JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 104.168.4.138

104.168.4.138 was found in our database!

This IP was reported 666 times. Confidence of Abuse is 100%: ?

100%

ISP	HostPapa
Usage Type	Data Center/Web Hosting/Transit
ASN	AS36352
Hostname(s)	104-168-4-138-host.colocrossing.com
Domain Name	hostpapa.com
Country	🇺🇸 United States of America
City	Buffalo, New York

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 104.168.4.138

Whois 104.168.4.138

IP Abuse Reports for 104.168.4.138:

This IP address has been reported a total of 666 times from 230 distinct sources. 104.168.4.138 was first reported on February 12th 2025, and the most recent report was 3 hours ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇫🇷 Catalin Negru	2026-06-05 06:46:27 (3 hours ago)	2026-05-13 11:59:09,870 fail2ban.actions [671]: NOTICE [apache-404] Ban 104.168.4.138 2026-0 ... show more 2026-05-13 11:59:09,870 fail2ban.actions [671]: NOTICE [apache-404] Ban 104.168.4.138 2026-05-13 11:59:10,767 fail2ban.actions [671]: NOTICE [web-scanner] Ban 104.168.4.138 2026-05-13 11:59:10,778 fail2ban.actions [671]: NOTICE [laravel-auth] Ban 104.168.4.138 2026-05-13 11:59:10,801 fail2ban.actions [671]: NOTICE [apache-dirscan] Ban 104.168.4.138 2026-05-13 11:59:10,919 fail2ban.actions [671]: NOTICE [laravel-env] Ban 104.168.4.138 ... show less	Brute-Force Web App Attack
🇫🇷 Catalin Negru	2026-05-30 18:08:35 (5 days ago)	2026-05-13 11:59:09,870 fail2ban.actions [671]: NOTICE [apache-404] Ban 104.168.4.138 2026-0 ... show more 2026-05-13 11:59:09,870 fail2ban.actions [671]: NOTICE [apache-404] Ban 104.168.4.138 2026-05-13 11:59:10,767 fail2ban.actions [671]: NOTICE [web-scanner] Ban 104.168.4.138 2026-05-13 11:59:10,778 fail2ban.actions [671]: NOTICE [laravel-auth] Ban 104.168.4.138 2026-05-13 11:59:10,801 fail2ban.actions [671]: NOTICE [apache-dirscan] Ban 104.168.4.138 2026-05-13 11:59:10,919 fail2ban.actions [671]: NOTICE [laravel-env] Ban 104.168.4.138 ... show less	Brute-Force Web App Attack
🇺🇸 infra-monitor	2026-05-30 09:00:04 (6 days ago)	Automated ban via infra-monitor: suspicious-probe	Port Scan
🇩🇪 4server	2026-05-30 08:07:06 (6 days ago)	[SatMay3010:07:04.0214412026][security2:error][pid3495412:tid3495476][client104.168.4.138:0]ModSecur ... show more [SatMay3010:07:04.0214412026][security2:error][pid3495412:tid3495476][client104.168.4.138:0]ModSecurity:Accessdeniedwithcode403\(phase2\).OperatorGEmatched5atTX:anomaly_score.[file\"/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf\"][line\"94\"][id\"949110\"][msg\"InboundAnomalyScoreExceeded\(TotalScore:5\)\"][severity\"CRITICAL\"][ver\"OWASP_CRS/3.3.9\"][tag\"application-multi\"][tag\"language-multi\"][tag\"platform-multi\"][tag\"attack-generic\"][hostname\"archi-box.ch\"][uri\"/.git/HEAD\"][unique_id\"ahqaqKWYqR13vJvp-P8hIQAAAMU\"] show less	Port Scan Brute-Force Web App Attack
🇬🇧 pinguin	2026-05-30 06:40:41 (6 days ago)	Triggered Cloudflare WAF (firewallManaged) from US. Action taken: BLOCK Protocol: HTTP/1.1 (GET meth ... show more Triggered Cloudflare WAF (firewallManaged) from US. Action taken: BLOCK Protocol: HTTP/1.1 (GET method) Endpoint: /backend/.env UA: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36 This report was generated by: https://github.com/sefinek/Cloudflare-WAF-To-AbuseIPDB show less	Bad Web Bot
Anonymous	2026-05-30 05:11:50 (6 days ago)	(caddyscan) Scanner path probe from 104.168.4.138 (US/United States/104-168-4-138-host.colocrossing. ... show more (caddyscan) Scanner path probe from 104.168.4.138 (US/United States/104-168-4-138-host.colocrossing.com): 5 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: [REDACTED] 200 2627 104.168.4.138 - - [30/May/2026:05:11:47 +0000] "GET /.git/HEAD HTTP/1.1" [REDACTED] 200 2627 104.168.4.138 - - [30/May/2026:05:11:48 +0000] "GET /.env HTTP/1.1" [REDACTED] 200 2627 104.168.4.138 - - [30/May/2026:05:11:48 +0000] "GET /.env.local HTTP/1.1" [REDACTED] 200 2627 104.168.4.138 - - [30/May/2026:05:11:49 +0000] "GET /.env.production HTTP/1.1" [REDACTED] 200 2627 104.168.4.138 - - [30/May/2026:05:11:49 +0000] "GET /.git/config HTTP/1.1" show less	Port Scan
