138.201.157.49

Classification: Malicious

138.201.157.49 is a malicious IP address. Reported by 4 threat sources, last seen 2026-08-15. Network: AS24940 Hetzner Online GmbH.

Current activity

  • Known attacker — Seen launching attacks over the Internet.

Blacklist sightings

Description Source First seen Last seen Labels MITRE ATT&CK
Mail Spammer Barracuda 2024-07-07 11:53:57 2026-08-15 14:44:47 attacker malicious-activity
Malicious Host AbuseIPDB 2025-02-05 15:04:02 2025-07-18 17:52:42 compromised malicious-activity
SSH Attacker Blocklist.de 2024-07-07 11:53:54 2025-07-16 08:59:30 malicious-activity
Suspicious Host AbuseIPDB 2025-03-27 20:50:24 2025-07-13 20:10:23 anomalous-activity
HTTP Attacker Blocklist.de 2025-03-17 12:47:17 2025-04-15 11:58:57 malicious-activity
Bruteforce AbuseIPDB 2025-02-05 14:21:53 2025-04-05 07:30:01 malicious-activity
Hacking AbuseIPDB 2025-02-05 15:23:17 2025-04-02 17:03:49 malicious-activity
HTTP Attacker AbuseIPDB 2025-02-05 19:27:24 2025-04-02 07:00:03 malicious-activity
Port Scanner AbuseIPDB 2025-02-05 15:20:55 2025-03-21 10:03:31 anomalous-activity
SSH Attacker AbuseIPDB 2025-02-05 14:55:55 2025-02-08 19:32:46 malicious-activity
Mail Spammer AbuseIPDB 2025-02-05 18:03:04 2025-02-05 18:03:04 malicious-activity
IMAP Attacker AbuseIPDB 2025-02-05 16:57:32 2025-02-05 16:57:32 malicious-activity
SSH Attacker Blocklist.net.ua 2024-07-07 16:30:16 2024-07-07 16:30:16 malicious-activity

Tags

ssh bruteforce bot abuse apache ddos rfi attacker

Whois information

AS name
AS24940 Hetzner Online GmbH
AS registry
ripencc
AS date
1990-05-23 00:00:00
AS CIDR
138.201.0.0/16
Registrant
Hetzner Online GmbH
City
Falkenstein/Vogtl.
Postal code
08223
Country
DE — Germany 🇩🇪
First indexed
2024-07-07 11:53:54
Last updated
2026-08-15 14:44:48

Malicious IPs in the same CIDR

138.201.196.252 138.201.51.181 138.201.121.103 138.201.225.177 138.201.125.121 138.201.121.34 138.201.126.243 138.201.133.126 138.201.19.25 138.201.58.21 138.201.105.101 138.201.78.61 138.201.118.8 138.201.126.72 138.201.157.49