AbuseIPDB » 138.68.189.204

Check an IP Address, Domain Name, or Subnet

e.g. 3.235.140.84, microsoft.com, or 5.188.10.0/24

138.68.189.204 was found in our database!

This IP was reported 68 times. Confidence of Abuse is 100%: ?

100%

ISP	DigitalOcean LLC
Usage Type	Data Center/Web Hosting/Transit
Domain Name	digitalocean.com
Country	United Kingdom of Great Britain and Northern Ireland
City	London, England

IP info including ISP, Usage Type, and Location provided by IP2Location. Updated monthly.

Report 138.68.189.204

Whois 138.68.189.204

IP Abuse Reports for 138.68.189.204:

This IP address has been reported a total of 68 times from 37 distinct sources. 138.68.189.204 was first reported on June 28th 2022, and the most recent report was 2 weeks ago.

Old Reports: The most recent abuse report for this IP address is from 2 weeks ago. It is possible that this IP is no longer involved in abusive activities.

Reporter	Date	Comment	Categories
syokadmin	25 Jul 2022	(PERMBLOCK) 138.68.189.204 (GB/United Kingdom/795443.cloudwaysapps.com) has had more than 2 temp blo ... show more(PERMBLOCK) 138.68.189.204 (GB/United Kingdom/795443.cloudwaysapps.com) has had more than 2 temp blocks in the last 86400 secs show less	Brute-Force
syokadmin	24 Jul 2022	(mod_security) mod_security (id:77317941) triggered by 138.68.189.204 (GB/United Kingdom/795443.clou ... show more(mod_security) mod_security (id:77317941) triggered by 138.68.189.204 (GB/United Kingdom/795443.cloudwaysapps.com): 1 in the last 3600 secs show less	Brute-Force
Maykson	24 Jul 2022	138.68.189.204 - - [24/Jul/2022:05:16:36 -0300] "GET /.env HTTP/1.1" 403 4397 "-" "Mozilla/5.0 (X11; ... show more138.68.189.204 - - [24/Jul/2022:05:16:36 -0300] "GET /.env HTTP/1.1" 403 4397 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.129 Safari/537.36" ... show less	Exploited Host Web App Attack
mnsf	23 Jul 2022	Too many Status 40X (15)	Brute-Force Web App Attack
Anonymous	13 Jul 2022		Web App Attack
McClay	09 Jul 2022	HTTP-404 spam:138.68.189.204 - - [09/Jul/2022:22:32:05 +0200] "GET /.env HTTP/1.1" 404 577 "-" "Mozi ... show moreHTTP-404 spam:138.68.189.204 - - [09/Jul/2022:22:32:05 +0200] "GET /.env HTTP/1.1" 404 577 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.129 Safari/537.36" 138.68.189.204 - - [09/Jul/2022:22:32:06 +0200] "GET /vendor/.env HTTP/1.1" 404 577 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.129 Safari/537.36" 138.68.189.204 - - [09/Jul/2022:22:32:06 +0200] "GET /storage/.env HTTP/1.1" 404 577 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.129 Safari/537.36" 138.68.189.204 - - [09/Jul/2022:22:32:07 +0200] "GET /public/.env HTTP/1.1" 404 577 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.129 Safari/537.36" 138.68.189.204 - - [09/Jul/2022:22:32:07 +0200] "GET /local/.env HTTP/1.1" 404 577 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.129 Safari/537.36" 138.68.189.204 - - [09/Jul/ ... show less	Web App Attack
ut-addicted.com	09 Jul 2022	\[Sat Jul 09 18:54:54.942686 2022\] \[:error\] \[pid 5472:tid 139915257911040\] \[client 138.68.189. ... show more\[Sat Jul 09 18:54:54.942686 2022\] \[:error\] \[pid 5472:tid 139915257911040\] \[client 138.68.189.204:55712\] \[client 138.68.189.204\] ModSecurity: Access denied with code 403 $phase 2$. Operator GE matched 5 at TX:anomaly_score. \[file "/usr/local/apache/modsecurity-owasp-latest/rules/REQUEST-949-BLOCKING-EVALUATION.conf"\] \[line "57"\] \[id "949110"\] \[msg "Inbound Anomaly Score Exceeded $Total Score: 5$"\] \[severity "CRITICAL"\] \[tag "application-multi"\] \[tag "language-multi"\] \[tag "platform-multi"\] \[tag "attack-generic"\] \[hostname "ut-addicted.com"\] \[uri "/.env"\] \[unique_id "Ysmy3uhzYiaPLHTd3jlvLQAAAM8"\] show less	Brute-Force Web App Attack
