JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 164.92.157.131

164.92.157.131 was found in our database!

This IP was reported 20 times. Confidence of Abuse is 37%: ?

37%

ISP	DigitalOcean, LLC
Usage Type	Data Center/Web Hosting/Transit
ASN	AS14061
Domain Name	digitalocean.com
Country	🇳🇱 Netherlands
City	Amsterdam, North Holland

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 164.92.157.131

Whois 164.92.157.131

IP Abuse Reports for 164.92.157.131:

This IP address has been reported a total of 20 times from 15 distinct sources. 164.92.157.131 was first reported on February 9th 2024, and the most recent report was 2 weeks ago.

Old Reports: The most recent abuse report for this IP address is from 2 weeks ago . It is possible that this IP is no longer involved in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇩🇪 ghostwarriors	2026-07-06 08:51:36 (2 weeks ago)	Webpage scraping	Brute-Force Bad Web Bot Web App Attack
🇩🇪 ghostwarriors	2026-07-03 00:20:57 (3 weeks ago)	Webpage scraping	Brute-Force Bad Web Bot Web App Attack
🇧🇷 opastorello	2026-06-17 15:47:10 (1 month ago)	T-Pot honeypot: 42 hits in 15min on port(s) 2083,2087,2077,2078,2082 (P0f/Suricata). Port scan / uns ... show more T-Pot honeypot: 42 hits in 15min on port(s) 2083,2087,2077,2078,2082 (P0f/Suricata). Port scan / unsolicited connection. Automated report. show less	Port Scan
🇳🇱 BIV	2026-06-17 15:04:56 (1 month ago)	Honeypot multi-source hit. Sources: tpot:Honeytrap,tpot:P0f,tpot:Suricata. Ports: 443,80. Automated ... show more Honeypot multi-source hit. Sources: tpot:Honeytrap,tpot:P0f,tpot:Suricata. Ports: 443,80. Automated tiered (T-Pot+DShield). show less	Port Scan Hacking Bad Web Bot
🇺🇸 markawes	2026-06-17 14:21:59 (1 month ago)	[markis] Auto banned by Fail2Ban. Reason: Malicious web scan / attempted access to sensitive paths. ... show more [markis] Auto banned by Fail2Ban. Reason: Malicious web scan / attempted access to sensitive paths. Evidence: 164.92.157.131 - - [17/Jun/2026:15:21:38 +0100] "GET /.env.production HTTP/1.1" 404 455 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)" 164.92.157.131 - - [17/Jun/2026:15:21:49 +0100] "GET /.env_production HTTP/1.1" 404 455 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14.4; rv:125.0) Gecko/20100101 Firefox/125.0" 164.92.157.131 - - [17/Jun/2026:15:21:58 +0100] "GET /.git-credentials HTTP/1.1" 404 455 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36" show less	Port Scan Hacking Web App Attack
🇺🇸 ISPLtd	2026-06-17 12:43:34 (1 month ago)	Jun 17 06:43:33 164.92.157.131 TCP SPT=51406 DPT=2087 SYN Jun 17 06:43:33 164.92.157.131 TCP SPT=604 ... show more Jun 17 06:43:33 164.92.157.131 TCP SPT=51406 DPT=2087 SYN Jun 17 06:43:33 164.92.157.131 TCP SPT=60444 DPT=2082 SYN Jun 17 06:43:33 164.92.157.131 TCP SPT=34550 DPT=2083 WIND ... show less	Port Scan
🇹🇼 kk_it_man	2026-06-17 12:00:14 (1 month ago)		Port Scan
Anonymous	2026-06-17 04:46:35 (1 month ago)	SIEM ALERT AUTO REPORT	Email Spam
🇺🇸 TPI-Abuse	2026-06-17 03:59:56 (1 month ago)	(mod_security) mod_security (id:210492) triggered by 164.92.157.131 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210492) triggered by 164.92.157.131 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jun 16 23:59:52.336687 2026] [security2:error] [pid 29965:tid 29965] [client 164.92.157.131:50532] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "192.64.150.65"] [uri "/.git/config"] [unique_id "ajIbuHiB60KNm2GdP4BBZwAAADY"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-06-17 03:30:27 (1 month ago)	(mod_security) mod_security (id:210492) triggered by 164.92.157.131 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210492) triggered by 164.92.157.131 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jun 16 23:30:22.000840 2026] [security2:error] [pid 1757:tid 1757] [client 164.92.157.131:60374] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "192.64.150.96"] [uri "/.git/HEAD"] [unique_id "ajIUznjOcMEETfYdPDl1iwAAAAk"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 donarev419	2026-06-17 02:31:42 (1 month ago)	Port scan detected on port 443 (connection without data transfer)	Port Scan
🇺🇸 MPL	2026-06-17 02:23:59 (1 month ago)	tcp port scan (10 or more attempts)	Port Scan
🇩🇪 ghostwarriors	2026-06-17 02:20:11 (1 month ago)	Webpage scraping	Brute-Force Bad Web Bot Web App Attack
🇺🇸 knock	2026-06-17 01:02:37 (1 month ago)	Knock-Knock honeypot brute-force: proto8 (49 total hits)	Brute-Force
🇷🇸 Scan	2026-06-17 01:02:09 (1 month ago)	MultiHost/MultiPort Probe, Scan, Hack -	Port Scan Hacking

Showing 1 to 15 of 20 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇨🇭 209.99.184.143

🇲🇽 201.138.210.27

🇧🇪 198.235.24.249

🇺🇦 178.212.96.28

🇬🇧 163.5.94.58

🇺🇸 91.230.168.251

🇺🇸 66.116.237.163

🇮🇪 52.169.186.136

🇺🇦 217.196.163.239

🇺🇸 216.180.246.192

🇧🇷 200.158.42.37

🇭🇰 199.45.154.155

🇧🇪 198.235.24.248

🇧🇪 198.235.24.247

🇧🇪 198.235.24.243

🇹🇼 198.235.24.67

🇺🇸 172.191.239.155

🇺🇸 130.131.220.95

🇮🇩 103.139.10.97

🇹🇷 94.154.43.184