JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 138.68.48.131

138.68.48.131 was found in our database!

This IP was reported 189 times. Confidence of Abuse is 100%: ?

100%

ISP	DigitalOcean, LLC
Usage Type	Data Center/Web Hosting/Transit
ASN	AS14061
Domain Name	digitalocean.com
Country	🇺🇸 United States of America
City	Santa Clara, California

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 138.68.48.131

Whois 138.68.48.131

IP Abuse Reports for 138.68.48.131:

This IP address has been reported a total of 189 times from 100 distinct sources. 138.68.48.131 was first reported on November 14th 2023, and the most recent report was 22 hours ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇺🇸 1cyb3rpunk	2026-08-31 17:24:52 (22 hours ago)	Coordinated campaign CMP-1786835848-001: 329 IPs sharing an attack fingerprint (acme_challenge_probe ... show more Coordinated campaign CMP-1786835848-001: 329 IPs sharing an attack fingerprint (acme_challenge_probe, admin_panel_probe, attacker_objective_inferred, backup_file_probe, cms_version_probe, command_injection_attempt). Observed on sectrace.org honeypot surface. show less	Port Scan Brute-Force Bad Web Bot Web App Attack
🇺🇸 1cyb3rpunk	2026-08-30 21:56:28 (1 day ago)	Coordinated campaign CMP-1786835848-001: 322 IPs sharing an attack fingerprint (acme_challenge_probe ... show more Coordinated campaign CMP-1786835848-001: 322 IPs sharing an attack fingerprint (acme_challenge_probe, admin_panel_probe, attacker_objective_inferred, backup_file_probe, cms_version_probe, command_injection_attempt). Observed on sectrace.org honeypot surface. show less	Port Scan Brute-Force Bad Web Bot Web App Attack
🇺🇸 1cyb3rpunk	2026-08-29 21:56:00 (2 days ago)	Coordinated campaign CMP-1786835848-001: 319 IPs sharing an attack fingerprint (acme_challenge_probe ... show more Coordinated campaign CMP-1786835848-001: 319 IPs sharing an attack fingerprint (acme_challenge_probe, admin_panel_probe, attacker_objective_inferred, backup_file_probe, cms_version_probe, command_injection_attempt). Observed on sectrace.org honeypot surface. show less	Port Scan Brute-Force Bad Web Bot Web App Attack
🇺🇸 1cyb3rpunk	2026-08-29 04:31:27 (3 days ago)	Coordinated campaign CMP-1786835848-001: 308 IPs sharing an attack fingerprint (acme_challenge_probe ... show more Coordinated campaign CMP-1786835848-001: 308 IPs sharing an attack fingerprint (acme_challenge_probe, admin_panel_probe, attacker_objective_inferred, backup_file_probe, cms_version_probe, command_injection_attempt). Observed on sectrace.org honeypot surface. show less	Port Scan Brute-Force Bad Web Bot Web App Attack
🇩🇪 4server	2026-08-28 14:56:35 (4 days ago)	[FriAug2816:56:32.6537352026][security2:error][pid2806499:tid2806528][client138.68.48.131:0]ModSecur ... show more [FriAug2816:56:32.6537352026][security2:error][pid2806499:tid2806528][client138.68.48.131:0]ModSecurity:Accessdeniedwithcode403\(phase2\).Patternmatch\"\\\\\\\\.vscode/\"atREQUEST_FILENAME.[file\"/etc/apache2/conf.d/modsec_rules/10_asl_rules.conf\"][line\"1189\"][id\"350593\"][rev\"1\"][msg\"Atomicorp.comWAFRules:AttackBlocked-Dataleakage-attempttoaccessstoredvscodepasswords\"][severity\"CRITICAL\"][hostname\"selenemodestipastrydetails.it\"][uri\"/.vscode/sftp.json\"][unique_id\"apGhoLuI0wwxE9SE_oG7DQAAABI\"] show less	Port Scan Brute-Force Web App Attack
