JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 161.97.105.197

161.97.105.197 was found in our database!

This IP was reported 49 times. Confidence of Abuse is 100%: ?

100%

ISP	Contabo GmbH
Usage Type	Data Center/Web Hosting/Transit
ASN	AS51167
Hostname(s)	vmd198298.contaboserver.net
Domain Name	contabo.com
Country	🇫🇷 France
City	Lauterbourg, Grand Est

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 161.97.105.197

Whois 161.97.105.197

IP Abuse Reports for 161.97.105.197:

This IP address has been reported a total of 49 times from 38 distinct sources. 161.97.105.197 was first reported on July 28th 2026, and the most recent report was 36 minutes ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇩🇪 FeG Deutschland	2026-07-29 18:57:19 (36 minutes ago)	Looking for CMS/PHP/SQL vulnerablilities/excessive crawling - 257	Exploited Host Web App Attack
🇩🇪 nyt	2026-07-29 18:42:09 (51 minutes ago)	Brute-Force, Web App Attack, 503 on login page	Brute-Force Web App Attack
Anonymous	2026-07-29 14:20:12 (5 hours ago)	IP banned by Fail2Ban in jail nginx-abusive-ips	Web App Attack Brute-Force Bad Web Bot
🇧🇪 cmbplf	2026-07-29 12:02:35 (7 hours ago)	2.267 requests from abuseipdb.com blacklisted IP (1mo1w4d)	Brute-Force Bad Web Bot
🇩🇪 Ba-Yu	2026-07-29 11:19:43 (8 hours ago)	WordPress bruteforce	Web Spam Hacking Brute-Force Exploited Host Web App Attack
🇩🇪 maxpower	2026-07-29 10:03:12 (9 hours ago)	(PERMBLOCK) 161.97.105.197 (FR/France/vmd198298.contaboserver.net) has had more than 4 temp blocks i ... show more (PERMBLOCK) 161.97.105.197 (FR/France/vmd198298.contaboserver.net) has had more than 4 temp blocks in the last 86400 secs; Ports: *; Direction: inout; Trigger: LF_PERMBLOCK_COUNT; Logs: show less	Port Scan
🇨🇦 KIsmay	2026-07-29 09:06:32 (10 hours ago)	Jul 29 00:25:40 www4 WPAudit[2224278]: 161.97.105.197 katharinedickerson.com "Mozilla/5.0 (Windows N ... show more Jul 29 00:25:40 www4 WPAudit[2224278]: 161.97.105.197 katharinedickerson.com "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36" katharinedickerson:katharinedickerson12 FAIL Jul 29 02:35:29 www4 WPAudit[2219265]: 161.97.105.197 siscobc.com "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36" sisco:Sisco@2024 FAIL Jul 29 02:44:03 www4 WPAudit[2233835]: 161.97.105.197 www.vhsport.ca "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36" sbd-admin:sbd-admin01 FAIL Jul 29 04:45:45 www4 WPAudit[2242490]: 161.97.105.197 dev.siscobc.com "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36" sbd-admin:user FAIL Jul 29 05:06:32 www4 WPAudit[2240703]: 161.97.105.197 www.servicesfyi.ca "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like ... show less	Brute-Force Web App Attack
🇦🇺 AWW-Admin	2026-07-29 08:16:17 (11 hours ago)	(wordpress) Failed wordpress login from 161.97.105.197 (FR/France/vmd198298.contaboserver.net)	Brute-Force
Anonymous	2026-07-29 07:00:00 (12 hours ago)	Automated Apache web application probing in selected 24h window; attempts=190, unique_paths=3, error ... show more Automated Apache web application probing in selected 24h window; attempts=190, unique_paths=3, error_responses=23; targets include WordPress, .env/.git, phpMyAdmin, autodiscover, wpad.dat and related probe paths. show less	Web App Attack
