138.197.136.163

Basic Info

City: unknown

Region: unknown

Country: Canada

Internet Service Provider: DigitalOcean LLC

Hostname: unknown

Organization: unknown

Usage Type: Data Center/Web Hosting/Transit

Comments:

Make a comment on this IP

Type	Details	Datetime
attack	Bruteforce detected by fail2ban	2020-09-30 03:10:28
attack	Invalid user oracle from 138.197.136.163 port 37458	2020-09-29 19:14:00

Comments on same subnet:

IP	Type	Details	Datetime
138.197.136.30	attack	2020-08-26T12:41:16.767587snf-827550 sshd[26410]: Failed password for invalid user hxn from 138.197.136.30 port 58790 ssh2 2020-08-26T12:51:06.675287snf-827550 sshd[26435]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=138.197.136.30 user=root 2020-08-26T12:51:08.066895snf-827550 sshd[26435]: Failed password for root from 138.197.136.30 port 52754 ssh2 ...	2020-08-26 17:55:02
138.197.136.72	attack	138.197.136.72 - - [23/Aug/2020:22:54:54 +0100] "POST /wp/wp-login.php HTTP/1.1" 200 1865 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0" 138.197.136.72 - - [23/Aug/2020:22:54:56 +0100] "POST /wp/wp-login.php HTTP/1.1" 200 1857 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0" 138.197.136.72 - - [23/Aug/2020:22:54:56 +0100] "POST /wp/xmlrpc.php HTTP/1.1" 200 247 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0" ...	2020-08-24 08:11:55
138.197.136.72	attack	WordPress wp-login brute force :: 138.197.136.72 0.100 - [19/Aug/2020:12:28:51 0000] [censored_1] "POST /wp-login.php HTTP/1.1" 200 2411 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0" "HTTP/1.1"	2020-08-20 01:18:46
138.197.136.72	attackspam	138.197.136.72 - - [17/Aug/2020:08:21:57 +0100] "POST /wp-login.php HTTP/1.1" 200 1948 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0" 138.197.136.72 - - [17/Aug/2020:08:21:58 +0100] "POST /wp-login.php HTTP/1.1" 200 1890 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0" 138.197.136.72 - - [17/Aug/2020:08:21:59 +0100] "POST /wp-login.php HTTP/1.1" 200 1887 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0" ...	2020-08-17 16:17:00
138.197.136.72	attackspambots	138.197.136.72 - - [07/Aug/2020:12:08:57 +0100] "POST /xmlrpc.php HTTP/1.1" 403 219 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0" 138.197.136.72 - - [07/Aug/2020:12:09:06 +0100] "POST /wp-login.php HTTP/1.1" 200 2066 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0" 138.197.136.72 - - [07/Aug/2020:12:09:06 +0100] "POST /xmlrpc.php HTTP/1.1" 403 219 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0" ...	2020-08-07 19:21:04
138.197.136.72	attack	WordPress Login Brute Force Attempt , PTR: PTR record not found	2020-08-06 21:57:06
