JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

138.199.142.68

Recent Activity

Abuse confidence score ?

47% Elevated

113 reports

50 reporters · latest 2 days ago

ISP	Hetzner Online GmbH
Usage Type	Data Center/Web Hosting/Transit
ASN	AS24940
Hostname(s)	static.68.142.199.138.clients.your-server.de
Domain Name	hetzner.com
Country	🇩🇪 Germany
City	Falkenstein, Saxony

ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report Whois

Reports Activity

Example preview

Report Categories (Last 60 Days)

Example preview

Top Reporter Countries (Last 60 Days)

Example preview

Account required for the enhanced features Log in Sign up

IP Abuse Reports for 138.199.142.68

Export CSV

This IP address has been reported a total of 113 times from 50 distinct sources. 138.199.142.68 was first reported on December 15th 2025, and the most recent report was 2 days ago. In the last 60 days, the top reporter locations were: United States of America with 10 reports; France with 8 reports; Greece with 6 reports. The most common categories in these recent reports were: Hacking 12 times; Port Scan 12 times; Bad Web Bot 11 times; Web App Attack 11 times; SQL Injection 8 times; Other 8 times.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇫🇷 cityhunter_rhone	2026-10-17 22:06:10 (2 days ago)	Fail2Ban offender in jail [recidive] — 1 total attempts — tracked by mercurius-guide.com security sy ... show more Fail2Ban offender in jail [recidive] — 1 total attempts — tracked by mercurius-guide.com security system. show less	SSH Brute-Force
🇬🇷 setupgr	2026-10-17 21:28:48 (2 days ago)	(mod_security) mod_security (id:11000011) triggered by 138.199.142.68 (DE/Germany/Saxony/Falkenstein ... show more (mod_security) mod_security (id:11000011) triggered by 138.199.142.68 (DE/Germany/Saxony/Falkenstein/-/[AS24940 Hetzner Online GmbH]): 1 in the last 86400 secs (CF_ENABLE); Ports: *; Direction: inout; Trigger: LF_MODSEC; Logs: [Sun Oct 18 00:28:43.819737 2026] [security2:error] [pid 2492:tid 2584] [remote 138.199.142.68:36640] ModSecurity: Access denied with code 406 (phase 1). Matched phrase "clients.your-server.de" at REMOTE_HOST. [file "/etc/apache2/conf.d/modsec/modsec2.user.conf"] [line "140"] [id "11000011"] [msg "BLOCKED BAD DOMAIN: static.68.142.199.138.clients.your-server.de"] [severity "CRITICAL"] [hostname "ftiaxtomonosou.gr"] [uri "/%CE%B5%CF%85%CE%BA%CE%B1%CE%B9%CF%81%CE%AF%CE%B1-%CE%B5%CF%81%CE%B3%CE%B1%CF%83%CE%AF%CE%B1%CF%82/"] [unique_id "atPoi-VNEvdn6p9SHo4FDgABCRI"] show less	Port Scan