Anonymous	2026-07-29 06:45:56 (12 hours ago)	Web attack blocked by Wordfence on mergel.nu (1 hit). Reported by CRMON.	Web App Attack
🇪🇸 masterguru	2026-07-29 06:42:02 (12 hours ago)	(PERMBLOCK) 161.97.105.197 (IN/India/vmd198298.contaboserver.net) has had more than 4 temp blocks in ... show more (PERMBLOCK) 161.97.105.197 (IN/India/vmd198298.contaboserver.net) has had more than 4 temp blocks in the last 86400 secs (0-122) show less	Hacking
🇩🇪 4server	2026-07-29 06:32:13 (13 hours ago)	[WedJul2908:32:11.3861232026][security2:error][pid1187104:tid1187153][client161.97.105.197:0]ModSecu ... show more [WedJul2908:32:11.3861232026][security2:error][pid1187104:tid1187153][client161.97.105.197:0]ModSecurity:Accessdeniedwithcode403\(phase1\).Stringmatch\"/xmlrpc.php\"atREQUEST_URI.[file\"/etc/apache2/conf.d/modsec_custom_rules.conf\"][line\"170\"][id\"960024\"][msg\"XML-RPCdisabled\"][hostname\"gmint.ch\"][uri\"/xmlrpc.php\"][unique_id\"ammea8AfOjH_y5P08WFB_QAAAEE\"] show less	Port Scan Brute-Force Web App Attack
🇩🇪 london2038.com	2026-07-29 06:21:29 (13 hours ago)	Attacking WordPress 161.97.105.197 - - [29/Jul/2026:08:21:26 +0200] "POST /wp-login.php HTTP/2.0" 50 ... show more Attacking WordPress 161.97.105.197 - - [29/Jul/2026:08:21:26 +0200] "POST /wp-login.php HTTP/2.0" 503 19289 "https://<REDACTED>/wp-login.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36" show less	Brute-Force Web App Attack
🇩🇪 Marc	2026-07-29 06:18:13 (13 hours ago)	161.97.105.197 - - [29/Jul/2026:06:59:21 +0200] "GET /wp-login.php HTTP/2.0" 200 3974 "-" "Mozilla/5 ... show more 161.97.105.197 - - [29/Jul/2026:06:59:21 +0200] "GET /wp-login.php HTTP/2.0" 200 3974 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36" 161.97.105.197 - - [29/Jul/2026:06:59:21 +0200] "POST /wp-login.php HTTP/2.0" 200 4623 "https://www.bente-personaldienstleistung.de/wp-login.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36" 161.97.105.197 - - [29/Jul/2026:07:42:17 +0200] "GET /wp-login.php HTTP/2.0" 200 3457 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36" 161.97.105.197 - - [29/Jul/2026:07:42:17 +0200] "POST /wp-login.php HTTP/2.0" 200 3271 "https://als-arnsberg.eu/wp-login.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36" 161.97.105.197 - - [29/Jul/2026:08:18:11 +0200] "GET /wp-login.php HTTP/2.0" 200 3905 "-" "Mozilla/5.0 (Windows NT 1 show less	Brute-Force Web App Attack
🇮🇳 evicky2002	2026-07-29 06:00:00 (13 hours ago)	Confirmed malicious by STILWaters CTI platform (score=100, sources=1)	Hacking Brute-Force SSH

Showing 1 to 15 of 49 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇧🇷 201.77.100.37

🇮🇹 172.253.12.214

🇨🇳 106.75.177.59

🇧🇬 79.124.40.106

🇺🇸 40.124.174.207

🇬🇧 193.176.29.24

🇫🇷 185.177.72.100

🇰🇷 106.246.89.70

🇧🇩 103.143.1.21

🇳🇱 64.89.162.15

🇺🇸 34.23.250.189

🇻🇳 27.72.102.65

🇷🇴 2.57.122.209

🇧🇷 205.210.31.130

🇹🇭 203.154.158.195

🇩🇿 154.255.64.215

🇩🇪 147.45.199.80

🇰🇷 112.161.26.125

🇿🇦 102.23.162.10

🇰🇿 82.200.240.33