JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

138.201.66.227

Neutral Activity

Abuse confidence score ?

0% Low Risk

34 reports

28 reporters · latest 1 year ago

ISP	Hetzner Online GmbH
Usage Type	Data Center/Web Hosting/Transit
ASN	AS24940
Hostname(s)	static.227.66.201.138.clients.your-server.de
Domain Name	hetzner.de
Country	🇩🇪 Germany
City	Falkenstein, Saxony

ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report Whois

No reports in the last 60 days

138.201.66.227 has been reported 34 times. The most recent report is from 1 year ago.

The full history is preserved below and remains searchable. A 0% score reflects the absence of recent activity, but this is not a guarantee that earlier reports were invalid. Abuse confidence score decays, naturally, over time, when the abusive activity stops.

IP Abuse Reports for 138.201.66.227

This IP address has been reported a total of 34 times from 28 distinct sources. 138.201.66.227 was first reported on October 16th 2024, and the most recent report was 1 year ago.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇺🇸 mnsf	2024-11-01 13:06:17 (1 year ago)	Request Overload (116)	Brute-Force Web App Attack
🇬🇧 Apache	2024-11-01 10:20:42 (1 year ago)	(mod_security) mod_security (id:210492) triggered by 138.201.66.227 (DE/Germany/static.227.66.201.13 ... show more (mod_security) mod_security (id:210492) triggered by 138.201.66.227 (DE/Germany/static.227.66.201.138.clients.your-server.de): 5 in the last 300 secs show less	Brute-Force Web App Attack
🇺🇸 TPI-Abuse	2024-10-31 00:06:40 (1 year ago)	(mod_security) mod_security (id:210492) triggered by 138.201.66.227 (static.227.66.201.138.clients.y ... show more (mod_security) mod_security (id:210492) triggered by 138.201.66.227 (static.227.66.201.138.clients.your-server.de): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 30 20:06:37.069906 2024] [security2:error] [pid 6025:tid 6025] [client 138.201.66.227:10878] [client 138.201.66.227] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "hollygrangenc.com"] [uri "/.env"] [unique_id "ZyLKDRzDN0sq6bcAns63UAAAAAQ"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2024-10-30 15:12:32 (1 year ago)	(mod_security) mod_security (id:210492) triggered by 138.201.66.227 (static.227.66.201.138.clients.y ... show more (mod_security) mod_security (id:210492) triggered by 138.201.66.227 (static.227.66.201.138.clients.your-server.de): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 30 11:12:25.190271 2024] [security2:error] [pid 20428:tid 20428] [client 138.201.66.227:24536] [client 138.201.66.227] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.waleed-security.com"] [uri "/.env"] [unique_id "ZyJM2cQFtWPylJEtSEP0WAAAAAg"] show less	Brute-Force Bad Web Bot Web App Attack
🇩🇪 nextweb	2024-10-30 12:56:13 (1 year ago)	(mod_security) mod_security (id:210492) triggered by 138.201.66.227 (DE/Germany/Saxony/Falkenstein/s ... show more (mod_security) mod_security (id:210492) triggered by 138.201.66.227 (DE/Germany/Saxony/Falkenstein/static.227.66.201.138.clients.your-server.de/[AS24940 Hetzner Online GmbH]): 5 in the last 3600 secs (CF_ENABLE) show less	Brute-Force
🇺🇸 TPI-Abuse	2024-10-30 12:28:22 (1 year ago)	(mod_security) mod_security (id:210492) triggered by 138.201.66.227 (static.227.66.201.138.clients.y ... show more (mod_security) mod_security (id:210492) triggered by 138.201.66.227 (static.227.66.201.138.clients.your-server.de): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 30 08:28:18.154728 2024] [security2:error] [pid 3054:tid 3054] [client 138.201.66.227:31832] [client 138.201.66.227] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "theateroobleck.com"] [uri "/.env"] [unique_id "ZyImYs9I6ek4mbaXyvPAkgAAAAY"] show less	Brute-Force Bad Web Bot Web App Attack
🇦🇺 AWW-Admin	2024-10-30 12:26:22 (1 year ago)	(mod_security) mod_security triggered on hostname [redacted] 138.201.66.227 (DE/Germany/static.227.6 ... show more (mod_security) mod_security triggered on hostname [redacted] 138.201.66.227 (DE/Germany/static.227.66.201.138.clients.your-server.de) show less	SQL Injection
