Bot Blog Spam
🇩🇪 LRob	2026-09-14 11:14:08 (5 days ago)	Asking over plain http and never following the redirect served — a crawler that reads nothing it ask ... show more Asking over plain http and never following the redirect served — a crawler that reads nothing it asks for \| method: GET \| path: /contact \| 2026-09-14 11:14 UTC show less	Bad Web Bot
🇩🇪 LRob	2026-09-12 01:09:21 (1 week ago)	Asking over plain http and never following the redirect served — a crawler that reads nothing it ask ... show more Asking over plain http and never following the redirect served — a crawler that reads nothing it asks for \| method: GET \| path: / \| 2026-09-12 01:09 UTC show less	Bad Web Bot
🇪🇸 Michael McCarthy	2026-09-10 23:35:01 (1 week ago)		Web Spam
🇦🇺 paulshipley.com.au	2026-09-05 19:44:37 (1 week ago)	[Sun Sep 06 05:44:36.425317 2026] [security2:error] [pid 778448] [client 138.68.105.22:48822] [clien ... show more [Sun Sep 06 05:44:36.425317 2026] [security2:error] [pid 778448] [client 138.68.105.22:48822] [client 138.68.105.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/modsecurity/crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.4"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "furst.com.au"] [uri "/"] [unique_id "apxxJPdKfPf3N4hluKlQnQAAAA0"] ... show less	Web App Attack
🇨🇭 4server	2026-09-03 02:40:54 (2 weeks ago)	[ThuSep0304:40:50.5007082026][security2:error][pid2378924:tid2379851][client138.68.105.22:0]ModSecur ... show more [ThuSep0304:40:50.5007082026][security2:error][pid2378924:tid2379851][client138.68.105.22:0]ModSecurity:Accessdeniedwithcode403\(phase2\).OperatorGEmatched5atTX:anomaly_score.[file\"/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf\"][line\"94\"][id\"949110\"][msg\"InboundAnomalyScoreExceeded\(TotalScore:5\)\"][severity\"CRITICAL\"][ver\"OWASP_CRS/3.3.10\"][tag\"application-multi\"][tag\"language-multi\"][tag\"platform-multi\"][tag\"attack-generic\"][hostname\"4spv.net\"][uri\"/\"][unique_id\"apjeMpyZ2NTEBbGfdOiW3wAAAIQ\"] show less	Hacking Web App Attack
Anonymous	2026-08-31 13:41:17 (2 weeks ago)	Web application attack detected.	Web App Attack
🇩🇪 Jochen Pretli	2026-08-30 06:39:46 (2 weeks ago)	connection to honeypot	Email Spam Port Scan
🇺🇦 URAN Publishing Service	2026-08-30 00:59:47 (2 weeks ago)	[30/Aug/2026:03:59:47 +0300] -- 138.68.105.22 Ban reason: User-Agent Java/	Bad Web Bot Web App Attack
🇺🇸 xmission.com	2025-10-30 02:24:52 (10 months ago)	Blocked by UFW (TCP on 465) Source port: 61013 TTL: 235 Packet length: 44 TOS: 0x08 This report (fo ... show more Blocked by UFW (TCP on 465) Source port: 61013 TTL: 235 Packet length: 44 TOS: 0x08 This report (for 138.68.105.22) was generated by: https://github.com/sefinek/UFW-AbuseIPDB-Reporter show less	Port Scan
🇩🇪 centurion	2025-10-30 02:09:30 (10 months ago)	Unauthorized attempt on lab [1133/tcp] Source port: 61008 TTL: 245 Packet length: 44 TOS: 0x00 https ... show more Unauthorized attempt on lab [1133/tcp] Source port: 61008 TTL: 245 Packet length: 44 TOS: 0x00 https://github.com/sefinek/UFW-AbuseIPDB-Reporter show less	Port Scan
🇺🇸 MPL	2025-10-30 02:04:53 (10 months ago)	tcp/443 (3 or more attempts)	Port Scan
🇲🇾 syokadmin	2024-09-18 12:57:57 (2 years ago)	138.68.105.22 (DE/Germany/-), more than 2 Apache 403 hits in the last 3600 secs	Brute-Force
🇵🇱 auto_reporter	2021-11-24 04:58:01 (4 years ago)	Unauthorized port sweep	Port Scan
🇸🇬 Samuel K	2021-11-23 18:00:10 (4 years ago)	Web scan/attack	Port Scan Web App Attack

Showing 1 to 15 of 32 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇪🇨 190.10.189.68

🇱🇹 62.60.130.253

🇮🇳 160.30.39.50

🇦🇺 134.199.159.238

🇺🇸 97.74.236.4

🇩🇪 63.176.8.218

🇮🇩 43.157.200.91

🇬🇧 35.203.210.184

🇰🇷 14.34.130.204

🇩🇪 213.209.159.241

🇧🇷 179.190.100.143

🇺🇸 156.232.10.218

🇺🇸 107.115.39.177

🇫🇷 104.165.180.151

🇳🇱 91.148.244.131

🇳🇱 81.171.72.93

🇰🇿 212.154.234.9

🇨🇳 211.155.100.9

🇭🇰 206.238.40.37

🇧🇷 205.210.31.130