🇬🇷 setupgr	2026-10-17 05:44:34 (3 days ago)	(mod_security) mod_security (id:11000011) triggered by 138.199.142.68 (DE/Germany/Saxony/Falkenstein ... show more (mod_security) mod_security (id:11000011) triggered by 138.199.142.68 (DE/Germany/Saxony/Falkenstein/-/[AS24940 Hetzner Online GmbH]): 1 in the last 86400 secs (CF_ENABLE); Ports: *; Direction: inout; Trigger: LF_MODSEC; Logs: [Sat Oct 17 08:44:34.266763 2026] [security2:error] [pid 51861:tid 51882] [remote 138.199.142.68:37518] ModSecurity: Access denied with code 406 (phase 1). Matched phrase "clients.your-server.de" at REMOTE_HOST. [file "/etc/apache2/conf.d/modsec/modsec2.user.conf"] [line "140"] [id "11000011"] [msg "BLOCKED BAD DOMAIN: static.68.142.199.138.clients.your-server.de"] [severity "CRITICAL"] [hostname "ions.gr"] [uri "/"] [unique_id "atMLQjqhN_dFKTpgrIsKrAAAhRQ"] show less	Port Scan
🇬🇧 gigatech	2026-10-16 23:45:06 (3 days ago)	Webserver Probing	Web App Attack
🇨🇿 ddw	2026-10-16 00:21:57 (4 days ago)	Access Violation Attempts - Multiple 403 Forbidden responses.	Hacking Bad Web Bot Web App Attack
🇬🇷 setupgr	2026-10-05 12:17:53 (2 weeks ago)	(mod_security) mod_security (id:11000011) triggered by 138.199.142.68 (DE/Germany/Saxony/Falkenstein ... show more (mod_security) mod_security (id:11000011) triggered by 138.199.142.68 (DE/Germany/Saxony/Falkenstein/-/[AS24940 Hetzner Online GmbH]): 1 in the last 86400 secs (CF_ENABLE); Ports: *; Direction: inout; Trigger: LF_MODSEC; Logs: [Mon Oct 05 15:17:52.925773 2026] [security2:error] [pid 868729:tid 869189] [remote 138.199.142.68:57030] ModSecurity: Access denied with code 406 (phase 1). Matched phrase "clients.your-server.de" at REMOTE_HOST. [file "/etc/apache2/conf.d/modsec/modsec2.user.conf"] [line "141"] [id "11000011"] [msg "BLOCKED BAD DOMAIN: static.68.142.199.138.clients.your-server.de"] [severity "CRITICAL"] [hostname "babis.photo"] [uri "/"] [unique_id "asOVcMO1Iyeje53PKPUwkgAAjSM"] show less	Port Scan
🇬🇷 setupgr	2026-09-24 17:08:42 (3 weeks ago)	(mod_security) mod_security (id:11000011) triggered by 138.199.142.68 (DE/Germany/Saxony/Falkenstein ... show more (mod_security) mod_security (id:11000011) triggered by 138.199.142.68 (DE/Germany/Saxony/Falkenstein/-/[AS24940 Hetzner Online GmbH]): 1 in the last 86400 secs (CF_ENABLE); Ports: *; Direction: inout; Trigger: LF_MODSEC; Logs: [Thu Sep 24 20:08:38.692696 2026] [security2:error] [pid 454484:tid 454552] [remote 138.199.142.68:59186] ModSecurity: Access denied with code 406 (phase 1). Matched phrase "clients.your-server.de" at REMOTE_HOST. [file "/etc/apache2/conf.d/modsec/modsec2.user.conf"] [line "141"] [id "11000011"] [msg "BLOCKED BAD DOMAIN: static.68.142.199.138.clients.your-server.de"] [severity "CRITICAL"] [hostname "adoro.gr"] [uri "/"] [unique_id "arVZFkG0wBP-_vRlG8qbBwAESBA"] show less	Port Scan
Anonymous	2026-09-24 09:31:14 (3 weeks ago)	LH-Watcher: FAKE_ID SQL_INJECTION [your-server.de]	SQL Injection Web App Attack Bad Web Bot