🇺🇸 TPI-Abuse	2024-10-30 06:43:47 (1 year ago)	(mod_security) mod_security (id:210492) triggered by 138.201.66.227 (static.227.66.201.138.clients.y ... show more (mod_security) mod_security (id:210492) triggered by 138.201.66.227 (static.227.66.201.138.clients.your-server.de): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 30 02:43:41.882443 2024] [security2:error] [pid 11763:tid 11826] [client 138.201.66.227:64512] [client 138.201.66.227] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.orthopedica.org"] [uri "/.env"] [unique_id "ZyHVnVVeV42zkip0lgs9wwAAAcE"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 Gary Hornibrook	2024-10-22 22:00:00 (1 year ago)	138.201.66.227 - - [17/OCT/2024:18:15:48 -0500] "GET /CONFIG.JS HTTP/1.1" 404 20 7 "-" "MOZILLA/5.0 ... show more 138.201.66.227 - - [17/OCT/2024:18:15:48 -0500] "GET /CONFIG.JS HTTP/1.1" 404 20 7 "-" "MOZILLA/5.0 (WINDOWS NT 6.1) APPLEWEBKIT/537.36 (KHTML, LIKE GECKO) CHRO show less	Hacking Brute-Force
🇺🇸 Moby	2024-10-21 13:57:56 (1 year ago)	Mon Oct 21 04:07:43.972905 2024138.201.66.227 - - [21/Oct/2024:08:57:54 -0500] "GET /.remote HTTP/1. ... show more Mon Oct 21 04:07:43.972905 2024138.201.66.227 - - [21/Oct/2024:08:57:54 -0500] "GET /.remote HTTP/1.1" 404 984 "-" "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36" Mon Oct 21 04:07:43.972905 2024138.201.66.227 - - [21/Oct/2024:08:57:54 -0500] "GET /.local HTTP/1.1" 404 984 "-" "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36" Mon Oct 21 04:07:43.972905 2024138.201.66.227 - - [21/Oct/2024:08:57:55 -0500] "GET /.production HTTP/1.1" 404 984 "-" "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36" ... show less	Web App Attack
🇨🇦 polycoda	2024-10-21 09:14:23 (1 year ago)	⌨️ Probes for /.env everywhere	Hacking Web App Attack
🇺🇸 Carltonfsck	2024-10-21 07:46:02 (1 year ago)	138.201.66.227 - - [21/Oct/2024:07:46:00 +0000] "GET /.env HTTP/1.1" 404 49 138.201.66.227 - - [21/O ... show more 138.201.66.227 - - [21/Oct/2024:07:46:00 +0000] "GET /.env HTTP/1.1" 404 49 138.201.66.227 - - [21/Oct/2024:07:46:00 +0000] "GET /.remote HTTP/1.1" 404 49 ... show less	Hacking Web App Attack
🇵🇱 jo	2024-10-21 06:31:53 (1 year ago)	[Mon Oct 21 06:31:49.380303 2024] [php:error] [pid 3197432] [client 138.201.66.227:51606] script '/v ... show more [Mon Oct 21 06:31:49.380303 2024] [php:error] [pid 3197432] [client 138.201.66.227:51606] script '/var/www/html/.env.php' not found or unable to stat [Mon Oct 21 06:31:50.791311 2024] [php:error] [pid 3197427] [client 138.201.66.227:52094] script '/var/www/html/index.php' not found or unable to stat [Mon Oct 21 06:31:50.835646 2024] [php:error] [pid 3195602] [client 138.201.66.227:52110] script '/var/www/html/index1.php' not found or unable to stat [Mon Oct 21 06:31:52.353336 2024] [php:error] [pid 3197432] [client 138.201.66.227:52586] script '/var/www/html/phpinfo.php' not found or unable to stat [Mon Oct 21 06:31:52.493636 2024] [php:error] [pid 3197464] [client 138.201.66.227:52630] script '/var/www/html/info.php' not found or unable to stat ... show less	Port Scan Hacking Brute-Force Bad Web Bot Exploited Host Web App Attack SSH
🇧🇷 diego	2024-10-20 13:47:37 (1 year ago)	[rede-44-49] 138.201.66.227 (DE/Germany/static.227.66.201.138.clients.your-server.de), more than 10 ... show more [rede-44-49] 138.201.66.227 (DE/Germany/static.227.66.201.138.clients.your-server.de), more than 10 Apache 404 hits in the last 3600 secs; Ports: 80,443; Direction: in; Trigger: LF_APACHE_404; Logs: show less	Port Scan
🇺🇸 jcbriar	2024-10-20 06:49:29 (1 year ago)	Searching for vulnerable scripts	Hacking Web App Attack

Showing 1 to 15 of 34 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇺🇸 162.216.149.44

🇺🇸 147.185.132.227

🇺🇸 147.185.132.43

🇨🇳 111.10.224.70

🇮🇳 103.13.40.2

🇺🇸 66.132.186.141

🇺🇸 64.23.255.65

🇪🇸 34.175.49.145

🇺🇸 20.65.170.47

🇧🇷 187.88.26.209

🇺🇸 162.216.150.229

🇮🇩 103.111.249.99

🇮🇷 86.104.244.228

🇸🇪 78.66.44.61

🇸🇬 43.134.54.246

🇺🇸 40.124.172.8

🇬🇧 35.234.136.205

🇺🇸 20.169.99.56

🇧🇷 200.151.115.100

🇸🇪 185.217.0.181