JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

158.173.46.138

Recent Activity

Abuse Confidence Score

14% Caution

11 reports

9 reporters · latest 6 days ago

ISP: Mullvad VPN AB
Usage Type: Data Center/Web Hosting/Transit
ASN: AS212238
Domain Name: mullvad.net
Country: 🇩🇰 Denmark
City: Copenhagen, Capital Region

ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report Whois

Example preview

Account required for the enhanced features Log in Sign up

Abuse Reports

Export reports CSV

Total reports

11 from 9 distinct reporters

First reported

February 22nd 2026

Most recent report

6 days ago

Last 60 days

Top reporter locations 🇩🇪 Germany 4

Most common categories Brute-Force 3 Port Scan 1

Recent reports We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇩🇪 initsol	2026-11-04 17:13:37 UTC · (6 days ago)	[Wed Nov 04 18:13:28.061350 2026] [authz_core:error] [pid 1571827:tid 1571827] [client 158.173.46.138:11604] AH01630: client denied by server configuration: /var/www/ [Wed Nov 04 18:13:30.648274 2026] [authz_core:error] [pid 1545646:tid 1545646] [cli ... show more [Wed Nov 04 18:13:28.061350 2026] [authz_core:error] [pid 1571827:tid 1571827] [client 158.173.46.138:11604] AH01630: client denied by server configuration: /var/www/ [Wed Nov 04 18:13:30.648274 2026] [authz_core:error] [pid 1545646:tid 1545646] [client 158.173.46.138:11620] AH01630: client denied by server configuration: /var/www/ [Wed Nov 04 18:13:37.330410 2026] [authz_core:error] [pid 1589648:tid 1589648] [client 158.173.46.138:59910] AH01630: client denied by server configuration: /var/www/ ... show less	Brute-Force
🇩🇪 initsol	2026-11-04 12:36:27 UTC · (6 days ago)	[Wed Nov 04 13:36:26.243880 2026] [authz_core:error] [pid 1540574:tid 1540574] [client 158.173.46.138:20322] AH01630: client denied by server configuration: /var/www/ [Wed Nov 04 13:36:26.659179 2026] [authz_core:error] [pid 1529311:tid 1529311] [cli ... show more [Wed Nov 04 13:36:26.243880 2026] [authz_core:error] [pid 1540574:tid 1540574] [client 158.173.46.138:20322] AH01630: client denied by server configuration: /var/www/ [Wed Nov 04 13:36:26.659179 2026] [authz_core:error] [pid 1529311:tid 1529311] [client 158.173.46.138:20330] AH01630: client denied by server configuration: /var/www/ [Wed Nov 04 13:36:27.487412 2026] [authz_core:error] [pid 1529317:tid 1529317] [client 158.173.46.138:20356] AH01630: client denied by server configuration: /var/www/ ... show less	Brute-Force
🇩🇪 _ArminS_	2026-11-04 12:24:34 UTC · (6 days ago)	WEB-Scan 43312:80 detected 2026.11.04 13:24:34 blocked until 2026.12.24 06:27:21	Port Scan
🇩🇪 initsol	2026-10-30 08:13:08 UTC · (1 week ago)	[Fri Oct 30 09:13:05.568035 2026] [authz_core:error] [pid 668048:tid 668048] [client 158.173.46.138:13422] AH01630: client denied by server configuration: /var/www/ [Fri Oct 30 09:13:06.068478 2026] [authz_core:error] [pid 712425:tid 712425] [client ... show more [Fri Oct 30 09:13:05.568035 2026] [authz_core:error] [pid 668048:tid 668048] [client 158.173.46.138:13422] AH01630: client denied by server configuration: /var/www/ [Fri Oct 30 09:13:06.068478 2026] [authz_core:error] [pid 712425:tid 712425] [client 158.173.46.138:13442] AH01630: client denied by server configuration: /var/www/ [Fri Oct 30 09:13:07.616856 2026] [authz_core:error] [pid 722468:tid 722468] [client 158.173.46.138:13458] AH01630: client denied by server configuration: /var/www/ ... show less	Brute-Force
