AbuseIPDB » 138.199.21.229

138.199.21.229 was found in our database!

This IP was reported 30 times. Confidence of Abuse is 38%: ?

38%

ISP	DataCamp Limited
Usage Type	Data Center/Web Hosting/Transit
Hostname(s)	unn-138-199-21-229.datapacket.com
Domain Name	datacamp.co.uk
Country	Japan
City	Tokyo, Tokyo

IP info including ISP, Usage Type, and Location provided by IP2Location. Updated monthly.

Report 138.199.21.229

Whois 138.199.21.229

IP Abuse Reports for 138.199.21.229:

This IP address has been reported a total of 30 times from 27 distinct sources. 138.199.21.229 was first reported on March 2nd 2023, and the most recent report was 2 weeks ago.

Old Reports: The most recent abuse report for this IP address is from 2 weeks ago. It is possible that this IP is no longer involved in abusive activities.

Reporter	IoA Timestamp in UTC	Comment	Categories
Jim Keir	2024-09-18 11:14:54 (2 weeks ago)	2024-09-18 11:14:53 138.199.21.229 File scanning, blocking 138.199.21.229 for 5 minutes	Web App Attack
BlueWire Hosting	2024-09-17 14:10:08 (2 weeks ago)	Scanning for Laravel vulnerabilities	Web App Attack
Anonymous	2024-09-17 05:05:15 (2 weeks ago)	Legion Credential Harvester / SMTP Hijacker: /.env	Hacking Web App Attack
oh.mg	2024-09-12 21:31:10 (3 weeks ago)	(mod_security) mod_security (id:949110) triggered by 138.199.21.229 (JP/Japan/unn-138-199-21-229.dat ... show more(mod_security) mod_security (id:949110) triggered by 138.199.21.229 (JP/Japan/unn-138-199-21-229.datapacket.com): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: [Thu Sep 12 21:31:04.310712 2024] [:error] [pid 1130391:tid 140622849627904] [client 138.199.21.229:62631] [client 138.199.21.229] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:blocking_inbound_anomaly_score. [file "/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "184"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 8)"] [ver "OWASP_CRS/4.0.0-rc1"] [tag "anomaly-evaluation"] [hostname "82.66.98.178"] [uri "/.env"] [unique_id "ZuNdmIGw4-0NGectwUSV2AAAAEk"] show less	Port Scan
WebTejo	2024-09-12 08:57:51 (3 weeks ago)	Detected multiple authentication failures and invalid user attempts from IP address 138.199.21.229 o ... show moreDetected multiple authentication failures and invalid user attempts from IP address 138.199.21.229 on [PT] A01 Node show less	Brute-Force SSH
Jim Keir	2024-09-11 16:16:07 (3 weeks ago)	2024-09-11 16:16:07 138.199.21.229 File scanning, blocking 138.199.21.229 for 5 minutes	Web App Attack
AdminSys	2024-09-11 14:53:40 (3 weeks ago)	IP Scan 404. ...	Bad Web Bot Web App Attack
ne1for23	2024-09-11 13:01:13 (3 weeks ago)	Attempt to access invalid virtual host name (###.###.###.###). Typically used to access "internal" ... show moreAttempt to access invalid virtual host name (###.###.###.###). Typically used to access "internal" resources improperly exposed externally and "protected" only by a lack of external DNS resolution. 138.199.21.229 - - [11/Sep/2024:13:01:12 +0000] "GET /.env HTTP/1.1" 403 555 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.129 Safari/537.36" "-" show less	Hacking
SecondEdge	2024-09-11 11:52:30 (3 weeks ago)	A web attack was detected from 138.199.21.229 (Japan / Tokyo / Tokyo) against 52.215.230.232 (Git Va ... show moreA web attack was detected from 138.199.21.229 (Japan / Tokyo / Tokyo) against 52.215.230.232 (Git Variable Scan). show less	Web App Attack
Charles	2024-09-11 01:04:17 (3 weeks ago)	138.199.21.229 - - [11/Sep/2024:09:04:15 +0800] "GET /.env HTTP/1.1" 404 397 "-" "Mozilla/5.0 (X11; ... show more138.199.21.229 - - [11/Sep/2024:09:04:15 +0800] "GET /.env HTTP/1.1" 404 397 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.129 Safari/537.36" ... show less	Web Spam Email Spam Brute-Force Bad Web Bot Web App Attack SSH
Jim Keir	2024-09-10 22:50:32 (3 weeks ago)	2024-09-10 22:50:31 138.199.21.229 File scanning, blocking 138.199.21.229 for 5 minutes	Web App Attack
M	2024-08-22 19:57:00 (1 month ago)	Bluehost impersonator [email protected]	Fraud Orders Phishing Email Spam
Anonymous	2024-01-17 03:22:08 (8 months ago)	port scan and connect, tcp 3306 (mysql)	Port Scan
essinghigh	2023-12-06 21:30:49 (9 months ago)	1701898249 # Service_probe # SIGNATURE_SEND # source_ip:138.199.21.229 # dst_port:5432 ...	Port Scan
crispi	2023-09-01 14:03:44 (1 year ago)	Unauthorized connection attempt detected from IP address 138.199.21.229 to TCP port 8000	Port Scan