JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 138.197.20.253

138.197.20.253 was found in our database!

This IP was reported 208 times. Confidence of Abuse is 15%: ?

15%

ISP	DigitalOcean, LLC
Usage Type	Data Center/Web Hosting/Transit
ASN	AS14061
Domain Name	digitalocean.com
Country	🇺🇸 United States of America
City	Clifton, New Jersey

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 138.197.20.253

Whois 138.197.20.253

IP Abuse Reports for 138.197.20.253:

This IP address has been reported a total of 208 times from 60 distinct sources. 138.197.20.253 was first reported on April 27th 2023, and the most recent report was 1 month ago.

Old Reports: The most recent abuse report for this IP address is from 1 month ago . It is possible that this IP is no longer involved in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇺🇸 MPL	2026-05-07 09:04:16 (1 month ago)	tcp/8883	Port Scan
🇬🇧 PeravixGroup	2026-05-07 08:34:41 (1 month ago)	Honeypot detection: Web application scanning / reconnaissance attempt on port 8443. Severity: LOW. A ... show more Honeypot detection: Web application scanning / reconnaissance attempt on port 8443. Severity: LOW. Aaran.cloud show less	Port Scan Bad Web Bot
🇩🇪 AS213449.net	2026-05-07 08:24:19 (1 month ago)	05/07/2026-10:24:12.322078 src=138.197.20.253 dst=89.144.63.18:3306 proto=6 msg=ET SCAN Suspicious i ... show more 05/07/2026-10:24:12.322078 src=138.197.20.253 dst=89.144.63.18:3306 proto=6 msg=ET SCAN Suspicious inbound to mySQL port 3306 show less	SQL Injection
🇫🇷 EDSL	2026-05-07 08:00:59 (1 month ago)	[SRV-VPN1] Blocked by SysWarden Firewall (Web Attack Port 80)	Web App Attack Hacking Port Scan
🇷🇺 eugenemolotov.ru	2024-04-29 21:00:06 (2 years ago)	138.197.20.253 - - [29/Apr/2024:05:42:42 +0500] "GET /upl.php HTTP/1.1" 404 125 "-" "Mozilla/5.0" 13 ... show more 138.197.20.253 - - [29/Apr/2024:05:42:42 +0500] "GET /upl.php HTTP/1.1" 404 125 "-" "Mozilla/5.0" 138.197.20.253 - - [29/Apr/2024:05:42:44 +0500] "GET /1.php HTTP/1.1" 404 188 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36" 138.197.20.253 - - [29/Apr/2024:05:42:45 +0500] "GET /systembc/password.php HTTP/1.1" 404 188 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36" 138.197.20.253 - - [29/Apr/2024:05:42:45 +0500] "GET /password.php HTTP/1.1" 404 188 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36" 138.197.20.253 - - [29/Apr/2024:05:42:45 +0500] "GET /info.php HTTP/1.1" 404 188 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36" show less	Web App Attack
🇺🇸 gu-alvareza	2024-04-29 07:05:32 (2 years ago)	SystemBC.Botnet	DDoS Attack Hacking
🇦🇺 ozisp.com.au	2024-04-29 04:45:00 (2 years ago)	US_DigitalOcean,_<33>1714365899 [119:33:2] (http_inspect) UNESCAPED SPACE IN HTTP URI [Classificatio ... show more US_DigitalOcean,_<33>1714365899 [119:33:2] (http_inspect) UNESCAPED SPACE IN HTTP URI [Classification: Unknown Traffic] [Priority: 3] {TCP} 138.197.20.253:42150 show less	Hacking
