JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

68.148.138.163

Recent Activity

Abuse Confidence Score

62% Elevated

23 reports

16 reporters · latest 13 hours ago

ISP: Shaw Communications
Usage Type: Fixed Line ISP
ASN: AS6327
Hostname(s): s010674d02b861f01.ed.shawcable.net
Domain Name: rogers.com
Country: 🇨🇦 Canada
City: Edmonton, Alberta

ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report Whois

Example preview

Account required for the enhanced features Log in Sign up

Abuse Reports

Export reports CSV

Total reports

23 from 16 distinct reporters

First reported

September 3rd 2026

Most recent report

13 hours ago

Last 60 days

Top reporter locations 🇩🇪 Germany 8 🇺🇸 United States of America 8 🇫🇷 France 2

Most common categories Web App Attack 18 Brute-Force 8 Hacking 3 Port Scan 3 Exploited Host 2

Recent reports We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇺🇸 francelink.fr	2026-10-28 12:14:24 (13 hours ago)	Azure WAF blocked a request. Rule: 100200. Observed at: 2026-10-28T12:12:36.000Z.	Web App Attack
🇩🇪 4server	2026-10-28 10:17:10 (15 hours ago)	[WedOct2811:17:08.2025782026][security2:error][pid1032594:tid1032651][client68.148.138.163:0]ModSecurity:Accessdeniedwithcode403\(phase2\).Patternmatch\"\(\?i\)\\\\\\\\b\(\?:i\(\?:s\(\?:_\(\?:in\(\?:t\(\?:eger\)\?\\|finite\)\\|n\(\?:u\(\?:meric\\|ll\)\\| ... show more [WedOct2811:17:08.2025782026][security2:error][pid1032594:tid1032651][client68.148.138.163:0]ModSecurity:Accessdeniedwithcode403\(phase2\).Patternmatch\"\(\?i\)\\\\\\\\b\(\?:i\(\?:s\(\?:_\(\?:in\(\?:t\(\?:eger\)\?\\|finite\)\\|n\(\?:u\(\?:meric\\|ll\)\\|an\)\\|\(\?:calla\\|dou\)ble\\|s\(\?:calar\\|tring\)\\|f\(\?:inite\\|loat\)\\|re\(\?:source\\|al\)\\|l\(\?:ink\\|ong\)\\|a\(\?:rray\)\?\\|object\\|bool\)\\|set\)\\|n\(\?:\(\?:clud\\|vok\)e\\|t\(\?:div\\|val\)\)\\|\(\?:mplod\\|dat\)e\\|conv\)\\|s\(\?:t\(\?:r\(\?:\(\?:le\\|sp\)n\\|...\"atREQUEST_COOKIES:4d5d155d508a4a358e8ec19b16a4af51.[file\"/etc/apache2/conf.d/modsec_rules/10_asl_rules.conf\"][line\"582\"][id\"380026\"][rev\"27\"][msg\"Atomicorp.comWAFRules:PHPpayloaddetected\"][data\"echo\(1144\*4475\)\"][severity\"CRITICAL\"][tag\"SQLi\"][tag\"RCE\"][hostname\"www.ksmstudio.ch\"][uri\"/wp-content/plugins/instagram-feed/instagram-feed.php\"][unique_id\"auHLpLMAxmAISQy-4iN8lwAAAE8\"] show less	Port Scan Brute-Force Web App Attack
Anonymous	2026-10-28 02:07:03 (23 hours ago)	68.148.138.163 - - [28/Oct/2026:03:07:02 +0100] "GET /wp-content/themes/twentynineteen/ HTTP/1.1" 404 56 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:155.0) Gecko/20100101 Firefox/155.0"	Web App Attack
🇺🇸 ambor	2026-10-27 23:38:11 (1 day ago)	Honeypot triggered: /wp-content/themes/twentynineteen/functions.php on ifebridge.com. User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:155.0) Gecko/20100101 Firefox/155.0. Method: GET	Web App Attack
