JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 138.197.173.249

138.197.173.249 was found in our database!

This IP was reported 20 times. Confidence of Abuse is 37%: ?

37%

ISP	DigitalOcean, LLC
Usage Type	Data Center/Web Hosting/Transit
ASN	AS14061
Domain Name	digitalocean.com
Country	🇨🇦 Canada
City	Toronto, Ontario

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 138.197.173.249

Whois 138.197.173.249

IP Abuse Reports for 138.197.173.249:

This IP address has been reported a total of 20 times from 16 distinct sources. 138.197.173.249 was first reported on May 20th 2021, and the most recent report was 6 days ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇦🇺 screwlooseit.com.au	2026-06-19 05:06:29 (6 days ago)	Blocked by CSF 13 firewall - Rule: WPLOGIN CA/Canada/-	Web App Attack
🇩🇪 Axel	2026-06-18 22:19:46 (1 week ago)	[2026-06-18 22:19:46 UTC] Honeypot Web Admin connection attempt \| AXFRA HONEYPOT	Web App Attack
🇺🇸 drewf.ink	2026-06-18 21:41:14 (1 week ago)	[21:41] Port scanning. Port(s) scanned: TCP/3306	Port Scan
🇺🇸 TPI-Abuse	2026-05-29 04:37:09 (3 weeks ago)	(mod_security) mod_security (id:210492) triggered by 138.197.173.249 (-): 1 in the last 300 secs; Po ... show more (mod_security) mod_security (id:210492) triggered by 138.197.173.249 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri May 29 00:37:03.761129 2026] [security2:error] [pid 7618:tid 7618] [client 138.197.173.249:52478] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "192.64.150.117"] [uri "/.env"] [unique_id "ahkX7zGaSyXNWN9R-DA16gAAABQ"] show less	Brute-Force Bad Web Bot Web App Attack
🇫🇷 Baking333	2026-05-28 05:29:53 (4 weeks ago)	[redacted] 138.197.173.249 - - [28/May/2026:06:29:52 +0100] "GET /[redacted] HTTP/1.1" 307 379 "-" " ... show more [redacted] 138.197.173.249 - - [28/May/2026:06:29:52 +0100] "GET /[redacted] HTTP/1.1" 307 379 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0 Safari/537.36" [redacted] 138.197.173.249 - - [28/May/2026:06:29:51 +0100] "GET /.env HTTP/1.1" 307 379 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0 Safari/537.36" show less	Bad Web Bot Web App Attack
🇳🇱 Savvii	2026-05-26 23:23:02 (4 weeks ago)	20 attempts against mh-misbehave-ban on ethyl	Brute-Force Bad Web Bot Web App Attack
🇫🇷 Baking333	2026-05-26 23:22:58 (4 weeks ago)	[redacted] 138.197.173.249 - - [27/May/2026:00:22:57 +0100] "GET /[redacted] HTTP/1.1" 307 379 "-" " ... show more [redacted] 138.197.173.249 - - [27/May/2026:00:22:57 +0100] "GET /[redacted] HTTP/1.1" 307 379 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0 Safari/537.36" [redacted] 138.197.173.249 - - [27/May/2026:00:22:57 +0100] "GET /.env HTTP/1.1" 307 379 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0 Safari/537.36" show less	Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-05-26 22:52:02 (4 weeks ago)	(mod_security) mod_security (id:210492) triggered by 138.197.173.249 (-): 1 in the last 300 secs; Po ... show more (mod_security) mod_security (id:210492) triggered by 138.197.173.249 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue May 26 18:51:57.004384 2026] [security2:error] [pid 10327:tid 10414] [client 138.197.173.249:56614] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "192.64.150.123"] [uri "/.env"] [unique_id "ahYkDWpaQU4ChpQNAddOQwAAAVU"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 MPL	2026-05-21 03:11:45 (1 month ago)	tcp/8086 (2 or more attempts)	Port Scan
🇬🇧 gbzret4d	2026-05-21 02:42:10 (1 month ago)	Honeypot [uk-production01]: HTTP/1.1 request on 6936 GET / User-Agent: Mozilla/5.0 (X11; Linux x86_ ... show more Honeypot [uk-production01]: HTTP/1.1 request on 6936 GET / User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate; 6936 [2] TCP show less	Hacking Bad Web Bot
🇨🇳 ThreatBook.io	2025-04-02 00:41:43 (1 year ago)	ThreatBook Intelligence: cdn more details on http://threatbook.io/ip/138.197.173.249 2025-04-01 10:0 ... show more ThreatBook Intelligence: cdn more details on http://threatbook.io/ip/138.197.173.249 2025-04-01 10:06:37 /favicon.ico 2025-04-01 10:06:37 / show less	Web App Attack
🇩🇪 David Ferneding	2025-04-01 18:33:06 (1 year ago)	Blocked by UFW (TCP on 5000) Source port: 61014 TTL: 240 Packet length: 44 TOS: 0x00 This report (f ... show more Blocked by UFW (TCP on 5000) Source port: 61014 TTL: 240 Packet length: 44 TOS: 0x00 This report (for 138.197.173.249) was generated by: https://github.com/sefinek/UFW-AbuseIPDB-Reporter show less	Port Scan
🇺🇸 MPL	2025-04-01 18:30:53 (1 year ago)	tcp/4782 (2 or more attempts)	Port Scan
🇺🇸 RAP	2025-04-01 02:25:12 (1 year ago)	2025-04-01 02:25:12 UTC Unauthorized activity to TCP port 3306.	Port Scan
🇺🇸 Cyber Crusader	2025-03-31 18:56:16 (1 year ago)	Hundreds of Attempts (at least) to Connect to and Access Firewall Ports	Port Scan Hacking Brute-Force

Showing 1 to 15 of 20 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇫🇷 95.111.234.72

🇸🇬 8.222.228.141

🇨🇭 104.251.180.164

🇭🇰 103.100.209.142

🇨🇳 59.61.184.204

🇲🇾 49.124.151.64

🇰🇷 47.80.62.251

🇨🇳 36.99.46.101

🇻🇳 14.225.217.138

🇭🇰 8.218.154.243

🇭🇰 8.217.160.32

🇭🇰 8.217.79.101

🇵🇰 202.141.237.36

🇱🇹 188.69.225.188

🇮🇳 122.184.124.46

🇨🇳 117.48.216.110

🇻🇳 103.77.215.165

🇫🇷 85.217.140.11

🇨🇳 47.102.134.93

🇺🇸 47.77.206.8