JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 138.197.35.59

138.197.35.59 was found in our database!

This IP was reported 59 times. Confidence of Abuse is 100%: ?

100%

ISP	DigitalOcean, LLC
Usage Type	Data Center/Web Hosting/Transit
ASN	AS14061
Domain Name	digitalocean.com
Country	🇺🇸 United States of America
City	Clifton, New Jersey

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 138.197.35.59

Whois 138.197.35.59

IP Abuse Reports for 138.197.35.59:

This IP address has been reported a total of 59 times from 45 distinct sources. 138.197.35.59 was first reported on February 18th 2025, and the most recent report was 3 hours ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇫🇷 masterguru	2026-10-17 07:17:52 (3 hours ago)	Restricted File Access Attempt. Matched phrase ".git/" at REQUEST_FILENAME. (930130-196)	Hacking Web App Attack
🇺🇸 TPI-Abuse	2026-10-17 07:12:39 (3 hours ago)	(mod_security) mod_security (id:210492) triggered by 138.197.35.59 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:210492) triggered by 138.197.35.59 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 17 03:12:35.685267 2026] [security2:error] [pid 10074:tid 10074] [client 138.197.35.59:56762] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "dyckia.fritsknuf.com"] [uri "/.env"] [unique_id "atMf4-lM-YJh-DdSENykDgAAAA0"] show less	Brute-Force Bad Web Bot Web App Attack
🇩🇪 Hary74656	2026-10-17 06:16:14 (4 hours ago)	Fail2Ban on schani.hostmi.at: jail=apache-instablock, failures=1. [client 138.197.35.59] [realclient ... show more Fail2Ban on schani.hostmi.at: jail=apache-instablock, failures=1. [client 138.197.35.59] [realclient 138.197.35.59] [17/Oct/2026:08:16:13 +0200] [vhost schani.hostmi.at] 403 "GET /.env HTTP/2.0" show less	Web App Attack
🇺🇸 TPI-Abuse	2026-10-17 06:14:24 (4 hours ago)	(mod_security) mod_security (id:210492) triggered by 138.197.35.59 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:210492) triggered by 138.197.35.59 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 17 02:14:17.845454 2026] [security2:error] [pid 14143:tid 14143] [client 138.197.35.59:36086] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "dwci.winformation.us"] [uri "/.env"] [unique_id "atMSOUC9u0nVXn7j7_ruhwAAAAY"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 Epimetheus	2026-10-17 05:38:04 (5 hours ago)	Unauthorized access attempts: [GET] /vendor/laravel-filemanager/js/script.js [GET] /wordpress [GET] ... show more Unauthorized access attempts: [GET] /vendor/laravel-filemanager/js/script.js [GET] /wordpress [GET] /new [GET] /blog [GET] /.git/config [GET] /wp [GET] /demo [GET] /public/vendor/laravel-filemanager/js/script.js [GET] /debug/default/index [GET] /.env [POST] /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php [GET] /_ignition/execute-solution UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36 show less	Web App Attack
🇺🇦 URAN Publishing Service	2026-10-17 05:37:47 (5 hours ago)	[17/Oct/2026:08:37:46 +0300] -- 138.197.35.59 Ban reason: Scanner [SENSITIVE_FILES] \| Request: GET / ... show more [17/Oct/2026:08:37:46 +0300] -- 138.197.35.59 Ban reason: Scanner [SENSITIVE_FILES] \| Request: GET /.env HTTP/1.1 show less	Bad Web Bot Web App Attack
🇧🇪 taivas.nl	2026-10-17 05:32:11 (5 hours ago)	Bad_requests	Bad Web Bot
Anonymous	2026-10-17 05:23:46 (5 hours ago)	XSS Attempt	Hacking
Anonymous	2026-10-17 05:07:30 (5 hours ago)	Web application attack detected.	Web App Attack
🇳🇱 Nrbrtkls	2026-10-17 04:57:42 (5 hours ago)	Scanning for .env secrets files on Cloudflare-fronted site	Web App Attack
🇳🇱 Alt255	2026-10-17 04:56:01 (5 hours ago)	[ti-06al] Web exploit scanning: 1 suspicious requests detected by fail2ban jail apache-scanner. Exam ... show more [ti-06al] Web exploit scanning: 1 suspicious requests detected by fail2ban jail apache-scanner. Example: 138.197.35.59 - - [17/Oct/2026:06:55:45 +0200] "GET /.env HTTP/2.0" 404 1338 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" ... show less	Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-10-17 04:54:00 (6 hours ago)	(mod_security) mod_security (id:210492) triggered by 138.197.35.59 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:210492) triggered by 138.197.35.59 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 17 00:53:53.792036 2026] [security2:error] [pid 14438:tid 14438] [client 138.197.35.59:35894] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "dusty-buggz.aisoftwaretools.com"] [uri "/.env"] [unique_id "atL_Ybs1xcca49GQMaBpZgAAAAY"] show less	Brute-Force Bad Web Bot Web App Attack
🇫🇷 Coco Bongo	2026-10-17 04:50:25 (6 hours ago)	138.197.35.59 [redacted].dns.[redacted] (14061-DigitalOcean, LLC United States Clifton) - - [17/Oct/ ... show more 138.197.35.59 [redacted].dns.[redacted] (14061-DigitalOcean, LLC United States Clifton) - - [17/Oct/2026:06:50:09 +0200] "POST /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1" 404 181 "-" "Mozil ... show less	Bad Web Bot Web App Attack
🇩🇪 ghostwarriors	2026-10-17 04:50:11 (6 hours ago)	Webpage scraping	Brute-Force Bad Web Bot Web App Attack
🇪🇸 robotstxt	2026-10-17 04:38:24 (6 hours ago)	138.197.35.59 - - [17/Oct/2026:04:37:47 +0000] "POST /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin ... show more 138.197.35.59 - - [17/Oct/2026:04:37:47 +0000] "POST /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/2.0" 403 13106 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" "-" edge="138.197.35.59" 138.197.35.59 - - [17/Oct/2026:04:37:47 +0000] "POST / HTTP/2.0" 403 17125 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" "-" edge="138.197.35.59" 138.197.35.59 - - [17/Oct/2026:04:37:47 +0000] "POST / HTTP/2.0" 403 17028 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" "-" edge="138.197.35.59" 138.197.35.59 - - [17/Oct/2026:04:37:48 +0000] "POST /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/2.0" 403 13138 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" "-" edge="138.197.35.59" 138.197.35.59 - - [17/Oct/20 ... show less	Web App Attack

Showing 1 to 15 of 59 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇧🇪 207.175.106.239

🇺🇦 194.44.57.95

🇺🇸 172.252.206.202

🇰🇷 112.184.47.98

🇳🇱 109.160.32.150

🇮🇩 103.156.164.0

🇷🇴 80.94.92.234

🇺🇸 74.82.47.13

🇺🇸 52.168.141.47

🇺🇸 45.207.183.173

🇳🇱 45.148.10.151

🇧🇷 45.5.252.250

🇮🇱 40.223.221.98

🇺🇸 40.223.128.89

🇷🇺 188.227.111.138

🇺🇸 172.252.107.106

🇺🇸 172.121.131.234

🇨🇳 129.211.204.19

🇰🇷 125.182.93.87

🇺🇸 109.105.209.74