JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 164.152.30.189

164.152.30.189 was found in our database!

This IP was reported 37 times. Confidence of Abuse is 100%: ?

100%

ISP	Oracle Corporation
Usage Type	Data Center/Web Hosting/Transit
ASN	AS31898
Domain Name	oracle.com
Country	🇺🇸 United States of America
City	Chicago, Illinois

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 164.152.30.189

Whois 164.152.30.189

IP Abuse Reports for 164.152.30.189:

This IP address has been reported a total of 37 times from 24 distinct sources. 164.152.30.189 was first reported on October 13th 2026, and the most recent report was 1 hour ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇫🇷 xascorro	2026-10-17 20:22:49 (1 hour ago)	Homeland Labs Threat Radar: Unauthorized SSH brute-force attack detected across cluster.	Brute-Force SSH
🇩🇪 hchristo	2026-10-17 18:20:42 (3 hours ago)	[Sat Oct 17 20:20:39.967772 2026] [authz_core:error] [pid 43701:tid 44133] [client 164.152.30.189:51 ... show more [Sat Oct 17 20:20:39.967772 2026] [authz_core:error] [pid 43701:tid 44133] [client 164.152.30.189:51340] AH01630: client denied by server configuration: /usr/share/liveconfig/html/.env.bak [Sat Oct 17 20:20:40.117132 2026] [authz_core:error] [pid 43701:tid 44031] [client 164.152.30.189:53112] AH01630: client denied by server configuration: /usr/share/liveconfig/html/.env.old [Sat Oct 17 20:20:40.119539 2026] [authz_core:error] [pid 43701:tid 44039] [client 164.152.30.189:51340] AH01630: client denied by server configuration: /usr/share/liveconfig/html/.env.save [Sat Oct 17 20:20:40.148180 2026] [authz_core:error] [pid 43701:tid 44135] [client 164.152.30.189:50956] AH01630: client denied by server configuration: /usr/share/liveconfig/html/.env.orig [Sat Oct 17 20:20:41.567375 2026] [authz_core:error] [pid 43701:tid 44106] [client 164.152.30.189:50956] AH01630: client denied by server configuration: /usr/share/liveconfig/html/appsettings.Production.json.bak ... show less	Brute-Force
Anonymous	2026-10-17 17:12:36 (4 hours ago)	Probing for exposed sensitive files.	Hacking
🇳🇱 tpjg	2026-10-17 14:18:52 (7 hours ago)	Automated: 15 requests with error status in 120s window from 164.152.30.189. Evidence: /oci_config:3 ... show more Automated: 15 requests with error status in 120s window from 164.152.30.189. Evidence: /oci_config:301,/oci/oci_api_key.pem:301,/oci/config:301,/.oci/api_key.pem:301,/.oci/private_key.pem:301,/.oci/oci_api_key.pem.bak:301,/.oci/config.old:301,/.oci/config.bak:301,/.cursor/mcp.json:301,/.mcp.json:301,/anythingllm/.env:301,/flowise/.env:301,/oke/kubeconfig:301,/azure-auth.json:301,/.serverless/serverless-state.json:301 show less	Web App Attack
🇳🇱 Alt255	2026-10-17 13:10:41 (8 hours ago)	[ti-30al] Web exploit scanning: 36 suspicious requests detected by fail2ban jail apache-scanner. Exa ... show more [ti-30al] Web exploit scanning: 36 suspicious requests detected by fail2ban jail apache-scanner. Example: 164.152.30.189 - - [17/Oct/2026:15:10:32 +0200] "GET /.env.development HTTP/1.1" 404 7853 "-" "WebSiphon/next-0.1" 164.152.30.189 - - [17/Oct/2026:15:10:32 +0200] "GET /backend/.env HTTP/1.1" 404 7853 "-" "WebSiphon/next-0.1" 164.152.30.189 - - [17/Oct/2026:15:10:32 +0200] "GET /.env.old HTTP/1.1" 404 7853 "-" "WebSiphon/next-0.1" 164.152.30.189 - - [17/Oct/2026:15:10:32 +0200] "GET /.env.development.local HTTP/1.1" 404 7853 "-" "WebSiphon/next-0.1" 164.152.30.189 - - [17/Oct/2026:15:10:32 +0200] "GET /.aws/credentials HTTP/1.1" 404 7853 "-" "WebSiphon/next-0.1" 164.152.30.189 - - [17/Oct/2026:15:10:32 +0200] "GET /.env.save HTTP/1.1" 404 7853 "-" "WebSiphon/next-0.1" 164.152.30. ... show less	Bad Web Bot Web App Attack
