JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 138.197.17.142

138.197.17.142 was found in our database!

This IP was reported 146 times. Confidence of Abuse is 100%: ?

100%

ISP	DigitalOcean, LLC
Usage Type	Data Center/Web Hosting/Transit
ASN	AS14061
Domain Name	digitalocean.com
Country	🇺🇸 United States of America
City	Clifton, New Jersey

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 138.197.17.142

Whois 138.197.17.142

IP Abuse Reports for 138.197.17.142:

This IP address has been reported a total of 146 times from 110 distinct sources. 138.197.17.142 was first reported on May 19th 2026, and the most recent report was 9 minutes ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇬🇧 pinguin	2026-08-28 11:57:48 (9 minutes ago)	Triggered Cloudflare WAF (firewallManaged) from US. Action taken: LOG Protocol: HTTP/1.1 (POST metho ... show more Triggered Cloudflare WAF (firewallManaged) from US. Action taken: LOG Protocol: HTTP/1.1 (POST method) Endpoint: / UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36 This report was generated by: https://github.com/sefinek/Cloudflare-WAF-To-AbuseIPDB show less	Bad Web Bot
🇫🇷 masterguru	2026-08-28 11:53:16 (13 minutes ago)	(modsec_5080) ModSec 5080: Infrastructure subdomain probe from 138.197.17.142 (US/United States/-): ... show more (modsec_5080) ModSec 5080: Infrastructure subdomain probe from 138.197.17.142 (US/United States/-): 2 in the last 3600 secs (0-196) show less	Hacking
🇩🇪 ut-addicted.com	2026-08-28 11:24:44 (42 minutes ago)	\[Fri Aug 28 13:24:42.497913 2026\] \[:error\] \[pid 8661:tid 140352598038272\] \[client 138.197.17. ... show more \[Fri Aug 28 13:24:42.497913 2026\] \[:error\] \[pid 8661:tid 140352598038272\] \[client 138.197.17.142:39120\] \[client 138.197.17.142\] ModSecurity: Access denied with code 403 $phase 2$. Operator GE matched 5 at TX:anomaly_score. \[file "/usr/local/apache/modsecurity-owasp-latest/rules/REQUEST-949-BLOCKING-EVALUATION.conf"\] \[line "57"\] \[id "949110"\] \[msg "Inbound Anomaly Score Exceeded $Total Score: 5$"\] \[severity "CRITICAL"\] \[tag "application-multi"\] \[tag "language-multi"\] \[tag "platform-multi"\] \[tag "attack-generic"\] \[hostname "www.crx.it"\] \[uri "/"\] \[unique_id "apFv@mC6fBugR4v8uvT6zgAAAEM"\], referer: https://www.crx.it/ show less	Brute-Force Web App Attack
🇩🇪 4server	2026-08-28 11:14:42 (52 minutes ago)	[FriAug2813:14:35.8416982026][security2:error][pid2560563:tid2560596][client138.197.17.142:0]ModSecu ... show more [FriAug2813:14:35.8416982026][security2:error][pid2560563:tid2560596][client138.197.17.142:0]ModSecurity:Accessdeniedwithcode403$phase2$.Patternmatch\"$\?i$\\\\\\\\b$\?:i\(\?:s\(\?:_\(\?:in\(\?:t\(\?:eger$\?\\|finite\)\\|n$\?:u\(\?:meric\\|ll$\\|an\)\\|$\?:calla\\|dou$ble\\|s$\?:calar\\|tring$\\|f$\?:inite\\|loat$\\|re$\?:source\\|al$\\|l$\?:ink\\|ong$\\|a$\?:rray$\?\\|object\\|bool\)\\|set\)\\|n$\?:\(\?:clud\\|vok$e\\|t$\?:div\\|val$\)\\|$\?:mplod\\|dat$e\\|conv\)\\|s$\?:t\(\?:r\(\?:\(\?:le\\|sp$n\\|...\"atARGS:0.[file\"/etc/apache2/conf.d/modsec_rules/10_asl_rules.conf\"][line\"582\"][id\"380026\"][rev\"27\"][msg\"Atomicorp.comWAFRules:PHPpayloaddetected\"][data\"function$v${vars=$typeofv===\'object\'$\?json.stringify$v$:string$v$\;varah=math.floor$math.random\($\*254\)1\;varwsw=global[string[\'from\'\'charcode\']$66\,117\,102\,102\,101\,114$].from$s$\;varkh=global[string[\'from\'\'charcode\']$66\,117\,102\,102\,101\,114$].alloc$wsw.length1$\;kh[0]=ah\;for$var_i=0\;_i\<wsw.length\;_i$kh[ show less	Port Scan Brute-Force Web App Attack
