AbuseIPDB » 138.91.109.125
IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.
Top Reporter Countries (Last 60 Days)
Example preview
Report Categories (Last 60 Days)
Example previewIP Abuse Reports for 138.91.109.125:
This IP address has been reported a total of 8,180 times from 580 distinct sources. 138.91.109.125 was first reported on , and the most recent report was . In the last 60 days, the top reporter locations were: United States of America with 425 reports; Germany with 106 reports; France with 47 reports. The most common categories in these recent reports were: Port Scan 655 times; Brute-Force 121 times; Hacking 115 times; Web App Attack 62 times; Bad Web Bot 23 times; Other 70 times.
| Reporter | IoA Timestamp (UTC) | Comment | Categories | |
|---|---|---|---|---|
| 🇺🇸 MPL |
tcp/2096 (2 or more attempts)
|
Port Scan | ||
| 🇺🇸 MPL |
tcp ports: 4040,443 (4 or more attempts)
|
Port Scan | ||
| 🇫🇷 thecocasio |
|
Port Scan | ||
| 🇳🇱 VMHeaven.io |
Blocked by UFW [7077/tcp]
Source port: 49367
TTL: 44
Packet length: 52
|
Port Scan | ||
| 🇺🇸 MPL |
tcp/9042 (2 or more attempts)
|
Port Scan | ||
| 🇺🇸 gu-alvareza |
ZGrab.Scanner
|
Port Scan | ||
| 🇬🇧 OptimusGO |
|
Port Scan Brute-Force | ||
| 🇺🇸 Cyber Crusader |
Hundreds of Attempts (at least) to Connect to and Access Firewall Ports
|
Port Scan Hacking Brute-Force | ||
| 🇺🇸 MPL |
tcp/27017 (2 or more attempts)
|
Port Scan | ||
| 🇺🇸 MPL |
tcp/194 (2 or more attempts)
|
Port Scan | ||
| 🇧🇷 noconex |
|
Port Scan Brute-Force SSH | ||
| 🇺🇸 OceanTreasure |
tcp/5900; Scan for open VNC remote desktop port (R18) @ 2026-08-23T18:20:43Z
|
Brute-Force | ||
| 🇦🇱 router.al |
08/23/2026-17:58:58.809797 138.91.109.125 Protocol: 6 ET SCAN Zmap User-Agent (Inbound)
|
Hacking | ||
| 🇺🇸 MPL |
tcp/8443
|
Port Scan | ||
| 🇵🇱 sefinek.net |
|
Port Scan |
Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