JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 164.152.109.216

164.152.109.216 was found in our database!

This IP was reported 23 times. Confidence of Abuse is 100%: ?

100%

ISP	Oracle Corporation
Usage Type	Data Center/Web Hosting/Transit
ASN	AS31898
Domain Name	oracle.com
Country	🇺🇸 United States of America
City	Chicago, Illinois

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 164.152.109.216

Whois 164.152.109.216

IP Abuse Reports for 164.152.109.216:

This IP address has been reported a total of 23 times from 23 distinct sources. 164.152.109.216 was first reported on October 19th 2026, and the most recent report was 9 hours ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇫🇷 SpaceHost-Server	2026-10-22 22:17:32 (9 hours ago)		Brute-Force Web App Attack
🇮🇱 spd.co.il	2026-10-22 22:02:50 (9 hours ago)	Web application attack detected	Hacking Web App Attack
🇮🇹 ciccio diddo	2026-10-21 18:11:01 (1 day ago)	High Burst multiple 40X port:Tcp/80,443	Brute-Force Web App Attack
🇷🇸 pexodelic	2026-10-21 18:05:01 (1 day ago)	Automated report from web, SSH and FTP server logs: 99 requests probing for exposed secrets (.env, . ... show more Automated report from web, SSH and FTP server logs: 99 requests probing for exposed secrets (.env, .git, config files). First reported 2026-10-21 16:05 UTC, last reported 2026-10-21 20:05 UTC; counts cover the current log rotation window. show less	Hacking Web App Attack
Anonymous	2026-10-21 17:10:00 (1 day ago)	[Wed Oct 21 17:09:59.314623 2026] [security2:error] [pid 4088651:tid 4088651] [client 164.152.109.21 ... show more [Wed Oct 21 17:09:59.314623 2026] [security2:error] [pid 4088651:tid 4088651] [client 164.152.109.216:57580] [client 164.152.109.216] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 8)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.5"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "95.211.63.1"] [uri "/.git/config"] [unique_id "atjx58pG9ZV7jXNwHjezpQAAABI"] [Wed Oct 21 17:09:59.314919 2026] [security2:error] [pid 4088750:tid 4088750] [client 164.152.109.216:57770] [client 164.152.109.216] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Sco ... show less	Web App Attack
🇮🇹 Inartis	2026-10-21 16:53:51 (1 day ago)	164.152.109.216 - - [21/Oct/2026:18:53:50 +0200] "GET /.git/config HTTP/1.1" 302 403 "-" "WebSiphon/ ... show more 164.152.109.216 - - [21/Oct/2026:18:53:50 +0200] "GET /.git/config HTTP/1.1" 302 403 "-" "WebSiphon/next-0.1" ... show less	Brute-Force Bad Web Bot Web App Attack
🇨🇦 alexbfr	2026-10-21 15:35:52 (1 day ago)	Fail2Ban report from nginx-bot-trap; service=HTTP; application_protocol=HTTP; observed_at=2026-10-21 ... show more Fail2Ban report from nginx-bot-trap; service=HTTP; application_protocol=HTTP; observed_at=2026-10-21T15:35:52Z; reported_at=2026-10-21T15:35:54Z 2026-10-21T15:35:52Z activity=bot-trap request method=GET nginx_status=444 probe_target=/.env 2026-10-21T15:35:52Z activity=bot-trap request method=GET nginx_status=444 probe_target=/.env 2026-10-21T15:35:52Z activity=bot-trap request method=GET nginx_status=444 probe_target=/.env 2026-10-21T15:35:52Z activity=bot-trap request method=GET nginx_status=444 probe_target=/.env 2026-10-21T15:35:52Z activity=bot-trap request method=GET nginx_status=444 probe_target=/.env show less	Web App Attack
🇧🇷 ICS Labs	2026-10-21 14:40:41 (1 day ago)	ICS Labs threat intelligence (ICS Feeds): Brute-Force. Last observed 2026-10-21 UTC.	Brute-Force
🇫🇷 Kejult	2026-10-21 10:33:37 (1 day ago)	Honeypot Finding: active TCP application payload captured by Honeytrap; 587 payload-bearing connecti ... show more Honeypot Finding: active TCP application payload captured by Honeytrap; 587 payload-bearing connection/event(s), 83706 payload byte(s) total, maximum payload 166 byte(s). Target port(s): 10000. show less	Port Scan Hacking