138.197.136.72	attackbotsspam	138.197.136.72 - - [31/Jul/2020:01:36:22 +0200] "GET /wp-login.php HTTP/1.1" 200 1901 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0" 138.197.136.72 - - [31/Jul/2020:01:36:23 +0200] "POST /wp-login.php HTTP/1.1" 200 2031 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0" 138.197.136.72 - - [31/Jul/2020:01:36:23 +0200] "GET /wp-login.php HTTP/1.1" 200 1901 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0" 138.197.136.72 - - [31/Jul/2020:01:36:23 +0200] "POST /wp-login.php HTTP/1.1" 200 2007 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0" 138.197.136.72 - - [31/Jul/2020:01:36:23 +0200] "GET /wp-login.php HTTP/1.1" 200 1901 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0" 138.197.136.72 - - [31/Jul/2020:01:36:24 +0200] "POST /wp-login.php HTTP/1.1" 200 2008 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/201001 ...	2020-07-31 08:07:30
138.197.136.72	attackspam	Automatic report - Banned IP Access	2020-07-27 19:16:32
138.197.136.72	attack	138.197.136.72 - - [16/Jul/2020:07:24:28 +0100] "POST /wp-login.php HTTP/1.1" 200 2046 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0" 138.197.136.72 - - [16/Jul/2020:07:24:30 +0100] "POST /wp-login.php HTTP/1.1" 200 2020 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0" 138.197.136.72 - - [16/Jul/2020:07:24:31 +0100] "POST /wp-login.php HTTP/1.1" 200 2019 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0" ...	2020-07-16 19:11:46
138.197.136.72	attackspambots	138.197.136.72 - - \[06/Jul/2020:15:43:30 +0200\] "POST /wp-login.php HTTP/1.1" 200 9954 "-" "Mozilla/5.0 \(X11\; Ubuntu\; Linux x86_64\; rv:62.0\) Gecko/20100101 Firefox/62.0" 138.197.136.72 - - \[06/Jul/2020:15:43:31 +0200\] "POST /wp-login.php HTTP/1.1" 200 9823 "-" "Mozilla/5.0 \(X11\; Ubuntu\; Linux x86_64\; rv:62.0\) Gecko/20100101 Firefox/62.0" ...	2020-07-06 21:46:38
138.197.136.72	attackspam	Automatic report - XMLRPC Attack	2020-07-01 05:00:31
138.197.136.72	attackspambots	138.197.136.72 - - [27/Jun/2020:23:55:25 +0100] "POST /wp-login.php HTTP/1.1" 200 1792 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0" 138.197.136.72 - - [27/Jun/2020:23:55:26 +0100] "POST /wp-login.php HTTP/1.1" 200 1768 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0" 138.197.136.72 - - [27/Jun/2020:23:55:27 +0100] "POST /xmlrpc.php HTTP/1.1" 403 219 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0" ...	2020-06-28 07:29:02
138.197.136.72	attack	10 attempts against mh-misc-ban on heat	2020-06-14 02:29:17
138.197.136.72	attack	138.197.136.72 - - [10/Jun/2020:05:53:21 +0200] "GET /wp-login.php HTTP/1.1" 200 6433 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0" 138.197.136.72 - - [10/Jun/2020:05:53:23 +0200] "POST /wp-login.php HTTP/1.1" 200 6684 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0" 138.197.136.72 - - [10/Jun/2020:05:53:24 +0200] "POST /xmlrpc.php HTTP/1.1" 200 427 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"	2020-06-10 14:01:51
138.197.136.72	attackbots	Automatic report - XMLRPC Attack	2020-06-07 04:11:01

