JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

168.144.138.192

Recent Activity

Abuse Confidence Score

100% Critical

72 reports

62 reporters · latest 1 day ago

ISP: DigitalOcean, LLC
Usage Type: Data Center/Web Hosting/Transit
ASN: AS14061
Domain Name: digitalocean.com
Country: 🇸🇬 Singapore
City: Singapore

ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report Whois

Example preview

Account required for the enhanced features Log in Sign up

Abuse Reports

Export reports CSV

Total reports

72 from 62 distinct reporters

First reported

October 19th 2026

Most recent report

1 day ago

Last 60 days

Top reporter locations 🇩🇪 Germany 18 🇫🇷 France 7 🇵🇱 Poland 6

Most common categories Web App Attack 49 Bad Web Bot 23 Hacking 20 Brute-Force 10 Port Scan 5

Recent reports We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇲🇽 octageeks.com	2026-11-11 05:21:16 UTC · (1 day ago)	Wordpress malicious attack:[octascan]	Web App Attack
🇨🇭 copestack	2026-11-11 02:30:15 UTC · (1 day ago)	Honeypot hit on ov-4e5936 (fail2ban jail: nginx-compat)	Web App Attack
🇻🇮 Axel	2026-11-10 15:23:12 UTC · (1 day ago)	WAF/ModSecurity blocked 12 malicious request(s) (HTTP 403) from this IP. Activity: request_uri: Images folder - prevent PHP files from executing x7; Malware x3; request_uri: prevent PHP files from executing x1; request_uri: ModX - prevent PHP files f ... show more WAF/ModSecurity blocked 12 malicious request(s) (HTTP 403) from this IP. Activity: request_uri: Images folder - prevent PHP files from executing x7; Malware x3; request_uri: prevent PHP files from executing x1; request_uri: ModX - prevent PHP files from executing x1. Latest: 2026-11-10T15:23:12Z. show less	Hacking Web App Attack
🇺🇸 lavnet.net	2026-11-10 12:31:58 UTC · (1 day ago)	168.144.138.192 - - [10/Nov/2026:12:31:35 +0000] "GET //images/images/cache.php HTTP/1.1" 404 2110 "www.google.com" "Mozlila/5.0 (Linux; Android 7.0; SM-G892A Bulid/NRD90M; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/60.0.3112.107 M ... show more 168.144.138.192 - - [10/Nov/2026:12:31:35 +0000] "GET //images/images/cache.php HTTP/1.1" 404 2110 "www.google.com" "Mozlila/5.0 (Linux; Android 7.0; SM-G892A Bulid/NRD90M; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/60.0.3112.107 Moblie Safari/537.36" 168.144.138.192 - - [10/Nov/2026:12:31:38 +0000] "GET //cgi-bin/cgi-bin/cgi-bin/cgi-bin/cache.php HTTP/1.1" 404 2110 "www.google.com" "Mozlila/5.0 (Linux; Android 7.0; SM-G892A Bulid/NRD90M; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/60.0.3112.107 Moblie Safari/537.36" 168.144.138.192 - - [10/Nov/2026:12:31:42 +0000] "GET //images/images/images/images/images/images/images/images/cache.php HTTP/1.1" 404 2110 "www.google.com" "Mozlila/5.0 (Linux; Android 7.0; SM-G892A Bulid/NRD90M; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/60.0.3112.107 Moblie Safari/537.36" 168.144.138.192 - - [10/Nov/2026:12:31:48 +0000] "GET //images/images/images/images/images/images/images/cache.php HTTP/1.1" 40 ... show less	Brute-Force
🇮🇹 VHosting	2026-11-10 11:50:03 UTC · (1 day ago)	Detected WordPress attack from different servers	Brute-Force Web App Attack
🇩🇪 SCHAPPY	2026-11-10 10:02:35 UTC · (2 days ago)	Faked HTTP referer / referer spam detected.	Blog Spam Web App Attack
Anonymous	2026-11-10 08:31:26 UTC · (2 days ago)	Backdrop CMS module - malicious activity detected	Bad Web Bot Web App Attack
🇩🇪 todix	2026-11-10 08:22:22 UTC · (2 days ago)	"GET //images/images/cache.php HTTP/1.1" 301 5 "www.google.com" "Mozlila/5.0 (Linux; Android 7.0; SM-G892A Bulid/NRD90M; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/60.0.3112.107 Moblie Safari/537.36"	Bad Web Bot
