JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 168.253.116.138

168.253.116.138 was found in our database!

This IP was reported 23 times. Confidence of Abuse is 53%: ?

53%

ISP	NGCOM
Usage Type	Fixed Line ISP
ASN	AS37347
Hostname(s)	host-168-253-116-138.ngcomworld.com
Domain Name	ngcomnetworks.com
Country	🇳🇬 Nigeria
City	Lagos, Lagos

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 168.253.116.138

Whois 168.253.116.138

IP Abuse Reports for 168.253.116.138:

This IP address has been reported a total of 23 times from 17 distinct sources. 168.253.116.138 was first reported on December 27th 2025, and the most recent report was 7 hours ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇩🇪 kkeyser	2026-07-19 06:05:26 (7 hours ago)	GET /owa/auth/logon.aspx?replaceCurrent=1&url=https%3A//owa.mgateB.kmkorma.ru/owa/ HTTP/1.1	Web App Attack
🇩🇪 filstal.org	2026-07-19 05:36:57 (8 hours ago)	Automated bot: spoofed/impossible user-agent, web scraping or automated request patterns detected. U ... show more Automated bot: spoofed/impossible user-agent, web scraping or automated request patterns detected. UA: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko show less	Bad Web Bot Web App Attack
Anonymous	2026-07-10 10:05:26 (1 week ago)	(caddyscan) Scanner path probe from 168.253.116.138 (NE/Niger/host-168-253-116-138.ngcomworld.com): ... show more (caddyscan) Scanner path probe from 168.253.116.138 (NE/Niger/host-168-253-116-138.ngcomworld.com): 5 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: [REDACTED] 404 301 168.253.116.138 - - [10/Jul/2026:09:25:51 +0000] "GET /owa/auth/logon.aspx?replaceCurrent=1&url=https%3A//[REDACTED]/owa/ HTTP/1.1" [REDACTED] 404 300 168.253.116.138 - - [10/Jul/2026:09:25:52 +0000] "GET /owa/auth/logon.aspx?replaceCurrent=1&url=http%3A//[REDACTED]/owa/ HTTP/1.1" [REDACTED] 200 2627 168.253.116.138 - - [10/Jul/2026:10:00:25 +0000] "GET /owa/auth/logon.aspx?replaceCurrent=1&url=http%3A//[REDACTED]/owa/ HTTP/1.1" [REDACTED] 200 2627 168.253.116.138 - - [10/Jul/2026:10:00:29 +0000] "GET /owa/auth/logon.aspx?replaceCurrent=1&url=http%3A//[REDACTED]/owa/ HTTP/1.1" [REDACTED] 200 2627 168.253.116.138 - - [10/Jul/2026:10:05:22 +0000] "GET /owa/auth/logon.aspx?replaceCurrent=1&url=http%3A//[REDACTED]/owa/ HTTP/1.1" show less	Port Scan
Anonymous	2026-07-10 03:20:20 (1 week ago)	(caddyscan) Scanner path probe from 168.253.116.138 (NE/Niger/host-168-253-116-138.ngcomworld.com): ... show more (caddyscan) Scanner path probe from 168.253.116.138 (NE/Niger/host-168-253-116-138.ngcomworld.com): 5 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: [REDACTED] 404 298 168.253.116.138 - - [10/Jul/2026:02:48:38 +0000] "GET /owa/auth/logon.aspx?replaceCurrent=1&url=http%3A//[REDACTED]/owa/ HTTP/1.1" [REDACTED] 200 2627 168.253.116.138 - - [10/Jul/2026:02:52:25 +0000] "GET /owa/auth/logon.aspx?replaceCurrent=1&url=http%3A//[REDACTED]/owa/ HTTP/1.1" [REDACTED] 200 2627 168.253.116.138 - - [10/Jul/2026:03:11:22 +0000] "GET /owa/auth/logon.aspx?replaceCurrent=1&url=http%3A//[REDACTED]/owa/ HTTP/1.1" [REDACTED] 200 2627 168.253.116.138 - - [10/Jul/2026:03:11:43 +0000] "GET /owa/auth/logon.aspx?replaceCurrent=1&url=http%3A//[REDACTED]/owa/ HTTP/1.1" [REDACTED] 200 2627 168.253.116.138 - - [10/Jul/2026:03:20:18 +0000] "GET /owa/auth/logon.aspx?replaceCurrent=1&url=http%3A//[REDACTED]/owa/ HTTP/1.1" show less	Port Scan