🇫🇷 guillaume illien	2024-04-29 00:42:14 (2 years ago)	138.197.20.253 - - [29/Apr/2024:00:42:11 +0000] "GET / HTTP/1.1" 301 178 "-" "Mozilla/5.0 (Windows N ... show more 138.197.20.253 - - [29/Apr/2024:00:42:11 +0000] "GET / HTTP/1.1" 301 178 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36" 138.197.20.253 - - [29/Apr/2024:00:42:12 +0000] "GET /form.html HTTP/1.1" 301 178 "-" "curl/8.1.2" 138.197.20.253 - - [29/Apr/2024:00:42:12 +0000] "GET /upl.php HTTP/1.1" 301 178 "-" "Mozilla/5.0" 138.197.20.253 - - [29/Apr/2024:00:42:12 +0000] "GET /geoip/ HTTP/1.1" 301 178 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36" 138.197.20.253 - - [29/Apr/2024:00:42:13 +0000] "GET /1.php HTTP/1.1" 301 178 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36" 138.197.20.253 - - [29/Apr/2024:00:42:13 +0000] "GET /bundle.js HTTP/1.1" 301 178 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36" 138.197.20.253 - - ... show less	Hacking Brute-Force Web App Attack SSH
🇩🇪 vtibi	2024-04-28 17:02:34 (2 years ago)	138.197.20.253 - - [28/Apr/2024:19:02:33 +0200] "GET /form.html HTTP/1.1" 404 341 "-" "curl/8.1.2" 1 ... show more 138.197.20.253 - - [28/Apr/2024:19:02:33 +0200] "GET /form.html HTTP/1.1" 404 341 "-" "curl/8.1.2" 138.197.20.253 - - [28/Apr/2024:19:02:33 +0200] "GET /upl.php HTTP/1.1" 404 341 "-" "Mozilla/5.0" 138.197.20.253 - - [28/Apr/2024:19:02:34 +0200] "GET /geoip/ HTTP/1.1" 404 341 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36" 138.197.20.253 - - [28/Apr/2024:19:02:34 +0200] "GET /1.php HTTP/1.1" 404 341 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36" ... show less	Web App Attack
🇩🇪 _ArminS_	2024-04-28 14:58:36 (2 years ago)	WEB-Scan 55379:80 detected 2024.04.28 16:58:36 blocked until 2024.06.17 10:01:23	Port Scan
🇫🇷 Kraften	2024-04-28 14:48:19 (2 years ago)	Try to find web path ...	Web App Attack
🇩🇪 QUADEMU Abuse Dpt	2024-04-28 14:45:07 (2 years ago)	[New] Noxious/Nuisible/вредоносный Host.	Port Scan Exploited Host
🇧🇷 diego	2024-04-28 14:31:25 (2 years ago)	Events: TCP SYN Discovery or Flooding, Seen 5 times in the last 10800 seconds	DDoS Attack
🇺🇸 MPL	2024-04-28 14:30:18 (2 years ago)	tcp/80	Port Scan
🇩🇪 Fusl	2023-10-12 11:55:20 (2 years ago)	received unsolicited smtp data stream: Received: by aviso77444115.actualizaciondedocumentos.com (Pos ... show more received unsolicited smtp data stream: Received: by aviso77444115.actualizaciondedocumentos.com (Postfix, from userid 0) id 13A5F458A4; Thu, 12 Oct 2023 11:52:06 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gob.mx; s=mail; t=1697111526; bh=Uyn1UQolUDs4K0Imrk8Yj7jiUsVzEKsZsqgqdHuh6Fg=; h=Subject:From:To:Date; b=dQlVu0G1NpSN/+ABNqYzdKdwsvkR8Y95Ow/t6j4VYvTW8JzryBD+8FOuRIHQlpndk 9bq4yV++NDmK72r0M8jLP5+mmY+Wc6HzZa51pMZo63lJqBumgqJKYuhq/hxlkdYrxI fejGkOW3OgMe4fe+X5Noff2/sxzQbVTt4Jayw1Hw8fcArgxp05pweNCCnwV79AMAHt Wyp3+HJc5Q/UBN4tWMg2ymEcZq9lFk7D3+uxb3z3d10ZTfa43561q8zqbxuuYSXnCi Dd70Xy1GdQCxSokq+Kh3tS9YvOZJ8V1h//t06Ko8R8splSQusZSfpE42zG89+Qf6Zq eWVkSWo4SXAsw== content-type: text/html Subject: Cierre de Proceso Administrativo - 12/10/2023 MIME-Version: 1.0 X-Priority: 1 X-MSmail-Priority: High Priority: urgent Importance: high X-Mailer: Microsoft Office Outlook, Build 11.0.5510 X-Newsreader: Microsoft Outlook Express 6.00.2800.140 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.28 show less	Email Spam

Showing 1 to 15 of 208 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇮🇩 103.67.78.56

🇺🇸 147.185.132.76

🇨🇳 123.117.152.61

🇭🇰 118.193.32.119

🇮🇩 103.67.78.49

🇻🇳 58.186.20.101

🇬🇧 2a06:4880:c000::da

🇳🇱 212.192.240.10

🇻🇪 190.142.97.50

🇳🇱 176.65.139.56

🇮🇩 103.67.78.251

🇮🇩 103.67.78.217

🇮🇩 103.67.78.216

🇲🇾 49.124.205.169

🇹🇷 46.20.146.40

🇨🇳 42.234.194.84

🇳🇴 217.79.117.138

🇺🇸 216.25.89.104

🇹🇳 197.5.145.102

🇲🇩 178.175.129.44