Whois info:

Dig info:

; <<>> DiG 9.10.3-P4-Ubuntu <<>> 138.197.136.163
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 61669
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;138.197.136.163.		IN	A

;; AUTHORITY SECTION:
.			366	IN	SOA	a.root-servers.net. nstld.verisign-grs.com. 2020092900 1800 900 604800 86400

;; Query time: 16 msec
;; SERVER: 183.60.83.19#53(183.60.83.19)
;; WHEN: Tue Sep 29 19:13:57 CST 2020
;; MSG SIZE  rcvd: 119

Host info

Host 163.136.197.138.in-addr.arpa. not found: 3(NXDOMAIN)

Nslookup info:

Server:		183.60.83.19
Address:	183.60.83.19#53

** server can't find 163.136.197.138.in-addr.arpa: NXDOMAIN

Related IP info:

Related comments:

IP	Type	Details	Datetime
77.40.3.118	attack	email spam	2020-10-09 00:03:42
152.136.70.177	attackbots	TCP (SYN) 152.136.70.177:48241 -> port 4244, len 44	2020-10-08 23:51:31
62.28.222.221	attack	Oct 8 09:11:19 vps647732 sshd[22505]: Failed password for root from 62.28.222.221 port 32782 ssh2 ...	2020-10-09 00:19:59
199.195.250.247	attackbotsspam	sshguard	2020-10-09 00:10:30
121.204.208.43	attackspambots	2020-10-08 00:26:03 server sshd[89592]: Failed password for invalid user root from 121.204.208.43 port 36582 ssh2	2020-10-09 00:13:41
94.244.140.103	attackbotsspam	Automatic report - Port Scan Attack	2020-10-09 00:22:43
193.169.253.63	attackbots	TCP (SYN) 193.169.253.63:55064 -> port 25, len 40	2020-10-09 00:01:15
201.149.49.146	attackspam	Oct 8 12:32:22 master sshd[21506]: Failed password for root from 201.149.49.146 port 55644 ssh2 Oct 8 12:36:29 master sshd[21508]: Failed password for root from 201.149.49.146 port 34060 ssh2 Oct 8 12:48:43 master sshd[21535]: Failed password for root from 201.149.49.146 port 54004 ssh2 Oct 8 12:52:46 master sshd[21537]: Failed password for root from 201.149.49.146 port 60652 ssh2 Oct 8 13:04:56 master sshd[21559]: Failed password for root from 201.149.49.146 port 52366 ssh2 Oct 8 13:08:55 master sshd[21562]: Failed password for root from 201.149.49.146 port 59014 ssh2	2020-10-08 23:46:18
186.154.38.249	attackspam	TCP (SYN) 186.154.38.249:44286 -> port 23, len 40	2020-10-08 23:56:00
222.186.180.130	attackbots	2020-10-08T19:10:41.447473lavrinenko.info sshd[4111]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=222.186.180.130 user=root 2020-10-08T19:10:44.036052lavrinenko.info sshd[4111]: Failed password for root from 222.186.180.130 port 10623 ssh2 2020-10-08T19:10:41.447473lavrinenko.info sshd[4111]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=222.186.180.130 user=root 2020-10-08T19:10:44.036052lavrinenko.info sshd[4111]: Failed password for root from 222.186.180.130 port 10623 ssh2 2020-10-08T19:10:47.504247lavrinenko.info sshd[4111]: Failed password for root from 222.186.180.130 port 10623 ssh2 ...	2020-10-09 00:20:28
113.186.42.25	attackbots	2020-10-08T15:49:55.186186mail.broermann.family sshd[6756]: Failed password for root from 113.186.42.25 port 61863 ssh2 2020-10-08T16:05:25.366915mail.broermann.family sshd[8180]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=113.186.42.25 user=root 2020-10-08T16:05:27.474538mail.broermann.family sshd[8180]: Failed password for root from 113.186.42.25 port 15593 ssh2 2020-10-08T16:20:59.122583mail.broermann.family sshd[9585]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=113.186.42.25 user=root 2020-10-08T16:21:01.115261mail.broermann.family sshd[9585]: Failed password for root from 113.186.42.25 port 8298 ssh2 ...	2020-10-08 23:57:26
101.51.191.21	attack	1602103454 - 10/07/2020 22:44:14 Host: 101.51.191.21/101.51.191.21 Port: 445 TCP Blocked	2020-10-09 00:16:17
129.204.208.34	attack	129.204.208.34 (CN/China/-), 6 distributed sshd attacks on account [root] in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_DISTATTACK; Logs: Oct 8 02:59:54 server2 sshd[13278]: Failed password for root from 35.200.203.6 port 46678 ssh2 Oct 8 03:01:38 server2 sshd[14281]: Failed password for root from 129.204.208.34 port 43560 ssh2 Oct 8 03:01:36 server2 sshd[14281]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=129.204.208.34 user=root Oct 8 03:02:07 server2 sshd[14661]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=115.159.152.188 user=root Oct 8 02:59:18 server2 sshd[13179]: Failed password for root from 121.52.154.36 port 52332 ssh2 Oct 8 02:59:17 server2 sshd[13179]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=121.52.154.36 user=root IP Addresses Blocked: 35.200.203.6 (-)	2020-10-09 00:21:55
104.131.131.140	attackspambots	(sshd) Failed SSH login from 104.131.131.140 (US/United States/-): 5 in the last 3600 secs	2020-10-08 23:44:00
134.175.11.167	attack	Oct 8 16:12:46 vm0 sshd[9244]: Failed password for root from 134.175.11.167 port 55962 ssh2 ...	2020-10-08 23:59:55

Recently Reported IPs

134.127.44.162	101.228.109.134	194.105.6.66	162.158.158.113
36.74.47.123	114.47.15.58	66.35.114.162	1.55.230.170
89.160.179.46	61.170.209.183	49.232.3.125	137.74.219.115
36.24.153.1	190.27.103.100	200.109.66.201	177.82.100.19
173.0.84.226	58.186.120.77	236.229.235.216	51.195.63.170