🇺🇸 George0phile	2026-07-13 00:00:43 UTC · (3 months ago)	SSH brute force on port 22 -- 4 attempts, 3 successful. Credentials: root:root. Active: 2026-07-12T17:36 to 2026-07-12T20:49. Post-login: /usr/bin/lukhfnzmfr [mm_percpu_wq] 3069724; /usr/bin/lukhfnzmfr hald-runner 3069724; /usr/bin/lukhfnzmfr pcscd 3 ... show more SSH brute force on port 22 -- 4 attempts, 3 successful. Credentials: root:root. Active: 2026-07-12T17:36 to 2026-07-12T20:49. Post-login: /usr/bin/lukhfnzmfr [mm_percpu_wq] 3069724; /usr/bin/lukhfnzmfr hald-runner 3069724; /usr/bin/lukhfnzmfr pcscd 3069724. Malware: trojan (high); trojan (critical); botnet (high). Source: AS212238 Datacamp Limited (Copenhagen, DK). Data from SSH honeypot — not a production system. show less	Brute-Force SSH IoT Targeted
🇩🇪 4server	2026-05-19 19:00:38 UTC · (5 months ago)	[TueMay1921:00:36.4630582026][security2:error][pid3317236:tid3317287][client158.173.46.138:0]ModSecurity:Accessdeniedwithcode403\(phase2\).Matchof\"beginsWith%{request_headers.host}\"against\"TX:1\"required.[file\"/etc/apache2/conf.d/modsec_rules/10_ ... show more [TueMay1921:00:36.4630582026][security2:error][pid3317236:tid3317287][client158.173.46.138:0]ModSecurity:Accessdeniedwithcode403\(phase2\).Matchof\"beginsWith%{request_headers.host}\"against\"TX:1\"required.[file\"/etc/apache2/conf.d/modsec_rules/10_asl_rules.conf\"][line\"510\"][id\"340162\"][rev\"309\"][msg\"Atomicorp.comWAFRules:RemoteFileInjectionAttackdetected\(UnauthorizedURLdetectedasargument\)\"][data\"\,TX:1\"][severity\"CRITICAL\"][hostname\"www.orabonastudio.it\"][uri\"/wp-content/plugins/appointment-calendar/calendar/calendar_form.php\"][unique_id\"agyzVG5TIOe1d3vgo9FE9wAAAEw\"]\,referer:http://orabonastudio.it/wp-content/plugins/appointment-calendar/calendar/calendar_form.php\?objname=date1\ show less	Port Scan Brute-Force Web App Attack
🇩🇪 filstal.org	2026-05-18 12:19:16 UTC · (5 months ago)	Automated bot: spoofed/impossible user-agent, web scraping or automated request patterns detected. UA: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET CLR 3.0.4506.2 ... show more Automated bot: spoofed/impossible user-agent, web scraping or automated request patterns detected. UA: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729) show less	Bad Web Bot Web App Attack
🇺🇸 xmission.com	2026-04-09 10:00:28 UTC · (7 months ago)	Blocked by UFW (TCP on 55756) Source port: 65433 TTL: 109 Packet length: 52 TOS: 0x08 This report (for 158.173.46.138) was generated by: https://github.com/sefinek/UFW-AbuseIPDB-Reporter	Port Scan
Anonymous	2026-03-17 22:30:03 UTC · (7 months ago)	\| Multiple SQL injection attempts from same source ip.(multiple servers)	Web App Attack Hacking SQL Injection
🇺🇸 fortypoundhead	2026-03-12 03:01:11 UTC · (7 months ago)	SQL Injection Attempt	SQL Injection Web App Attack
Anonymous	2026-02-22 20:45:58 UTC · (8 months ago)	Unauthorized connection attempt	Port Scan Hacking Exploited Host

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown

Recently Reported IPs:

🇺🇸 189.104.62.3

🇺🇸 172.171.244.149

🇺🇸 147.185.132.113

🇸🇬 138.199.60.19

🇬🇧 92.43.87.33

🇩🇪 69.5.169.180

🇺🇸 54.167.103.79

🇧🇪 35.210.58.143

🇧🇩 27.147.202.237

🇬🇧 216.226.76.30

🇹🇼 198.235.24.6

🇬🇧 192.248.150.180

🇺🇸 162.216.150.138

🇰🇷 112.185.221.153

🇺🇸 100.51.6.16

🇳🇱 86.38.187.43

🇺🇸 73.227.15.40

🇭🇰 64.144.226.231

🇺🇸 34.139.157.174

🇺🇸 23.234.78.252