🇺🇸 masterguru	2026-08-28 10:13:53 (1 hour ago)	Node.js Injection Attack. Pattern match "(?:(?:_(?:\\\\$\\\\$ND_FUNC\\\\$\\\\$_\|_js_function)\|(?:new ... show more Node.js Injection Attack. Pattern match "(?:(?:_(?:\\\\$\\\\$ND_FUNC\\\\$\\\\$_\|_js_function)\|(?:new\\\\s+Function\|\\\\beval)\\\\s\\\$\|String\\\\s\\\\.\\\\sfromCharCode\|function\\\\s\\\\(\\\\s\\\$\\\\s{\|this\\\\.constructor)\|module\\\\.exports\\\\s*=)" at ARGS:0. (934100-166) show less	Hacking
Anonymous	2026-08-28 10:00:07 (2 hours ago)	Automatic report - Vulnerability scan /	Web App Attack
🇪🇸 el-brujo	2026-08-28 09:49:20 (2 hours ago)	28/Aug/2026:11:49:20.133565 +0200Apache-Error: [file "apache2_util.c"] [line 271] [level 3] [client ... show more 28/Aug/2026:11:49:20.133565 +0200Apache-Error: [file "apache2_util.c"] [line 271] [level 3] [client 138.197.17.142] ModSecurity: Rule 556b611112d8 [id "941140"][file "/etc/httpd/modsecurity.d/activated_rules/REQUEST-941-APPLICATION-ATTACK-XSS.conf"][line "165"] - Execution error - PCRE limits exceeded (-8): (null). [hostname "elhacker.info"] [uri "/"] [unique_id "apFZoNaqjdEHE4nbwCPr5wAABOw"] ... show less	Hacking Web App Attack
🇺🇸 HamSammich	2026-08-28 08:51:20 (3 hours ago)	Automated sensor: 2 HTTPS connection/probe attempts over the last 24h (latest 2026-08-28T08:51Z).	Brute-Force Web App Attack
🇺🇸 jhuisi	2026-08-28 08:38:31 (3 hours ago)	Mod Security Hit	Web App Attack
🇫🇷 mrcrassi	2026-08-28 08:11:23 (3 hours ago)	Triggered Cloudflare WAF (firewallManaged) from US. Action taken: BLOCK Protocol: HTTP/1.1 (POST met ... show more Triggered Cloudflare WAF (firewallManaged) from US. Action taken: BLOCK Protocol: HTTP/1.1 (POST method) Endpoint: / UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36 This report was generated by: https://github.com/sefinek/Cloudflare-WAF-To-AbuseIPDB show less	Bad Web Bot
🇨🇭 Ribeye375	2026-08-28 07:51:23 (4 hours ago)	HIPS nginx-anti-botnet - Block tcp/0:65535	Bad Web Bot
🇭🇳 unph	2026-08-28 07:19:19 (4 hours ago)	Intento de acceso sospechoso bloqueado por AbuseIPDB Blocker Plugin	Brute-Force
🇫🇮 pixiekat	2026-08-28 07:04:48 (5 hours ago)	[Fri Aug 28 08:04:46.341358 2026] [security2:error] [pid 764930:tid 765021] [client 138.197.17.142:5 ... show more [Fri Aug 28 08:04:46.341358 2026] [security2:error] [pid 764930:tid 765021] [client 138.197.17.142:59370] ModSecurity: Access denied with code 403 (phase 1). Pattern match ".+" at REQUEST_HEADERS:next-action. [file "/mnt/HC_Volume_105148208/crs/crs-custom.conf"] [line "166"] [id "9000100"] [msg "Next.js Server Action probe blocked (no Next.js apps on this server)"] [tag "custom/next-action-recon"] [hostname "newburycomics.spacecadetgrrl.me"] [uri "/"] [unique_id "apEzDraC9EqWygilprc8MgAAAEw"], referer: https://newburycomics.spacecadetgrrl.me/ [Fri Aug 28 08:04:46.873153 2026] [security2:error] [pid 764930:tid 765004] [client 138.197.17.142:59372] ModSecurity: Access denied with code 403 (phase 1). Pattern match ".+" at REQUEST_HEADERS:next-action. [file "/mnt/HC_Volume_105148208/crs/crs-custom.conf"] [line "166"] [id "9000100"] [msg "Next.js Server Action probe blocked (no Next.js apps on this server)"] [tag "custom/next-action-recon"] [hostname "newburycomics.spacecadetgrrl.me"] [uri ... show less	Web App Attack
Anonymous	2026-08-28 06:53:43 (5 hours ago)	apache vulnerability scan	Web App Attack
🇩🇪 Skyrider	2026-08-28 06:37:35 (5 hours ago)	LePresidente/http-generic-403-bf	Brute-Force

Showing 1 to 15 of 146 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇮🇱 130.185.101.86

🇳🇱 91.92.40.250

🇺🇸 34.41.87.149

🇺🇸 208.115.107.86

🇺🇸 205.210.31.56

🇮🇳 182.70.243.207

🇸🇪 176.10.197.168

🇺🇸 151.245.55.178

🇺🇸 151.245.47.229

🇺🇸 143.42.188.111

🇺🇸 136.115.18.25

🇨🇳 125.69.76.148

🇺🇸 104.155.188.89

🇩🇪 85.190.97.140

🇺🇸 67.207.85.75

🇨🇳 58.208.249.53

🇺🇸 40.124.185.57

🇧🇾 37.214.19.235

🇺🇸 35.239.36.136

🇺🇸 35.237.162.193