JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

138.68.22.203

Activity Trending Down

Abuse Confidence Score

29% Elevated

13 reports

11 reporters · latest 1 month ago

ISP: DigitalOcean, LLC
Usage Type: Data Center/Web Hosting/Transit
ASN: AS14061
Domain Name: digitalocean.com
Country: 🇺🇸 United States of America
City: Santa Clara, California

ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report Whois

Example preview

Account required for the enhanced features Log in Sign up

Abuse Reports

Export reports CSV

Total reports

13 from 11 distinct reporters

First reported

September 27th 2026

Most recent report

1 month ago

Last 60 days

Top reporter locations 🇩🇪 Germany 4 🇵🇱 Poland 3 🇨🇭 Switzerland 1

Most common categories Web App Attack 11 Brute-Force 5 Bad Web Bot 4 Hacking 2

Old reports The most recent abuse report for this IP address is from 1 month ago. It is possible that this IP is no longer involved in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇸🇪 vaia.cloud	2026-10-08 19:50:03 UTC · (1 month ago)	crowdsecurity/http-cve-probing	Brute-Force Web App Attack
🇵🇱 Budyn	2026-10-08 17:13:19 UTC · (1 month ago)	Automated threat detected by Budyn Honeypot Sinkhole. Attack type: Unknown Bot / General Web Recon. Malicious scanner triggered a security trap targeting emulated vulnerabilities. Evidence: HOST: s3.goblinpot.store \| URI: /wp-json/batch/v1 \| UA: Mozi ... show more Automated threat detected by Budyn Honeypot Sinkhole. Attack type: Unknown Bot / General Web Recon. Malicious scanner triggered a security trap targeting emulated vulnerabilities. Evidence: HOST: s3.goblinpot.store \| URI: /wp-json/batch/v1 \| UA: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 \| BODY: [Empty / GET Request] show less	Bad Web Bot Web App Attack
🇵🇱 Budyn	2026-10-08 12:57:30 UTC · (1 month ago)	Automated threat detected by Budyn Honeypot Sinkhole. Attack type: Unknown Bot / General Web Recon. Malicious scanner triggered a security trap targeting emulated vulnerabilities. Evidence: HOST: cluster.definitelynotahoneypot.online \| URI: /wp-json/ ... show more Automated threat detected by Budyn Honeypot Sinkhole. Attack type: Unknown Bot / General Web Recon. Malicious scanner triggered a security trap targeting emulated vulnerabilities. Evidence: HOST: cluster.definitelynotahoneypot.online \| URI: /wp-json/batch/v1 \| UA: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 \| BODY: [Empty / GET Request] show less	Bad Web Bot Web App Attack
🇩🇪 ghostwarriors	2026-10-08 09:20:11 UTC · (1 month ago)	Attempts against non-existent wp-login	Brute-Force Web App Attack
🇩🇪 yitzhaq	2026-10-08 09:19:41 UTC · (1 month ago)	138.68.22.203 - - [08/Oct/2026:09:49:53 +0200] "GET /wp-login.php HTTP/1.1" 301 629 "-" "Mozilla/5.0" 138.68.22.203 - - [08/Oct/2026:09:49:54 +0200] "GET /wp-login.php HTTP/1.1" 403 4474 "-" "Mozilla/5.0" 138.68.22.203 - - [08/Oct/2026:11:19:37 +0200 ... show more 138.68.22.203 - - [08/Oct/2026:09:49:53 +0200] "GET /wp-login.php HTTP/1.1" 301 629 "-" "Mozilla/5.0" 138.68.22.203 - - [08/Oct/2026:09:49:54 +0200] "GET /wp-login.php HTTP/1.1" 403 4474 "-" "Mozilla/5.0" 138.68.22.203 - - [08/Oct/2026:11:19:37 +0200] "POST /wp-json/batch/v1 HTTP/1.1" 301 599 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36" 138.68.22.203 - - [08/Oct/2026:11:19:37 +0200] "GET /wp-json/batch/v1 HTTP/1.1" 403 4668 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36" 138.68.22.203 - - [08/Oct/2026:11:19:38 +0200] "POST /?rest_route=/batch/v1 HTTP/1.1" 301 609 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36" 138.68.22.203 - - [08/Oct/2026:11:19:38 +0200] "GET /?rest_route=/batch/v1 HTTP/1.1" 403 4669 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.3 show less	Web App Attack Hacking