Anonymous	2026-10-17 13:05:07 (8 hours ago)	[Sat Oct 17 15:05:06.001857 2026] [access_compat:error] [pid 1692256:tid 130589772453568] [client 16 ... show more [Sat Oct 17 15:05:06.001857 2026] [access_compat:error] [pid 1692256:tid 130589772453568] [client 164.152.30.189:39500] AH01797: client denied by server configuration: /var/www/html/.env [Sat Oct 17 15:05:06.002564 2026] [access_compat:error] [pid 1692257:tid 130589210437312] [client 164.152.30.189:39454] AH01797: client denied by server configuration: /var/www/html/sitemap_index.xml [Sat Oct 17 15:05:06.002578 2026] [access_compat:error] [pid 1692257:tid 130590107997888] [client 164.152.30.189:39494] AH01797: client denied by server configuration: /var/www/html/.well-known [Sat Oct 17 15:05:06.002872 2026] [access_compat:error] [pid 1692257:tid 130589210437312] [client 164.152.30.189:39480] AH01797: client denied by server configuration: /var/www/html/site.webmanifest [Sat Oct 17 15:05:06.003171 2026] [access_compat:error] [pid 1692257:tid 130590267393728] [client 164.152.30.189:39512] AH01797: client denied by server configuration: /var/www/html/.env.local [Sat Oct 17 15:05:06.003776 ... show less	Brute-Force Web App Attack
🇩🇪 ghostwarriors	2026-10-17 09:50:24 (11 hours ago)	Unauthorized connection attempt detected, SSH Brute-Force	Brute-Force Port Scan SSH
🇩🇪 Tsumugi Kotobuki	2026-10-17 09:36:49 (12 hours ago)	Port Scan on Honeypot \| Ports: 22/SSH \| Proto: TCP(1) \| Flags: all SYN \| TTL: 244 \| Len: 44B \| Win: ... show more Port Scan on Honeypot \| Ports: 22/SSH \| Proto: TCP(1) \| Flags: all SYN \| TTL: 244 \| Len: 44B \| Win: 65535(1) \| F2B/ufw-honeypot@2026-10-17T09:36:49Z show less	Port Scan Hacking
🇩🇪 Selckie	2026-10-17 09:28:51 (12 hours ago)	fail2ban: NGINX unusual impact	Web App Attack
🇩🇪 Ilop	2026-10-17 09:15:03 (12 hours ago)	[v7-22] Blocked by os-abuseipdb; 3 hits, proto=tcp, ports=22, src_ip=164.152.30.189	Port Scan Hacking
Anonymous	2026-10-17 06:04:29 (15 hours ago)	Aggressive web scan	Web App Attack
🇫🇷 xascorro	2026-10-16 20:17:01 (1 day ago)	Homeland Labs Threat Radar: Unauthorized SSH brute-force attack detected across cluster.	Brute-Force SSH
🇫🇷 Kejult	2026-10-16 20:08:29 (1 day ago)	Honeypot Finding: active TCP application payload captured by Honeytrap; 124 payload-bearing connecti ... show more Honeypot Finding: active TCP application payload captured by Honeytrap; 124 payload-bearing connection/event(s), 16974 payload byte(s) total, maximum payload 268 byte(s). Target port(s): 8332. show less	Port Scan Hacking
🇸🇬 drewf.ink	2026-10-16 04:17:24 (1 day ago)	[04:17] Attempted HTTP access to an exposed .env file (/.env.old)	Web App Attack
🇸🇬 drewf.ink	2026-10-16 04:17:22 (1 day ago)	[04:17] Attempted HTTP access to an exposed .env file	Web App Attack

Showing 1 to 15 of 37 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇨🇴 2800:484:820e:2a00:da9:3d38:118:fea

🇬🇧 64.205.72.138

🇺🇸 64.139.246.187

🇨🇳 47.93.192.43

🇧🇷 205.210.31.136

🇲🇽 189.223.6.184

🇩🇪 162.55.245.41

🇭🇰 152.32.254.89

🇨🇳 112.42.12.193

🇫🇷 85.217.140.13

🇺🇸 67.222.139.160

🇺🇸 47.148.243.209

🇳🇱 34.6.37.38

🇩🇪 213.209.159.238

🇨🇳 202.100.41.30

🇵🇰 110.38.240.65

🇺🇸 71.6.134.229

🇨🇳 58.220.39.200

🇮🇷 5.237.93.60

🇺🇸 216.219.89.86