JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

168.196.138.66

Activity Trending Down

Abuse Confidence Score

19% Caution

26 reports

21 reporters · latest 1 month ago

ISP: BRASIL TECPAR | AMIGO | AVATO
Usage Type: Fixed Line ISP
ASN: AS262907
Domain Name: brasiltecpar.com.br
Country: 🇧🇷 Brazil
City: Sao Paulo, Sao Paulo

ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report Whois

Example preview

Account required for the enhanced features Log in Sign up

Abuse Reports

Export reports CSV

Total reports

26 from 21 distinct reporters

First reported

December 6th 2024

Most recent report

1 month ago

Last 60 days

Top reporter locations 🇩🇪 Germany 3 🇫🇮 Finland 1 🇺🇸 United States of America 1

Most common categories Web App Attack 2 Hacking 2 Port Scan 2 Brute-Force 2 Bad Web Bot 1

Old reports The most recent abuse report for this IP address is from 1 month ago. It is possible that this IP is no longer involved in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
Anonymous	2026-10-10 06:38:24 UTC · (1 month ago)	Cowrie SSH honeypot: cowrie.session.connect	Brute-Force SSH
🇫🇮 6kilowatti	2026-10-10 02:13:33 UTC · (1 month ago)	2026-10-10T05:13:32.306017+03:00 koti kernel: [UFW BLOCK] IN=enp0s25 OUT= MAC=6c:62:6d:bd:29:2d:18:fd:74:70:71:9e:08:00 SRC=168.196.138.66 DST=10.0.0.30 LEN=60 TOS=0x00 PREC=0x00 TTL=49 ID=53735 DF PROTO=TCP SPT=65414 DPT=23 WINDOW=65535 RES=0x00 SYN ... show more 2026-10-10T05:13:32.306017+03:00 koti kernel: [UFW BLOCK] IN=enp0s25 OUT= MAC=6c:62:6d:bd:29:2d:18:fd:74:70:71:9e:08:00 SRC=168.196.138.66 DST=10.0.0.30 LEN=60 TOS=0x00 PREC=0x00 TTL=49 ID=53735 DF PROTO=TCP SPT=65414 DPT=23 WINDOW=65535 RES=0x00 SYN URGP=0 ... show less	Port Scan
🇩🇪 LRob	2026-10-08 01:11:15 UTC · (1 month ago)	WordPress attack-tool calls \| method: POST \| path: /xmlrpc.php \| ua: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7; x64) AppleWebKit/537.36 (KHTML, like Gecko) Opera/75.0.0.0 Safari/537.36	Web App Attack Hacking
Anonymous	2026-10-07 07:01:44 UTC · (1 month ago)	denied traffic to a honeypot network. destination port 32557.	Port Scan Hacking
🇺🇸 TPI-Abuse	2026-09-24 03:40:31 UTC · (1 month ago)	(mod_security) mod_security (id:210350) triggered by 168.196.138.66 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Sep 23 23:40:26.869878 2026] [security2:error] [pid 21371:tid 21371] [client 168.196.138.66:57561] ... show more (mod_security) mod_security (id:210350) triggered by 168.196.138.66 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Sep 23 23:40:26.869878 2026] [security2:error] [pid 21371:tid 21371] [client 168.196.138.66:57561] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close\|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close\|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found\|\|usfspirit.com\|F\|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "usfspirit.com"] [uri "/"] [unique_id "arSbqh3zb-HX_ruzE-AbjgAAABA"], referer: https://nhanptes.blogspot.com/ show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 kosada.com	2026-08-31 00:41:44 UTC · (2 months ago)	Web bot: denial-of-service flood	DDoS Attack Bad Web Bot
🇺🇸 鬼影233	2026-08-24 22:00:54 UTC · (2 months ago)	Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36	Bad Web Bot
🇳🇱 ByeByte API	2026-08-09 01:53:39 UTC · (3 months ago)	Port scan from this IP. Firewall dropped every packet. Targeted UDP ports: 22022. Single burst at 2026-08-09 01:53 UTC.	Port Scan
🇳🇱 ByeByte API	2026-08-09 01:53:39 UTC · (3 months ago)	Port scan from this IP. Firewall dropped every packet. Targeted UDP ports: 22022. Single burst at 2026-08-09 01:53 UTC.	Port Scan
🇩🇪 ValtonTahiri	2026-08-08 12:42:04 UTC · (3 months ago)	UFW blocked a suspicious connection attempt to a closed or denied port. This activity is commonly associated with port scanning, service discovery, or automated internet probing. Technical: source_ip=168.196.138.66; proto=UDP; source_port=16802; targ ... show more UFW blocked a suspicious connection attempt to a closed or denied port. This activity is commonly associated with port scanning, service discovery, or automated internet probing. Technical: source_ip=168.196.138.66; proto=UDP; source_port=16802; target_port=51654 show less	Port Scan
🇩🇪 Admins@FBN	2026-08-08 08:17:21 UTC · (3 months ago)	FW-PortScan: Traffic Blocked srcport=44432 dstport=32644	Port Scan
🇫🇷 EDSL	2026-08-08 03:34:22 UTC · (3 months ago)	[SRV-VPN1] Blocked by SysWarden Firewall (Port Scan / Probing)	Port Scan
🇩🇪 Admins@FBN	2026-08-07 05:17:15 UTC · (3 months ago)	FW-PortScan: Traffic Blocked srcport=12255 dstport=31593	Port Scan
Anonymous	2026-08-07 02:25:46 UTC · (3 months ago)	16985/udp (1 or more attempts)	Port Scan
🇩🇪 Admins@FBN	2026-08-07 00:35:18 UTC · (3 months ago)	FW-PortScan: Traffic Blocked srcport=44328 dstport=50587	Port Scan

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown

Recently Reported IPs:

🇳🇱 200.138.46.151

🇩🇪 167.94.146.43

🇺🇸 110.172.141.57

🇲🇦 105.68.205.136

🇮🇩 103.174.238.9

🇸🇪 46.59.91.85

🇺🇸 44.207.6.61

🇺🇸 40.119.46.0

🇮🇶 37.239.172.183

🇮🇶 37.77.55.178

🇹🇭 34.15.151.107

🇮🇹 217.202.29.131

🇩🇪 209.38.237.1

🇫🇮 204.168.152.22

🇳🇱 204.76.203.214

🇨🇴 190.255.34.218

🇲🇽 187.189.68.189

🇺🇸 147.185.132.55

🇮🇳 139.59.74.208

🇨🇳 115.190.226.99