🇫🇷 masterguru	2026-10-08 08:26:14 UTC · (1 month ago)	wp-login request blocked, no referer. Pattern match "wp-login.php" at REQUEST_URI. (88020-197)	Hacking
🇳🇱 Alt255	2026-10-08 08:25:27 UTC · (1 month ago)	[ti-17al] WordPress login brute-force: 4 suspicious requests detected by fail2ban jail apache-wordpress. Example: 138.68.22.203 - - [08/Oct/2026:10:21:28 +0200] "POST /wp-login.php HTTP/1.1" 200 9194 "-" "Mozilla/5.0" 138.68.22.203 - - [08/Oct/2026:1 ... show more [ti-17al] WordPress login brute-force: 4 suspicious requests detected by fail2ban jail apache-wordpress. Example: 138.68.22.203 - - [08/Oct/2026:10:21:28 +0200] "POST /wp-login.php HTTP/1.1" 200 9194 "-" "Mozilla/5.0" 138.68.22.203 - - [08/Oct/2026:10:22:51 +0200] "POST /wp-login.php HTTP/1.1" 200 9150 "-" "Mozilla/5.0" 138.68.22.203 - - [08/Oct/2026:10:24:01 +0200] "POST /wp-login.php HTTP/1.1" 200 14298 "-" "Mozilla/5.0" 138.68.22.203 - - [08/Oct/2026:10:25:20 +0200] "POST /wp-login.php HTTP/1.1" 200 9150 "-" "Mozilla/5.0" ... show less	Brute-Force Web App Attack
🇮🇹 VHosting	2026-10-08 08:25:04 UTC · (1 month ago)	Detected WordPress attack from different servers	Brute-Force Web App Attack
🇩🇪 Jurilia	2026-10-08 08:20:15 UTC · (1 month ago)	Probing for secret/configuration files (.env, .git, credentials) that do not exist. 1 request. Paths probed: /wp-login.php. First seen 2026-10-08T08:20:15Z, last seen 2026-10-08T08:20:15Z (UTC). Blocked automatically.	Web App Attack
🇵🇱 Budyn	2026-10-08 07:48:20 UTC · (1 month ago)	Automated threat detected by Budyn Honeypot Sinkhole. Attack type: WP Path Scanning (Recon). Malicious scanner triggered a security trap targeting emulated vulnerabilities. Evidence: HOST: vault.definitelynotahoneypot.xyz \| URI: /wp-login.php \| UA: M ... show more Automated threat detected by Budyn Honeypot Sinkhole. Attack type: WP Path Scanning (Recon). Malicious scanner triggered a security trap targeting emulated vulnerabilities. Evidence: HOST: vault.definitelynotahoneypot.xyz \| URI: /wp-login.php \| UA: Mozilla/5.0 \| BODY: [Empty / GET Request] show less	Bad Web Bot Web App Attack
🇨🇭 copestack	2026-09-27 01:30:10 UTC · (1 month ago)	Honeypot hit on ov-4e5936 (fail2ban jail: nginx-compat)	Web App Attack
🇩🇪 LRob	2026-09-27 01:11:34 UTC · (1 month ago)	This address requests our sites over plain http, is answered with a redirect to https, and never follows it — over and over. A browser follows redirects; a scanner enumerating hosts does not. It reads nothing it asks for and only loads the server; bl ... show more This address requests our sites over plain http, is answered with a redirect to https, and never follows it — over and over. A browser follows redirects; a scanner enumerating hosts does not. It reads nothing it asks for and only loads the server; blocked. Please check what runs on this address. \| method: GET \| path: / \| 2026-09-27 01:11 UTC show less	Bad Web Bot
🇺🇸 mnsf	2026-09-27 01:05:12 UTC · (1 month ago)	Request Overload (102)	Brute-Force Web App Attack

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown

Recently Reported IPs:

🇰🇷 14.55.148.34

🇨🇳 218.13.235.113

🇨🇴 181.62.56.67

🇺🇸 162.216.149.223

🇺🇸 143.198.232.158

🇹🇭 27.130.238.192

🇺🇸 216.25.90.84

🇻🇳 118.69.61.245

🇮🇩 103.151.223.159

🇺🇸 74.235.80.208

🇺🇸 216.218.206.117

🇰🇷 211.247.127.250

🇺🇸 208.59.151.208

🇨🇳 182.149.104.197

🇧🇩 103.124.110.86

🇮🇹 93.38.27.33

🇺🇸 66.132.186.236

🇺🇸 51.8.102.6

🇩🇪 31.40.195.110

🇺🇸 20.46.243.18