🇬🇷 setupgr	2026-09-24 09:01:25 (3 weeks ago)	(mod_security) mod_security (id:11000011) triggered by 138.199.142.68 (DE/Germany/Saxony/Falkenstein ... show more (mod_security) mod_security (id:11000011) triggered by 138.199.142.68 (DE/Germany/Saxony/Falkenstein/-/[AS24940 Hetzner Online GmbH]): 1 in the last 86400 secs (CF_ENABLE); Ports: *; Direction: inout; Trigger: LF_MODSEC; Logs: [Thu Sep 24 12:01:23.281268 2026] [security2:error] [pid 306377:tid 314628] [remote 138.199.142.68:48666] ModSecurity: Access denied with code 406 (phase 1). Matched phrase "clients.your-server.de" at REMOTE_HOST. [file "/etc/apache2/conf.d/modsec/modsec2.user.conf"] [line "141"] [id "11000011"] [msg "BLOCKED BAD DOMAIN: static.68.142.199.138.clients.your-server.de"] [severity "CRITICAL"] [hostname "fashionfragonard.gr"] [uri "/"] [unique_id "arTm4--x7Lf0Q6y-mXsJQAABxiI"] show less	Port Scan
🇸🇪 SkyDancer	2026-09-22 11:40:26 (4 weeks ago)	Multiple login attempts via RDP and/or SSH using wrong credentials. Attack automatically blocked by ... show more Multiple login attempts via RDP and/or SSH using wrong credentials. Attack automatically blocked by SkyDancer Ai via interface. show less	Hacking Brute-Force SSH
🇺🇸 sandra361	2026-09-21 15:45:49 (4 weeks ago)	Port scan detected: 41 attempts across 2 ports (80, 443). \| Evidence: REAPER_TARPIT: IN=enp1s0 SRC=1 ... show more Port scan detected: 41 attempts across 2 ports (80, 443). \| Evidence: REAPER_TARPIT: IN=enp1s0 SRC=138.199.142.68 LEN=60 TOS=0x00 PREC=0x00 TTL=52 ID=50288 DF PROTO=TCP SPT=59700 DPT=443 WINDOW=65280 RES=0x00 SYN URGP=0 show less	Port Scan
Anonymous	2026-09-21 05:17:55 (4 weeks ago)	LH-Watcher: FAKE_ID SQL_INJECTION [your-server.de]	SQL Injection Web App Attack Bad Web Bot
🇫🇷 masterguru	2026-09-20 15:11:29 (1 month ago)	(modsec_5015) ModSec 5015: Suspicious User-Agent from 138.199.142.68 (DE/Germany/static.68.142.199.1 ... show more (modsec_5015) ModSec 5015: Suspicious User-Agent from 138.199.142.68 (DE/Germany/static.68.142.199.138.clients.your-server.de): 1 in the last 3600 secs (0-195) show less	Hacking
🇫🇷 masterguru	2026-09-13 09:36:36 (1 month ago)	(modsec_5015) ModSec 5015: Suspicious User-Agent from 138.199.142.68 (DE/Germany/static.68.142.199.1 ... show more (modsec_5015) ModSec 5015: Suspicious User-Agent from 138.199.142.68 (DE/Germany/static.68.142.199.138.clients.your-server.de): 1 in the last 3600 secs (0-196) show less	Hacking
🇫🇷 masterguru	2026-09-13 08:59:12 (1 month ago)	(modsec_5015) ModSec 5015: Suspicious User-Agent from 138.199.142.68 (DE/Germany/static.68.142.199.1 ... show more (modsec_5015) ModSec 5015: Suspicious User-Agent from 138.199.142.68 (DE/Germany/static.68.142.199.138.clients.your-server.de): 1 in the last 3600 secs (0-195) show less	Hacking

Showing 1 to 15 of 113 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇩🇪 206.81.24.227

🇵🇱 194.180.49.220

🇬🇧 185.91.69.248

🇷🇴 92.118.39.96

🇨🇦 85.217.149.23

🇱🇹 62.60.130.238

🇧🇷 45.184.15.11

🇬🇧 45.82.76.104

🇧🇷 16.5.0.176

🇧🇷 201.76.120.30

🇵🇱 194.180.48.94

🇺🇦 188.239.246.193

🇺🇸 170.106.72.178

🇺🇸 161.35.48.246

🇺🇸 147.224.205.138

🇨🇳 123.245.85.38

🇨🇳 120.48.90.166

🇺🇸 108.84.235.97

🇺🇸 104.248.236.92

🇺🇸 104.23.253.96