eminovic.ba	09 Jul 2022	BRUTE FORCE: Excessive 404 hits ...	Hacking Brute-Force Web App Attack
debaba	09 Jul 2022		Brute-Force Web App Attack
Mario Silber	09 Jul 2022	(mod_security) mod_security triggered on hostname [redacted] 138.68.189.204 (GB/United Kingdom/79544 ... show more(mod_security) mod_security triggered on hostname [redacted] 138.68.189.204 (GB/United Kingdom/795443.cloudwaysapps.com) show less	SQL Injection
Bobby Williams	09 Jul 2022	(mod_security) mod_security triggered on hostname [redacted] 138.68.189.204 (GB/United Kingdom/79544 ... show more(mod_security) mod_security triggered on hostname [redacted] 138.68.189.204 (GB/United Kingdom/795443.cloudwaysapps.com) show less	SQL Injection
nick	08 Jul 2022	[08/Jul/2022:19:46:10.594266 +0200] YshtYsmcPuMe51R82TsI5gAAAAU 138.68.189.204 30938 5.2.65.207 443< ... show more[08/Jul/2022:19:46:10.594266 +0200] YshtYsmcPuMe51R82TsI5gAAAAU 138.68.189.204 30938 5.2.65.207 443 [08/Jul/2022:19:46:11.904308 +0200] YshtY8mcPuMe51R82TsI5wAAAAQ 138.68.189.204 31292 5.2.65.207 443 [08/Jul/2022:19:46:13.295605 +0200] YshtZZTq8b3iT-VF-64ptQAAANg 138.68.189.204 31642 5.2.65.207 443 [08/Jul/2022:19:46:13.615130 +0200] YshtZcmcPuMe51R82TsI6AAAABU 138.68.189.204 31736 5.2.65.207 443 [08/Jul/2022:19:46:14.032681 +0200] YshtZpTq8b3iT-VF-64ptgAAAM0 138.68.189.204 31806 5.2.65.207 443 show less	Web App Attack
4server	08 Jul 2022	[FriJul0818:33:34.8464352022][:error][pid7868:tid47670381119232][client138.68.189.204:16702][client1 ... show more[FriJul0818:33:34.8464352022][:error][pid7868:tid47670381119232][client138.68.189.204:16702][client138.68.189.204]ModSecurity:Accessdeniedwithcode403$phase2$.Patternmatch\"$\?:\\\\\\\\b\(\?:\\\\\\\\.\(\?:ht\(\?:access\\|passwd\\|group$\\|www_\?acl\)\\|global\\\\\\\\.asa\\|httpd\\\\\\\\.conf\\|boot\\\\\\\\.ini\\|web.config\)\\\\\\\\b\\|$\\|\^\\|\\\\\\\\.\\\\\\\\.$/etc/\\|/\\\\\\\\.$\?:history\\|bash_history\\|sh_history\\|env$\$\)\"atREQUEST_FILENAME.[file\"/etc/apache2/conf.d/modsec_rules/10_asl_rules.conf\"][line\"189\"][id\"390709\"][rev\"30\"][msg\"Atomicorp.comWAFRules:Attempttoaccessprotectedfileremotely\"][data\"/.env\"][severity\"CRITICAL\"][hostname\"idrotermoclima.ch\"][uri\"/.env\"][unique_id\"YshcXpHBHcUECImfv47lGwAAABQ\"][FriJul0818:33:36.4374712022][:error][pid7974:tid47670374815488][client138.68.189.204:17154][client138.68.189.204]ModSecurity:Accessdeniedwithcode403$phase2$.Patternmatch\"$\?:\\\\\\\\b\(\?:\\\\\\\\.\(\?:ht\(\?:access\\|passwd\\|group$\\|www_\?acl\)\\|global\\\\\\\\.asa\\|httpd\\\\\\\\.c show less	Port Scan Brute-Force Web App Attack
gwynethllewelyn.net	08 Jul 2022	2022/07/08 15:25:45 [error] 1829#1829: 208929 access forbidden by rule, client: 138.68.189.204, ser ... show more2022/07/08 15:25:45 [error] 1829#1829: 208929 access forbidden by rule, client: 138.68.189.204, server: gwynethllewelyn.net, request: "GET /.env HTTP/2.0", host: "gwynethllewelyn.net" 138.68.189.204 - - [08/Jul/2022:15:25:45 +0100] "GET /.env HTTP/2.0" 403 1166 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.129 Safari/537.36" 2022/07/08 15:25:46 [error] 1829#1829: *208937 access forbidden by rule, client: 138.68.189.204, server: gwynethllewelyn.net, request: "GET /vendor/.env HTTP/2.0", host: "gwynethllewelyn.net" ... show less	Web App Attack
MarkGGN	08 Jul 2022	Webexploits. 138.68.189.204 - - [08/Jul/2022:14:49:40 +0200] "GET /.env HTTP/1.1" 200 1182 "-" "Mozi ... show moreWebexploits. 138.68.189.204 - - [08/Jul/2022:14:49:40 +0200] "GET /.env HTTP/1.1" 200 1182 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.129 Safari/537.36" 138.68.189.204 - - [08/Jul/2022:14:49:40 +0200] "GET /vendor/.env HTTP/1.1" 404 78 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.129 Safari/537.36" show less	Brute-Force Bad Web Bot Web App Attack