🇫🇮 6kilowatti	2026-11-10 08:16:20 UTC · (2 days ago)	2026/11/10 10:16:14 [error] 794192#794192: 84150 FastCGI sent in stderr: "Primary script unknown" while reading response header from upstream, client: 168.144.138.192, server: oh6ah.fi, request: "GET //images/images/cache.php HTTP/1.1", upstream: "f ... show more 2026/11/10 10:16:14 [error] 794192#794192: 84150 FastCGI sent in stderr: "Primary script unknown" while reading response header from upstream, client: 168.144.138.192, server: oh6ah.fi, request: "GET //images/images/cache.php HTTP/1.1", upstream: "fastcgi://unix:/var/run/oh6ah.fi.sock:", host: "oh6ah.fi", referrer: "www.google.com" 2026/11/10 10:16:19 [error] 794192#794192: *84152 FastCGI sent in stderr: "Primary script unknown" while reading response header from upstream, client: 168.144.138.192, server: oh6ah.fi, request: "GET //cgi-bin/cgi-bin/cgi-bin/cgi-bin/cache.php HTTP/1.1", upstream: "fastcgi://unix:/var/run/oh6ah.fi.sock:", host: "oh6ah.fi", referrer: "www.google.com" ... show less	Web App Attack
🇵🇱 Budyn	2026-11-10 06:34:00 UTC · (2 days ago)	[Budyn Honeypot Sinkhole] \| Attack type: CRITICAL: ModSecurity WAF Exploit Block \| Summary: Request triggered an emulated security trap. \| Evidence: \| Host: astropot.online \| Path: //images/images/cache.php \| User-Agent: Mozlila/5.0 (Linux; Android 7 ... show more [Budyn Honeypot Sinkhole] \| Attack type: CRITICAL: ModSecurity WAF Exploit Block \| Summary: Request triggered an emulated security trap. \| Evidence: \| Host: astropot.online \| Path: //images/images/cache.php \| User-Agent: Mozlila/5.0 (Linux; Android 7.0; SM-G892A Bulid/NRD90M; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/60.0.3112.107 Moblie Safari/537.36 \| Request: [Empty / GET Request] show less	Hacking Web App Attack
🇩🇪 dbmwebdesign	2026-11-10 06:00:34 UTC · (2 days ago)	Repeated probing for non-existent PHP exploit paths blocked by Fail2Ban	Web App Attack
🇫🇮 as211431.net	2026-11-10 05:38:50 UTC · (2 days ago)	Triggered Cloudflare WAF (firewallCustom) from SG. Action taken: MANAGED_CHALLENGE Protocol: HTTP/1.1 (GET method) Endpoint: //images/images/images/images/images/images/images/images/cache.php UA: Mozlila/5.0 (Linux; Android 7.0; SM-G892A Bulid/NRD90 ... show more Triggered Cloudflare WAF (firewallCustom) from SG. Action taken: MANAGED_CHALLENGE Protocol: HTTP/1.1 (GET method) Endpoint: //images/images/images/images/images/images/images/images/cache.php UA: Mozlila/5.0 (Linux; Android 7.0; SM-G892A Bulid/NRD90M; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/60.0.3112.107 Moblie Safari/537.36 This report was generated by: https://github.com/sefinek/Cloudflare-WAF-To-AbuseIPDB show less	Bad Web Bot
Anonymous	2026-11-10 05:09:05 UTC · (2 days ago)	Bot / scanning and/or hacking attempts: GET /images/images/images/images/images/images/images/images/ca, GET //images/images/images/images/images/images/images/images/c, GET //cgi-bin/cgi-bin/cgi-bin/cgi-bin/cache.php HTTP/1.1, GET /images/images/cac ... show more Bot / scanning and/or hacking attempts: GET /images/images/images/images/images/images/images/images/ca, GET //images/images/images/images/images/images/images/images/c, GET //cgi-bin/cgi-bin/cgi-bin/cgi-bin/cache.php HTTP/1.1, GET /images/images/cache.php HTTP/1.1 show less	Hacking Web App Attack
🇺🇸 kosada.com	2026-11-10 02:52:59 UTC · (2 days ago)	Repeated requests for suspicious nonexistent URLs, for example: /images/images/images/images/images/images/images/images/cache.php (HTTP/1.1 port 443, user agent: "Mozlila/5.0 (Linux; Android 7.0; SM-G892A Bulid/NRD90M; wv) AppleWebKit/537.36 (KHTML, ... show more Repeated requests for suspicious nonexistent URLs, for example: /images/images/images/images/images/images/images/images/cache.php (HTTP/1.1 port 443, user agent: "Mozlila/5.0 (Linux; Android 7.0; SM-G892A Bulid/NRD90M; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/60.0.3112.107 Moblie Safari/537.36") show less	Web App Attack
🇩🇪 s@ch@	2026-11-10 01:30:02 UTC · (2 days ago)	Jail: plesk-modsecurity \| Web application attack (Plesk ModSecurity)	Web App Attack

Showing 1 to 15 of 72 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown

Recently Reported IPs:

🇦🇷 201.219.167.247

🇯🇵 152.32.202.151

🇩🇪 139.19.117.131

🇨🇳 119.125.102.51

🇷🇺 93.120.167.212

🇳🇱 86.38.187.65

🇪🇸 82.223.28.157

🇺🇸 65.49.1.182

🇸🇦 51.39.95.54

🇮🇹 217.26.179.249

🇻🇳 160.30.160.232

🇸🇬 152.42.232.107

🇯🇵 152.32.201.80

🇭🇰 152.32.186.240

🇨🇳 106.14.104.209

🇫🇷 88.165.80.169

🇦🇺 34.151.117.245

🇩🇪 2a02:c202:2359:8101::1

🇨🇭 209.99.190.186

🇳🇱 200.138.46.95