AbuseIPDB » 138.199.57.38

Check an IP Address, Domain Name, or Subnet

e.g. 34.239.148.127, microsoft.com, or 5.188.10.0/24

138.199.57.38 was found in our database!

This IP was reported 938 times. Confidence of Abuse is 29%: ?

29%

ISP	DataCamp Limited
Usage Type	Data Center/Web Hosting/Transit
Domain Name	datacamp.co.uk
Country	Canada
City	Toronto, Ontario

IP info including ISP, Usage Type, and Location provided by IP2Location. Updated monthly.

Report 138.199.57.38

Whois 138.199.57.38

IP Abuse Reports for 138.199.57.38:

This IP address has been reported a total of 938 times from 139 distinct sources. 138.199.57.38 was first reported on January 21st 2022, and the most recent report was 3 weeks ago.

Old Reports: The most recent abuse report for this IP address is from 3 weeks ago. It is possible that this IP is no longer involved in abusive activities.

Reporter	Date	Comment	Categories
bryth	04 Sep 2023	Wordpress login/xmlrpc abuse (Mon 04 Sep 2023 11:15:20 AM UTC)	Hacking Web App Attack
Buster	04 Sep 2023	Repeated script kiddie distributed mass attack attempts on multiple sites from Perm Blocked High Ris ... show moreRepeated script kiddie distributed mass attack attempts on multiple sites from Perm Blocked High Risk ASN & country: show less	Open Proxy Hacking Brute-Force Web App Attack
Xuan Can	03 Sep 2023	(mod_security) mod_security (id:20000222) triggered by 138.199.57.38 (CA/Canada/-): 1 in the last 36 ... show more(mod_security) mod_security (id:20000222) triggered by 138.199.57.38 (CA/Canada/-): 1 in the last 3600 secs; Ports: 80,443; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Sep 04 01:18:03.844445 2023] [security2:error] [pid 36924:tid 47194992432896] [client 138.199.57.38:0] [client 138.199.57.38] ModSecurity: Access denied with connection close (phase 2). Pattern match "wp-admin" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec/modsec2.user.conf"] [line "47"] [id "20000222"] [severity "CRITICAL"] [hostname "superdata.asia"] [uri "/wp-admin/network/cloud.php"] [unique_id "ZPTN28HK21Y16k5FgJw-rgAAAQQ"] show less	Brute-Force SSH
findlab	02 Sep 2023	Backdrop CMS module - Request: /wp-content/plugins/hellopress/wp_filemanager...	Bad Web Bot Web App Attack
strefapi_com	02 Sep 2023	Brute-force on web app ...	Brute-Force Web App Attack
Anonymous	02 Sep 2023	Fail2Ban Log Report 138.199.57.38 - [02/Sep/2023:09:26:46 +0200] "GET /wp-content/plugins/hellopress ... show moreFail2Ban Log Report 138.199.57.38 - [02/Sep/2023:09:26:46 +0200] "GET /wp-content/plugins/hellopress/wp_filemanager.php HTTP/2.0" 403 146 "-" "-" "-" "138.199.57.38" 138.199.57.38 - [02/Sep/2023:09:26:47 +0200] "GET /.well-known/pki-validation/cloud.php HTTP/1.1" 403 146 "-" "-" "-" "138.199.57.38" 138.199.57.38 - [02/Sep/2023:09:26:47 +0200] "GET /.well-known/acme-challenge/cloud.php HTTP/1.1" 403 146 "-" "-" "-" "138.199.57.38" 138.199.57.38 - [02/Sep/2023:09:26:48 +0200] "GET /wp-admin/network/cloud.php HTTP/2.0" 403 146 "-" "-" "-" "138.199.57.38" ... show less	Hacking Brute-Force Web App Attack
MAGIC	12 Jul 2023	VM2 Bad user agents ignoring web crawling rules. Draining bandwidth	DDoS Attack Bad Web Bot
MAGIC	21 Jun 2023	Distributed DDOS attempts for multiple sites	DDoS Attack Bad Web Bot
VHosting	27 May 2023	Attempt from 138.199.57.38, reason: OverConnLimit	DDoS Attack Bad Web Bot
niceshops.com	27 May 2023	Web Attack ([27/May/2023:08:43:28.897] GET /.env)	Web App Attack
raymarron.com	26 May 2023	/.env	Web App Attack
dtorrer	25 May 2023	General vulnerability scan.	Port Scan
Tha_14	02 May 2023	Incoming UDP Connection from 138.199.57.38 to port: 2155. Honeypot was triggered at 5/2/2023 03:21:4 ... show moreIncoming UDP Connection from 138.199.57.38 to port: 2155. Honeypot was triggered at 5/2/2023 03:21:46 PM. show less	Port Scan
stfw	06 Apr 2023	8000/tcp 8000/tcp 8000/tcp... [2023-04-06]4pkt,1pt.(tcp)	Port Scan
MAGIC	04 Apr 2023	Distributed DDOS attempts for multiple sites	DDoS Attack Bad Web Bot