This IP address has been reported a total of
10
times from
10 distinct
sources.
138.197.204.147 was first reported on
September 30th 2026 , and the most recent report was
3 days ago Germany
with 5
reports;
Belgium
with 1
report;
France
with 1
report.
The most common categories in these recent reports were:
Web App Attack
8
times;
Bad Web Bot
3
times;
Brute-Force
3
times;
Port Scan
1
time;
Hacking
1
time;
Other
1
time.
Recent Reports
We have received reports of abusive activity from this IP address within the last week. It is
potentially still actively engaged in abusive activities.
Reporter
IoA Timestamp (UTC)
Comment
Categories
🇧🇪
boxed-it
2026-10-01 20:30:31
(3 days ago)
GET /wp-login.php (Tarpitted for 1d15h8m29s, wasted 8.06MB)
Web App Attack
🇩🇪
ghostwarriors
2026-09-30 12:50:09
(4 days ago)
Attempts against non-existent wp-login
Brute-Force
Web App Attack
🇩🇪
yitzhaq
2026-09-30 12:35:06
(4 days ago)
138.197.204.147 - - [30/Sep/2026:07:24:33 +0200] "GET /wp-login.php HTTP/1.1" 301 593 "-" "Mozilla/5 ...
show more
138.197.204.147 - - [30/Sep/2026:07:24:33 +0200] "GET /wp-login.php HTTP/1.1" 301 593 "-" "Mozilla/5.0"
138.197.204.147 - - [30/Sep/2026:07:24:33 +0200] "GET /wp-login.php HTTP/1.1" 404 28328 "-" "Mozilla/5.0"
138.197.204.147 - - [30/Sep/2026:14:35:01 +0200] "POST /wp-json/batch/v1 HTTP/1.1" 301 563 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36"
138.197.204.147 - - [30/Sep/2026:14:35:02 +0200] "GET /wp-json/batch/v1 HTTP/1.1" 403 4488 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36"
138.197.204.147 - - [30/Sep/2026:14:35:02 +0200] "POST /?rest_route=/batch/v1 HTTP/1.1" 301 573 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36"
138.197.204.147 - - [30/Sep/2026:14:35:03 +0200] "GET /?rest_route=/batch/v1 HTTP/1.1" 403 4488 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0
show less
Web App Attack
Hacking
🇵🇱
Budyn
2026-09-30 05:46:41
(4 days ago)
Automated threat detected by Budyn Honeypot Sinkhole. Attack type: WP Path Scanning (Recon). Malicio ...
show more
Automated threat detected by Budyn Honeypot Sinkhole. Attack type: WP Path Scanning (Recon). Malicious scanner triggered a security trap targeting emulated vulnerabilities. Evidence: HOST: sweetpuddingtrap.xyz | URI: /wp-login.php | UA: Mozilla/5.0 | BODY: [Empty / GET Request]
show less
Bad Web Bot
Web App Attack
🇩🇪
jasperedv.de
2026-09-30 05:42:26
(4 days ago)
Apache Login - Brutforcing
Web App Attack
Brute-Force
🇮🇩
Burayot
2026-09-30 05:38:18
(4 days ago)
LF_MODSEC: (mod_security) mod_security (id:1000001) triggered by 138.197.204.147 (US/United States/- ...
show more
LF_MODSEC: (mod_security) mod_security (id:1000001) triggered by 138.197.204.147 (US/United States/-): 2 in the last 3600 secs
show less
Web App Attack
2026-09-30 05:31:18
(4 days ago)
Scanner hitting /wp-login.php on picsou.cloud (DIGITALOCEAN-138-197-0-0) — aaguard
Brute-Force
Port Scan
🇳🇱
ipoac.nl
2026-09-30 05:25:51
(4 days ago)
ipoac.nl:80 138.197.204.147 - - [30/Sep/2026:07:25:50 +0200] - "GET /wp-login.php HTTP/1.1" 403 1709 ...
show more
ipoac.nl:80 138.197.204.147 - - [30/Sep/2026:07:25:50 +0200] - "GET /wp-login.php HTTP/1.1" 403 1709 "-" "Mozilla/5.0"
show less
Bad Web Bot
🇩🇪
pltcldvlpr
2026-09-30 05:20:45
(4 days ago)
CMS/framework probe: 138.197.204.147 - - [30/Sep/2026:07:20:45 +0200] "GET /wp-login.php HTTP/1.1" 3 ...
show more
CMS/framework probe: 138.197.204.147 - - [30/Sep/2026:07:20:45 +0200] "GET /wp-login.php HTTP/1.1" 301 178 "-" "Mozilla/5.0" asn=14061 org="DigitalOcean, LLC" country=US
...
show less
Web App Attack
🇩🇪
EGP Abuse Dept
2026-09-30 05:19:34
(4 days ago)
Scanning for web/db/file exploits on www.elderhorst.nl
SQL Injection
Bad Web Bot
Web App Attack
Showing 1 to
10
of 10 reports
