JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 138.197.165.254

138.197.165.254 was found in our database!

This IP was reported 72 times. Confidence of Abuse is 100%: ?

100%

ISP	DigitalOcean, LLC
Usage Type	Data Center/Web Hosting/Transit
ASN	AS14061
Domain Name	digitalocean.com
Country	🇨🇦 Canada
City	Toronto, Ontario

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 138.197.165.254

Whois 138.197.165.254

IP Abuse Reports for 138.197.165.254:

This IP address has been reported a total of 72 times from 43 distinct sources. 138.197.165.254 was first reported on December 19th 2024, and the most recent report was 1 hour ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇳🇱 homeshowdomain.nl	2026-09-03 22:00:49 (1 hour ago)	Auto-ban: >3000 req/min op 2026-09-03	Web App Attack SSH Hacking
Anonymous	2026-09-03 21:43:40 (1 hour ago)	XSS Attempt	Hacking
🇫🇮 paissangroup	2026-09-03 20:59:51 (2 hours ago)	Multiple WAF Violations	Web App Attack
Anonymous	2026-09-03 18:13:24 (5 hours ago)	Blocked by FortiWeb WAF ML threat detection. ML probability: 99%, Country: CA, Attack patterns: Webs ... show more Blocked by FortiWeb WAF ML threat detection. ML probability: 99%, Country: CA, Attack patterns: Webshell probing, Cloud secrets probing show less	Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-09-03 01:34:46 (22 hours ago)	(mod_security) mod_security (id:210492) triggered by 138.197.165.254 (-): 1 in the last 300 secs; Po ... show more (mod_security) mod_security (id:210492) triggered by 138.197.165.254 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Sep 02 21:34:41.854830 2026] [security2:error] [pid 12512:tid 12512] [client 138.197.165.254:38434] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "arnoldwell.com"] [uri "/.git/config"] [unique_id "apjOsUmg5dB3Gy57U19KpQAAAA4"] show less	Brute-Force Bad Web Bot Web App Attack
🇸🇬 Cloudkul Cloudkul	2026-09-03 01:02:45 (22 hours ago)	Attempted Not Found (404 status code) requests on our application, more than 30% of their total requ ... show more Attempted Not Found (404 status code) requests on our application, more than 30% of their total requests. show less	Brute-Force Web App Attack
🇺🇸 TPI-Abuse	2026-09-03 01:01:00 (22 hours ago)	(mod_security) mod_security (id:210492) triggered by 138.197.165.254 (-): 1 in the last 300 secs; Po ... show more (mod_security) mod_security (id:210492) triggered by 138.197.165.254 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Sep 02 21:00:53.108770 2026] [security2:error] [pid 21797:tid 21797] [client 138.197.165.254:52260] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "armorcorp.gulftelecom.com"] [uri "/.git/config"] [unique_id "apjGxQl3LoabYLNTQ5yQvAAAAAw"] show less	Brute-Force Bad Web Bot Web App Attack
🇸🇬 securejdprop	2026-09-03 00:59:25 (22 hours ago)	This IP was detected by CrowdSec triggering crowdsecurity/vpatch-git-config.	Hacking
🇺🇸 TPI-Abuse	2026-09-03 00:24:11 (23 hours ago)	(mod_security) mod_security (id:210492) triggered by 138.197.165.254 (-): 1 in the last 300 secs; Po ... show more (mod_security) mod_security (id:210492) triggered by 138.197.165.254 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Sep 02 20:24:06.356111 2026] [security2:error] [pid 17173:tid 17173] [client 138.197.165.254:44708] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "armadillosigns.com"] [uri "/.git/config"] [unique_id "api-JtZdPQSxV5yKKpYKLQAAABc"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-09-02 23:58:30 (23 hours ago)	(mod_security) mod_security (id:210492) triggered by 138.197.165.254 (-): 1 in the last 300 secs; Po ... show more (mod_security) mod_security (id:210492) triggered by 138.197.165.254 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Sep 02 19:58:24.841786 2026] [security2:error] [pid 22553:tid 22553] [client 138.197.165.254:42538] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "arkqp.kreweofhyatt.com"] [uri "/.git/config"] [unique_id "api4IHLZDCHKWcxtf_K3hQAAAAA"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 wordpresshosting.solutions	2026-09-02 23:47:32 (23 hours ago)	Web app vulnerability scanning detected. Evidence: 138.197.165.254 - - [02/Sep/2026:23:47:32 +0000] ... show more Web app vulnerability scanning detected. Evidence: 138.197.165.254 - - [02/Sep/2026:23:47:32 +0000] "GET /.git/config HTTP/1.1" 404 6226 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.0.0 Safari/537.36" 138.197.165.254 - - [02/Sep/2026:23:47:32 +0000] "GET /.git/config HTTP/1.1" 404 6226 "http://arkfaucet.com/.git/config" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.0.0 Safari/537.36" show less	Web App Attack
🇳🇱 Site.eu	2026-09-02 23:25:46 (1 day ago)	Excessive multi-domain requests	Brute-Force
🇺🇸 TPI-Abuse	2026-09-02 23:20:54 (1 day ago)	(mod_security) mod_security (id:210492) triggered by 138.197.165.254 (-): 1 in the last 300 secs; Po ... show more (mod_security) mod_security (id:210492) triggered by 138.197.165.254 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Sep 02 19:20:50.143858 2026] [security2:error] [pid 11220:tid 11280] [client 138.197.165.254:33402] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "arizonasolutionsgroup.com"] [uri "/.git/config"] [unique_id "apivUv1PFYKXcBTRhO5frwAAAJM"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-09-02 19:03:40 (1 day ago)	(mod_security) mod_security (id:210492) triggered by 138.197.165.254 (-): 1 in the last 300 secs; Po ... show more (mod_security) mod_security (id:210492) triggered by 138.197.165.254 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Sep 02 15:03:33.851153 2026] [security2:error] [pid 2706:tid 2706] [client 138.197.165.254:60042] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "arellasoc.com"] [uri "/.git/config"] [unique_id "aphzBfkT4aayCxL_FvydaAAAAAY"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-09-02 18:43:52 (1 day ago)	(mod_security) mod_security (id:210492) triggered by 138.197.165.254 (-): 1 in the last 300 secs; Po ... show more (mod_security) mod_security (id:210492) triggered by 138.197.165.254 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Sep 02 14:43:45.483551 2026] [security2:error] [pid 23207:tid 23207] [client 138.197.165.254:40988] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "areafinancieratf.com"] [uri "/.git/config"] [unique_id "aphuYQgRs-_dglA1NMa8zwAAAA8"] show less	Brute-Force Bad Web Bot Web App Attack

Showing 1 to 15 of 72 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇵🇱 194.180.48.39

🇨🇳 118.145.82.180

🇺🇸 216.254.254.253

🇧🇩 114.130.98.180

🇺🇸 108.225.139.131

🇺🇸 45.61.187.220

🇰🇷 211.218.157.166

🇨🇳 183.16.162.39

🇺🇸 172.172.186.3

🇨🇳 122.237.16.225

🇨🇳 118.196.86.191

🇬🇧 91.230.225.240

🇸🇪 185.246.130.20

🇮🇩 103.99.214.214

🇱🇹 77.90.185.107

🇳🇱 45.148.10.120

🇹🇼 35.194.245.125

🇺🇸 209.85.210.230

🇺🇸 167.153.182.8

🇺🇸 129.239.10.180