JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 161.118.209.189

161.118.209.189 was found in our database!

This IP was reported 296 times. Confidence of Abuse is 100%: ?

100%

ISP	500 Oracle Parkway
Usage Type	Data Center/Web Hosting/Transit
ASN	AS31898
Domain Name	oracle.com
Country	🇸🇬 Singapore
City	Kampong Loyang

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 161.118.209.189

Whois 161.118.209.189

IP Abuse Reports for 161.118.209.189:

This IP address has been reported a total of 296 times from 171 distinct sources. 161.118.209.189 was first reported on December 31st 2025, and the most recent report was 1 day ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
Anonymous	2026-09-17 13:17:24 (1 day ago)	fail2ban jail apache-scanner: 161.118.209.189 - - [07/Sep/2026:02:25:23 -0700] "GET /sitemap.xml HTT ... show more fail2ban jail apache-scanner: 161.118.209.189 - - [07/Sep/2026:02:25:23 -0700] "GET /sitemap.xml HTTP/1.1" 403 441 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36" 161.118.209.189 - - [07/Sep/2026:02:25:24 -0700] "GET /wp-login.php HTTP/1.1" 403 441 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36" 161.118.209.189 - - [07/Sep/2026:02:25:24 -0700] "GET /config.php HTTP/1.1" 403 441 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36" 161.118.209.189 - - [07/Sep/2026:02:25:24 -0700] "GET /admin/ HTTP/1.1" 403 441 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36" 161.118.209.189 - - [07/Sep/2026:02:25:24 -0700] "GET /login HTTP/1.1" 403 441 "-" "Mozilla/5 show less	Web App Attack Port Scan
🇫🇷 SpaceHost-Server	2026-09-15 22:16:17 (2 days ago)		Brute-Force Web App Attack
🇫🇷 SpaceHost-Server	2026-09-14 22:15:41 (3 days ago)		Brute-Force Web App Attack
Anonymous	2026-09-14 15:52:08 (3 days ago)	Reported from Nginx log analysis 6. Log: 161.118.209.189 - - [14/Sep/2026:xx:xx:xx 0200] "GET / HTT ... show more Reported from Nginx log analysis 6. Log: 161.118.209.189 - - [14/Sep/2026:xx:xx:xx 0200] "GET / HTTP/1.1" xxx xxx "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36" "-" "SG Singapore Loyang" "AS31898" "Oracle Corporation" show less	Port Scan Brute-Force SSH
🇩🇪 Ilop	2026-09-14 11:30:04 (4 days ago)	[hp-100] 500 unsolicited packets to honeypot ports 8080 (OCI DShield sensor)	Port Scan
🇸🇪 sweplox.se	2026-09-14 11:04:14 (4 days ago)	Ip 161.118.209.189 performed 'crowdsecurity/http-sensitive-files' (5 events over 844.299736ms) at 20 ... show more Ip 161.118.209.189 performed 'crowdsecurity/http-sensitive-files' (5 events over 844.299736ms) at 2026-09-14 11:04:13.63826974 +0000 UTC show less	Hacking
🇩🇪 srtzero	2026-09-14 10:42:13 (4 days ago)	161.118.209.189 - - [14/Sep/2026:12:42:12 +0200] "GET /.env.bak HTTP/1.1" 404 1382 "-" "Mozilla/5.0 ... show more 161.118.209.189 - - [14/Sep/2026:12:42:12 +0200] "GET /.env.bak HTTP/1.1" 404 1382 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36" 161.118.209.189 - - [14/Sep/2026:12:42:12 +0200] "GET /.env.local HTTP/1.1" 404 1382 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36" 161.118.209.189 - - [14/Sep/2026:12:42:12 +0200] "GET /.env.production.local HTTP/1.1" 404 1382 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36" ... show less	Port Scan Bad Web Bot Web App Attack
🇩🇪 london2038.com	2026-09-14 08:48:01 (4 days ago)	Probing for exploits 161.118.209.189 - - [14/Sep/2026:10:47:57 +0200] "GET /.env.bak HTTP/1.1" 422 0 ... show more Probing for exploits 161.118.209.189 - - [14/Sep/2026:10:47:57 +0200] "GET /.env.bak HTTP/1.1" 422 0 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36" 161.118.209.189 - - [14/Sep/2026:10:47:57 +0200] "GET /.env.local HTTP/1.1" 422 0 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36" show less	Hacking Web App Attack
🇺🇸 dot.mg	2026-09-14 08:39:05 (4 days ago)	Bad behaviour	Web Spam
🇩🇪 raspi4	2026-09-14 08:36:15 (4 days ago)	Fail2Ban Ban Triggered	Brute-Force Web App Attack
Anonymous	2026-09-14 08:30:13 (4 days ago)	Fail2Ban triggered	Web App Attack
Anonymous	2026-09-10 14:00:09 (1 week ago)	fail2ban jail apache-scanner: 161.118.209.189 - - [07/Sep/2026:02:25:23 -0700] "GET /sitemap.xml HTT ... show more fail2ban jail apache-scanner: 161.118.209.189 - - [07/Sep/2026:02:25:23 -0700] "GET /sitemap.xml HTTP/1.1" 403 441 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36" 161.118.209.189 - - [07/Sep/2026:02:25:24 -0700] "GET /wp-login.php HTTP/1.1" 403 441 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36" 161.118.209.189 - - [07/Sep/2026:02:25:24 -0700] "GET /config.php HTTP/1.1" 403 441 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36" 161.118.209.189 - - [07/Sep/2026:02:25:24 -0700] "GET /admin/ HTTP/1.1" 403 441 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36" 161.118.209.189 - - [07/Sep/2026:02:25:24 -0700] "GET /login HTTP/1.1" 403 441 "-" "Mozilla/5 show less	Web App Attack Port Scan
🇪🇸 masterguru	2026-09-10 04:43:34 (1 week ago)	Host header is a numeric IP address. Pattern match "^ (920350-159)	Hacking Bad Web Bot
🇺🇸 natdem.org	2026-09-09 19:11:45 (1 week ago)	Web: .env file probe, Config file probe, Git repository probe	Web App Attack Hacking
🇺🇸 Gabriel Camargo	2026-09-09 08:43:00 (1 week ago)	161.118.209.189 - - [09/Sep/2026:03:42:59 -0500] "GET /.env.production HTTP/1.1" 404 197 "-" "Mozill ... show more 161.118.209.189 - - [09/Sep/2026:03:42:59 -0500] "GET /.env.production HTTP/1.1" 404 197 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36" 161.118.209.189 - - [09/Sep/2026:03:42:59 -0500] "GET /.env HTTP/1.1" 404 197 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36" 161.118.209.189 - - [09/Sep/2026:03:42:59 -0500] "GET /.env.bak HTTP/1.1" 404 197 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36" ... show less	Brute-Force SSH

Showing 1 to 15 of 296 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇩🇿 154.241.33.42

🇷🇸 82.25.247.118

🇷🇺 77.236.68.25

🇳🇱 45.148.10.141

🇨🇳 36.138.78.195

🇳🇱 195.178.110.30

🇨🇳 122.114.35.15

🇺🇸 64.62.197.239

🇿🇲 41.77.4.1

🇨🇳 14.103.118.153

🇧🇷 45.85.89.197

🇵🇰 39.56.66.72

🇺🇦 37.54.25.93

🇺🇸 35.222.189.4

🇮🇱 34.165.200.37

🇧🇪 34.62.250.141

🇺🇸 199.19.225.232

🇳🇱 185.242.226.102

🇯🇴 176.29.2.55

🇺🇸 146.88.241.40