JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 138.199.54.36

138.199.54.36 was found in our database!

This IP was reported 49 times. Confidence of Abuse is 0%: ?

ISP	Datacamp Limited
Usage Type	Data Center/Web Hosting/Transit
ASN	AS212238
Domain Name	datacamp.co.uk
Country	🇮🇹 Italy
City	Milan, Lombardy

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 138.199.54.36

Whois 138.199.54.36

IP Abuse Reports for 138.199.54.36:

This IP address has been reported a total of 49 times from 27 distinct sources. 138.199.54.36 was first reported on September 19th 2023, and the most recent report was 2 months ago.

Old Reports: The most recent abuse report for this IP address is from 2 months ago . It is possible that this IP is no longer involved in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇬🇧 consul.to	2026-04-05 03:29:07 (2 months ago)	Web attack/malicious scanning detected	Web App Attack
🇬🇧 consul.to	2026-03-17 05:31:52 (2 months ago)	Web attack/malicious scanning detected	Web App Attack
🇺🇸 xmission.com	2025-12-19 18:14:48 (5 months ago)	Blocked by UFW (TCP on 1) Source port: 41517 TTL: 50 Packet length: 64 TOS: 0x00 This report (for 1 ... show more Blocked by UFW (TCP on 1) Source port: 41517 TTL: 50 Packet length: 64 TOS: 0x00 This report (for 138.199.54.36) was generated by: https://github.com/sefinek/UFW-AbuseIPDB-Reporter show less	Port Scan
🇳🇱 mha.fi	2025-12-08 18:30:09 (6 months ago)	Unauthorized connection attempt detected from IP address 138.199.54.36 to port 445 (DNS-NL) [e]	Brute-Force Exploited Host
🇨🇭 teamsecure	2025-11-27 16:35:48 (6 months ago)	Banned for trying to access xmlrpc	Web App Attack
🇳🇴 Alexandr Kulkov	2025-08-13 07:43:34 (10 months ago)	138.199.54.36 triggered Icarus honeypot on port 23.	Port Scan Hacking
🇩🇪 barateza	2025-08-08 05:00:04 (10 months ago)	WAF repeated trigger detected by Fail2Ban in plesk-modsecurity jail	Web App Attack
🇧🇪 cmbplf	2024-10-25 17:02:43 (1 year ago)	5 /?licep=evdjl (1mo1d16h)	Brute-Force Bad Web Bot
🇩🇪 updown.io	2024-09-01 23:07:17 (1 year ago)	{"level":"info","ts":1725232015.121117,"logger":"http.log.access.log1","msg":"handled request","requ ... show more {"level":"info","ts":1725232015.121117,"logger":"http.log.access.log1","msg":"handled request","request":{"remote_ip":"138.199.54.36","remote_port":"33786","client_ip":"138.199.54.36","proto":"HTTP/1.1","method":"GET","host":"status.demarches-simplifiees.fr","uri":"/","headers":{"User-Agent":["Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0"],"Accept":["text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8"],"Accept-Encoding":["gzip, deflate, br"]}},"bytes_read":0,"user_id":"","duration":0.00006277,"size":0,"status":308,"resp_headers":{"Location":["https://status.demarches-simplifiees.fr/"],"Content-Type":[],"Server":["Caddy"],"Connection":["close"]}} {"level":"info","ts":1725232020.5180628,"logger":"http.log.access.log1","msg":"handled request","request":{"remote_ip":"138.199.54.36","remote_port":"33798","client_ip":"138.199.54.36","proto":"HTTP/1.1","method":"GET","host":"status.demarches-simplifiees.fr","uri":"/.well-known/secur ... show less	DDoS Attack Web App Attack
🇳🇴 ScamAware	2024-06-23 14:18:00 (1 year ago)	Probing for vulnerable code - Wordpress	Web App Attack
🇺🇸 TPI-Abuse	2024-06-23 12:03:07 (1 year ago)	(mod_security) mod_security (id:210730) triggered by 138.199.54.36 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:210730) triggered by 138.199.54.36 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Jun 23 08:02:47.273446 2024] [security2:error] [pid 21851] [client 138.199.54.36:48234] [client 138.199.54.36] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy\|\|templehistorical.org\|F\|2"] [data ".php.bak"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "templehistorical.org"] [uri "/site/default/settings.php.BAK"] [unique_id "ZngO5-WVr7JAGY7hZbkjdgAAAAg"] show less	Brute-Force Bad Web Bot Web App Attack
🇩🇪 ps-center	2024-06-23 08:04:05 (1 year ago)	ABV: Web Attack GET /wp-includes/radio.php	Web Spam Hacking Bad Web Bot Web App Attack
Anonymous	2024-06-23 07:59:32 (1 year ago)	Bot / scanning and/or hacking attempts: GET /Admin/uploads/ HTTP/1.1, GET /assets/ HTTP/1.1, GET /co ... show more Bot / scanning and/or hacking attempts: GET /Admin/uploads/ HTTP/1.1, GET /assets/ HTTP/1.1, GET /components/ HTTP/1.1, GET /admin/controller/extension/extension/ HTTP/1.1, GET /admin/uploads/ HTTP/1.1, GET /admin/uploads/images/ HTTP/1.1, GET /cgi-bin/ HTTP/1.1, GET /blog/wp-includes/ HTTP/1.1, GET /administrator/ HTTP/1.1, GET /home/ HTTP/1.1, GET /admin/images/slider/ HTTP/1.1, GET /admin/editor/ HTTP/1.1, GET /ALFA_DATA/alfacgiapi/ HTTP/1.1, GET /wp-includes/ID3 HTTP/1.1, GET /include/ HTTP/1.1, GET /wp-content/plugins/elementor/ HTTP/1.1, GET /admin/tmp/ HTTP/1.1, GET /sites/default/files/ HTTP/1.1 show less	Hacking Web App Attack
🇺🇸 hostseries	2024-06-23 04:53:12 (1 year ago)	Trigger: LF_MODSEC	Brute-Force
🇺🇸 TPI-Abuse	2024-06-23 02:08:46 (1 year ago)	(mod_security) mod_security (id:210730) triggered by 138.199.54.36 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:210730) triggered by 138.199.54.36 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Jun 22 22:08:39.690093 2024] [security2:error] [pid 20184] [client 138.199.54.36:37940] [client 138.199.54.36] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy\|\|mwrn.com\|F\|2"] [data ".php.bak"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "mwrn.com"] [uri "/site/default/settings.php.BAK"] [unique_id "ZneDp9-SSBmh4MqGlVXR1wAAAAw"] show less	Brute-Force Bad Web Bot Web App Attack

Showing 1 to 15 of 49 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇺🇸 65.49.1.21

🇭🇰 34.92.66.193

🇧🇷 179.126.187.0

🇮🇳 172.83.83.194

🇸🇬 114.119.145.198

🇩🇰 87.49.147.149

🇷🇺 81.30.212.94

🇷🇴 80.94.92.171

🇩🇪 69.5.169.45

🇧🇪 34.76.156.180

🇺🇸 2604:a880:400:d1:0:4:9622:a001

🇩🇪 217.60.245.42

🇻🇳 203.205.37.233

🇮🇩 103.154.231.122

🇩🇪 69.5.169.198

🇫🇮 2a00:1450:4010:c06::120

🇦🇷 186.57.3.137

🇰🇷 175.206.1.60

🇨🇳 117.50.44.85

🇭🇷 78.134.210.14