🇩🇪 4server	2026-10-26 18:53:40 (2 days ago)	[MonOct2619:53:36.3070252026][security2:error][pid2873682:tid2873719][client68.148.138.163:0]ModSecurity:Accessdeniedwithcode403\(phase2\).Patternmatch\"\(\?i\)\\\\\\\\b\(\?:i\(\?:s\(\?:_\(\?:in\(\?:t\(\?:eger\)\?\\|finite\)\\|n\(\?:u\(\?:meric\\|ll\)\\| ... show more [MonOct2619:53:36.3070252026][security2:error][pid2873682:tid2873719][client68.148.138.163:0]ModSecurity:Accessdeniedwithcode403\(phase2\).Patternmatch\"\(\?i\)\\\\\\\\b\(\?:i\(\?:s\(\?:_\(\?:in\(\?:t\(\?:eger\)\?\\|finite\)\\|n\(\?:u\(\?:meric\\|ll\)\\|an\)\\|\(\?:calla\\|dou\)ble\\|s\(\?:calar\\|tring\)\\|f\(\?:inite\\|loat\)\\|re\(\?:source\\|al\)\\|l\(\?:ink\\|ong\)\\|a\(\?:rray\)\?\\|object\\|bool\)\\|set\)\\|n\(\?:\(\?:clud\\|vok\)e\\|t\(\?:div\\|val\)\)\\|\(\?:mplod\\|dat\)e\\|conv\)\\|s\(\?:t\(\?:r\(\?:\(\?:le\\|sp\)n\\|...\"atREQUEST_COOKIES:4d5d155d508a4a358e8ec19b16a4af51.[file\"/etc/apache2/conf.d/modsec_rules/10_asl_rules.conf\"][line\"582\"][id\"380026\"][rev\"27\"][msg\"Atomicorp.comWAFRules:PHPpayloaddetected\"][data\"echo\(2145\*3890\)\"][severity\"CRITICAL\"][tag\"SQLi\"][tag\"RCE\"][hostname\"www.allegraravizza.it\"][uri\"/\"][unique_id\"at-hsB6pl5WJrirel8Wn7gAAAZY\"] show less	Port Scan Brute-Force Web App Attack
🇩🇪 FeG Deutschland	2026-10-26 18:32:03 (2 days ago)	Looking for CMS/PHP/SQL vulnerablilities/excessive crawling - 14	Exploited Host Web App Attack
🇺🇸 francelink.fr	2026-10-25 00:16:25 (4 days ago)	Azure WAF blocked a request. Rule: 100200. Observed at: 2026-10-24T04:10:59.000Z.	Web App Attack
Anonymous	2026-10-24 12:00:13 (4 days ago)	[osotir.org] httpd-shell-path-probe: sites=www.agonistes.gr; logs=/var/log/httpd/domains/agonistes.gr.log; samples=/wp-content/themes/lay.post.php	Hacking Web App Attack
🇺🇸 francelink.fr	2026-10-24 07:51:25 (4 days ago)	Azure WAF blocked a request. Rule: 100200. Observed at: 2026-10-23T18:34:53.000Z.	Web App Attack
🇬🇧 gigatech	2026-10-23 19:00:04 (5 days ago)	Webserver Probing	Web App Attack
🇺🇸 ambor	2026-10-23 14:12:25 (5 days ago)	Honeypot triggered: /wp-content/plugins/akismet/data.php on ifebridge.com. User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:155.0) Gecko/20100101 Firefox/155.0. Method: GET	Web App Attack
🇲🇽 octageeks.com	2026-09-26 04:12:56 (1 month ago)	Wordpress malicious attack:[octawp]	Web App Attack
🇫🇷 pm33	2026-09-25 19:49:19 (1 month ago)	Wordpress login attempts	Brute-Force
🇩🇪 LRob	2026-09-25 18:39:20 (1 month ago)	This address is trying passwords on WordPress logins we host — through the login page or xmlrpc.php, often across several sites — for accounts it does not own. This is credential brute force or credential stuffing, the way sites get hijacked to sprea ... show more This address is trying passwords on WordPress logins we host — through the login page or xmlrpc.php, often across several sites — for accounts it does not own. This is credential brute force or credential stuffing, the way sites get hijacked to spread malware and spam; blocked. Please check the machine for malware or an attack tool. \| path: /wp-login.php \| 2026-09-25 18:39 UTC show less	Brute-Force Web App Attack
🇺🇸 mnsf	2026-09-25 17:05:35 (1 month ago)	Login Too Frequent (11)	Brute-Force Web App Attack

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown

Recently Reported IPs:

🇦🇷 190.115.118.145

🇧🇷 187.51.84.86

🇺🇸 172.178.16.179

🇺🇸 162.243.210.180

🇸🇬 145.223.140.26

🇰🇷 121.180.67.208

🇧🇬 79.124.40.178

🇰🇷 220.76.220.247

🇩🇪 194.88.98.102

🇫🇷 185.177.72.9

🇩🇪 167.94.146.38

🇹🇭 152.32.245.93

🇸🇬 101.47.8.113

🇷🇺 93.92.69.34

🇨🇳 60.16.199.226

🇺🇸 20.38.35.186

🇺🇸 193.163.101.216

🇻🇳 183.91.186.36

🇺🇸 173.255.221.86

🇺🇸 152.163.195.133