Anonymous	2026-10-21 09:50:04 (1 day ago)	8443/tcp (1 or more attempts)	Port Scan
🇷🇴 gtheo99	2026-10-20 21:26:44 (2 days ago)	(CT) IP 164.152.109.216 (US/United States/-) found to have 122 connections	Port Scan
🇸🇪 1337v411	2026-10-20 21:05:36 (2 days ago)	[2026-10-20T21:05:35+00:00] uri="/.env.secrets" ua="WebSiphon/next-0.1"	Bad Web Bot Web App Attack
Anonymous	2026-10-20 20:55:57 (2 days ago)	164.152.109.216 - - [20/Oct/2026:22:55:56 +0200] "GET /.env.local HTTP/1.1" 200 3264 "-" "WebSiphon/ ... show more 164.152.109.216 - - [20/Oct/2026:22:55:56 +0200] "GET /.env.local HTTP/1.1" 200 3264 "-" "WebSiphon/next-0.1" ... show less	Port Scan Hacking Brute-Force Bad Web Bot Web App Attack SSH
🇺🇸 wteiken	2026-10-20 20:48:27 (2 days ago)	2026-10-20T16:48:25.504023-04:00 nostromo.teiken.net kernel: [448598.476086] syn_limit:IN=en-wan OUT ... show more 2026-10-20T16:48:25.504023-04:00 nostromo.teiken.net kernel: [448598.476086] syn_limit:IN=en-wan OUT= MAC=00:50:43:37:c2:00:88:a2:5e:1c:98:0c:08:00 SRC=164.152.109.216 DST=173.52.106.128 LEN=60 TOS=0x00 PREC=0x00 TTL=58 ID=53812 DF PROTO=TCP SPT=36560 DPT=443 WINDOW=62720 RES=0x00 SYN URGP=0 2026-10-20T16:48:25.504354-04:00 nostromo.teiken.net kernel: [448598.476181] syn_limit:IN=en-wan OUT= MAC=00:50:43:37:c2:00:88:a2:5e:1c:98:0c:08:00 SRC=164.152.109.216 DST=173.52.106.128 LEN=60 TOS=0x00 PREC=0x00 TTL=58 ID=51961 DF PROTO=TCP SPT=36478 DPT=443 WINDOW=62720 RES=0x00 SYN URGP=0 2026-10-20T16:48:25.504440-04:00 nostromo.teiken.net kernel: [448598.476209] syn_limit:IN=en-wan OUT= MAC=00:50:43:37:c2:00:88:a2:5e:1c:98:0c:08:00 SRC=164.152.109.216 DST=173.52.106.128 LEN=60 TOS=0x00 PREC=0x00 TTL=58 ID=28532 DF PROTO=TCP SPT=36508 DPT=443 WINDOW=62720 RES=0x00 SYN URGP=0 2026-10-20T16:48:25.504542-04:00 nostromo.teiken.net kernel: [448598.476234] syn_limit:IN=en-wan OUT= MAC=00:50:43:37: ... show less	Port Scan
Anonymous	2026-10-20 20:35:21 (2 days ago)	164.152.109.216 - - [20/Oct/2026:15:32:53 -0500] "GET /.env.stage HTTP/1.1" 403 199 "-" "WebSiphon/n ... show more 164.152.109.216 - - [20/Oct/2026:15:32:53 -0500] "GET /.env.stage HTTP/1.1" 403 199 "-" "WebSiphon/next-0.1" 164.152.109.216 164.152.109.216 - - [20/Oct/2026:15:32:53 -0500] "GET /.env.server HTTP/1.1" 403 199 "-" "WebSiphon/next-0.1" 164.152.109.216 164.152.109.216 - - [20/Oct/2026:15:32:53 -0500] "GET /.env.development HTTP/1.1" 403 199 "-" "WebSiphon/next-0.1" 164.152.109.216 164.152.109.216 - - [20/Oct/2026:15:32:53 -0500] "GET /.env.gpu HTTP/1.1" 403 199 "-" "WebSiphon/next-0.1" 164.152.109.216 164.152.109.216 - - [20/Oct/2026:15:32:53 -0500] "GET /.env.production.local HTTP/1.1" 403 199 "-" "WebSiphon/next-0.1" 164.152.109.216 164.152.109.216 - - [20/Oct/2026:15:32:53 -0500] "GET /.env.production HTTP/1.1" 403 199 "-" "WebSiphon/next-0.1" 164.152.109.216 164.152.109.216 - - [20/Oct/2026:15:32:53 -0500] "GET /.env.staging HTTP/1.1" 403 199 "-" "WebSiphon/next-0.1" 164.152.109.216 164.152.109.216 - - [20/Oct/2026:15:32:53 -0500] "GET /.env.prod HTTP/1.1" 403 199 "-" "WebSiphon/next ... show less	Brute-Force Bad Web Bot Web App Attack

Showing 1 to 15 of 23 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇬🇧 5.226.140.124

🇭🇰 218.255.103.194

🇮🇳 203.192.232.180

🇧🇷 201.71.222.145

🇮🇩 182.7.82.65

🇵🇸 178.130.165.229

🇯🇵 172.70.223.202

🇺🇿 82.215.99.233

🇧🇬 79.124.49.14

🇺🇸 73.149.235.20

🇺🇸 71.6.134.228

🇺🇸 47.89.193.150

🇺🇸 192.241.130.234

🇨🇴 191.92.190.232

🇨🇴 185.244.235.133

🇷🇺 176.118.244.99

🇻🇳 157.10.186.28

🇮🇩 140.213.4.14

🇸🇬 103.187.146.196

🇮🇳 103.30.65.122