🇺🇸 kosada.com	2026-07-09 09:04:05 (1 week ago)	Web vulnerability probing: /owa/auth/logon.aspx	Web App Attack
🇨🇭 Origon	2026-07-09 00:05:15 (1 week ago)	http-technology-probing - IP: 168.253.116.138 - time="2026-07-09T02:05:15+02:00" level=info msg="(5 ... show more http-technology-probing - IP: 168.253.116.138 - time="2026-07-09T02:05:15+02:00" level=info msg="(555f66b4f6a74558bc11e3f93469658es8App0Mcc0TKEeje) alert : crowdsecurity/http-technology-probing by ip 168.253.116.138 (NG/37347)" module=db show less	Web App Attack
🇺🇸 jkcunningham	2026-07-08 01:10:56 (1 week ago)	Vulnerability scanner. Targets os and filesystem, Attempts OWA login with user redirect.	Bad Web Bot Port Scan
🇫🇷 IRISIO	2026-07-06 09:44:46 (1 week ago)	scans/SQL injection/spam posts : 22 queries	Web App Attack SQL Injection
Anonymous	2026-07-06 07:32:13 (1 week ago)	"GET /owa/auth/logon.aspx?replaceCurrent=1&url=https%3A//owa./owa/ HTTP/1.1"	Hacking Web App Attack
Anonymous	2026-07-05 19:08:19 (1 week ago)	Unauthorized connection attempt	Port Scan Hacking Exploited Host
🇨🇭 Origon	2026-07-05 08:42:43 (2 weeks ago)	http-technology-probing - IP: 168.253.116.138 - time="2026-07-05T10:42:43+02:00" level=info msg="(5 ... show more http-technology-probing - IP: 168.253.116.138 - time="2026-07-05T10:42:43+02:00" level=info msg="(555f66b4f6a74558bc11e3f93469658es8App0Mcc0TKEeje) alert : crowdsecurity/http-technology-probing by ip 168.253.116.138 (NG/37347)" module=db show less	Web App Attack
🇺🇸 NXTwoThou	2026-07-02 10:30:42 (2 weeks ago)	/owa/auth/logon.aspx%3FreplaceCurrent=1%26url=https%3A//owa.winvoice.com/owa/	Web App Attack
🇨🇭 Origon	2026-06-30 16:27:00 (2 weeks ago)	http-technology-probing - IP: 168.253.116.138 - time="2026-06-30T18:26:59+02:00" level=info msg="(5 ... show more http-technology-probing - IP: 168.253.116.138 - time="2026-06-30T18:26:59+02:00" level=info msg="(555f66b4f6a74558bc11e3f93469658es8App0Mcc0TKEeje) alert : crowdsecurity/http-technology-probing by ip 168.253.116.138 (NG/37347)" module=db show less	Web App Attack
🇩🇪 mnpx	2026-01-08 06:54:20 (6 months ago)	SMTP brute forcing (6× over 4h:52m); first seen here 2025-12-27T23:43Z	Brute-Force
🇩🇪 mnpx	2026-01-08 06:54:20 (6 months ago)	SMTP brute forcing (4× over 2h:27m); first seen here 2025-12-27T23:43Z	Brute-Force

Showing 1 to 15 of 23 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇲🇦 196.114.198.172

🇮🇳 182.78.86.62

🇺🇸 2607:f8b0:4001:c0c::121

🇩🇪 217.181.84.225

🇮🇶 204.157.182.19

🇷🇴 193.32.162.83

🇪🇨 191.99.34.221

🇧🇷 177.91.2.14

🇪🇬 156.209.101.33

🇺🇸 147.185.132.202

🇨🇳 111.26.95.126

🇺🇸 66.132.172.182

🇮🇶 62.201.243.203

🇺🇸 20.168.6.88

🇺🇸 172.98.33.15

🇺🇸 162.216.149.195

🇨🇳 124.65.98.234

🇹🇼 118.163.132.212

🇨🇦 85.217.149.65

🇫🇷 85.217.140.47