🇩🇪 Skyrider	2026-05-29 19:38:47 (6 days ago)	crowdsecurity/http-sensitive-files	Hacking
Anonymous	2026-05-29 19:14:14 (6 days ago)	(caddyscan) Scanner path probe from 104.168.4.138 (US/United States/104-168-4-138-host.colocrossing. ... show more (caddyscan) Scanner path probe from 104.168.4.138 (US/United States/104-168-4-138-host.colocrossing.com): 5 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: [REDACTED] 200 2627 104.168.4.138 - - [29/May/2026:19:14:07 +0000] "GET /.git/HEAD HTTP/1.1" [REDACTED] 200 2627 104.168.4.138 - - [29/May/2026:19:14:08 +0000] "GET /.env HTTP/1.1" [REDACTED] 200 2627 104.168.4.138 - - [29/May/2026:19:14:09 +0000] "GET /.git/config HTTP/1.1" [REDACTED] 200 2627 104.168.4.138 - - [29/May/2026:19:14:09 +0000] "GET /.env.production HTTP/1.1" [REDACTED] 200 2627 104.168.4.138 - - [29/May/2026:19:14:09 +0000] "GET /.env.development HTTP/1.1" show less	Port Scan
🇯🇵 bokumin.org	2026-05-29 16:29:40 (6 days ago)	[id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [uri "/.git/HEAD"] [id "949110 ... show more [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [uri "/.git/HEAD"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] show less	Web App Attack
🇺🇸 Sling	2026-05-29 15:43:05 (6 days ago)	Automated detection: IP accessed 7 sensitive endpoints within 30s on slingexe.me. Paths: /.git/HEAD, ... show more Automated detection: IP accessed 7 sensitive endpoints within 30s on slingexe.me. Paths: /.git/HEAD, /.env, /.env.local, /env, /.aws/credentials, /.env.production, /config.json. UA: Mozilla/5.0 (Macintosh; Intel Mac OS X 15.7; rv:149.0) Gecko/20100101 Firefox/149.0. show less	Web App Attack Bad Web Bot Hacking
🇺🇸 Major Hostility	2026-05-29 14:00:07 (6 days ago)	"GET /.git/HEAD HTTP/1.1" 404 "GET /.git/config HTTP/1.1" 404 "GET /js/config.js HTTP/1.1" 404 "GET ... show more "GET /.git/HEAD HTTP/1.1" 404 "GET /.git/config HTTP/1.1" 404 "GET /js/config.js HTTP/1.1" 404 "GET /.env HTTP/1.1" 404 "GET /api/.env HTTP/1.1" 404 show less	Web App Attack
Anonymous	2026-05-29 10:29:59 (1 week ago)	(caddyscan) Scanner path probe from 104.168.4.138 (US/United States/104-168-4-138-host.colocrossing. ... show more (caddyscan) Scanner path probe from 104.168.4.138 (US/United States/104-168-4-138-host.colocrossing.com): 5 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: [REDACTED] 200 2627 104.168.4.138 - - [29/May/2026:10:29:52 +0000] "GET /.git/HEAD HTTP/1.1" [REDACTED] 200 2627 104.168.4.138 - - [29/May/2026:10:29:52 +0000] "GET /.env HTTP/1.1" [REDACTED] 200 2627 104.168.4.138 - - [29/May/2026:10:29:54 +0000] "GET /.env.production HTTP/1.1" [REDACTED] 200 2627 104.168.4.138 - - [29/May/2026:10:29:54 +0000] "GET /.aws/credentials HTTP/1.1" [REDACTED] 200 2627 104.168.4.138 - - [29/May/2026:10:29:54 +0000] "GET /.env.local HTTP/1.1" show less	Port Scan
🇩🇪 auridh	2026-05-29 09:00:56 (1 week ago)	Ip 104.168.4.138 performed 'crowdsecurity/http-sensitive-files' (5 events over 1.364242578s) at 2026 ... show more Ip 104.168.4.138 performed 'crowdsecurity/http-sensitive-files' (5 events over 1.364242578s) at 2026-05-29 07:12:26.743276204 +0000 UTC show less	Web App Attack
🇩🇪 auridh	2026-05-29 07:59:43 (1 week ago)	Ip 104.168.4.138 performed 'crowdsecurity/http-probing' (11 events over 5.883140748s) at 2026-05-29 ... show more Ip 104.168.4.138 performed 'crowdsecurity/http-probing' (11 events over 5.883140748s) at 2026-05-29 07:12:26.934079851 +0000 UTC show less	Web App Attack
🇳🇱 e.fierstra	2026-05-29 06:26:13 (1 week ago)	ModSecurity hits exceeded	Bad Web Bot Web App Attack

Showing 1 to 15 of 666 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇺🇸 66.132.186.190

🇺🇸 40.119.32.47

🇮🇳 27.58.254.114

🇺🇸 216.25.89.66

🇮🇳 168.144.82.178

🇩🇪 167.94.146.64

🇻🇳 152.32.162.42

🇷🇺 95.79.57.221

🇮🇳 49.43.241.11

🇮🇩 36.92.140.209

🇺🇸 206.217.128.7

🇯🇵 180.15.159.130

🇩🇪 167.94.145.31

🇻🇳 160.30.20.178

🇮🇳 139.5.1.125

🇱🇹 81.30.98.144

🇳🇱 45.148.10.183

🇩🇿 41.111.178.165

🇨🇳 36.111.42.36

🇳🇱 20.160.86.7