🇵🇱 sefinek.net	2026-08-28 10:39:17 (4 days ago)	Triggered Cloudflare WAF (firewallCustom) from US. Action: BLOCK \| Protocol: HTTP/1.1 (GET) \| Endpoi ... show more Triggered Cloudflare WAF (firewallCustom) from US. Action: BLOCK \| Protocol: HTTP/1.1 (GET) \| Endpoint: /sftp-config.json \| UA: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36 • Generated by: github.com/sefinek/Cloudflare-WAF-To-AbuseIPDB show less	Bad Web Bot
🇨🇭 4server	2026-08-28 05:41:09 (4 days ago)	[FriAug2807:41:06.7981162026][security2:error][pid69574:tid70368][client138.68.48.131:0]ModSecurity: ... show more [FriAug2807:41:06.7981162026][security2:error][pid69574:tid70368][client138.68.48.131:0]ModSecurity:Accessdeniedwithcode403\(phase2\).Patternmatch\"\\\\\\\\.vscode/\"atREQUEST_FILENAME.[file\"/etc/apache2/conf.d/modsec_rules/10_asl_rules.conf\"][line\"1189\"][id\"350593\"][rev\"1\"][msg\"Atomicorp.comWAFRules:AttackBlocked-Dataleakage-attempttoaccessstoredvscodepasswords\"][severity\"CRITICAL\"][hostname\"npdesign360.ch\"][uri\"/.vscode/sftp.json\"][unique_id\"apEfco-N3qET31Aeju3ZqwAAAEU\"] show less	Hacking Web App Attack
🇺🇸 1cyb3rpunk	2026-08-28 04:30:38 (4 days ago)	Coordinated campaign CMP-1786835848-001: 290 IPs sharing an attack fingerprint (acme_challenge_probe ... show more Coordinated campaign CMP-1786835848-001: 290 IPs sharing an attack fingerprint (acme_challenge_probe, admin_panel_probe, attacker_objective_inferred, backup_file_probe, cms_version_probe, command_injection_attempt). Observed on sectrace.org honeypot surface. show less	Port Scan Brute-Force Bad Web Bot Web App Attack
🇮🇹 mediarama.com	2026-08-28 03:13:57 (4 days ago)	Banned by Fail2Ban	Web App Attack
🇨🇿 ddw	2026-08-28 01:47:03 (4 days ago)	ModSecurity detection - Rules: 930130(Restricted File Access Attempt)	Web App Attack
🇫🇮 paissangroup	2026-08-27 19:05:48 (4 days ago)	Multiple WAF Violations	Web App Attack
🇮🇹 abuseiphack	2026-08-27 16:13:42 (4 days ago)	Automatic report for brute force attack	Web App Attack
🇩🇪 4server	2026-08-27 15:12:47 (5 days ago)	[ThuAug2717:12:44.8357492026][security2:error][pid1356446:tid1356522][client138.68.48.131:0]ModSecur ... show more [ThuAug2717:12:44.8357492026][security2:error][pid1356446:tid1356522][client138.68.48.131:0]ModSecurity:Accessdeniedwithcode403\(phase2\).Patternmatch\"\\\\\\\\.vscode/\"atREQUEST_FILENAME.[file\"/etc/apache2/conf.d/modsec_rules/10_asl_rules.conf\"][line\"1189\"][id\"350593\"][rev\"1\"][msg\"Atomicorp.comWAFRules:AttackBlocked-Dataleakage-attempttoaccessstoredvscodepasswords\"][severity\"CRITICAL\"][hostname\"shaping.ch\"][uri\"/.vscode/sftp.json\"][unique_id\"apBT7HjqgEOOIW3OLcA1GgAAAI8\"] show less	Port Scan Brute-Force Web App Attack
🇫🇷 masterguru	2026-08-27 12:38:37 (5 days ago)	Restricted File Access Attempt. Matched phrase ".vscode" at REQUEST_FILENAME. (930130-201)	Hacking Web App Attack
🇬🇧 Shadymint	2026-08-27 11:48:31 (5 days ago)	url probing from IP marked as abusive	Web App Attack

Showing 1 to 15 of 189 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇧🇷 200.232.114.71

🇹🇼 198.235.24.114

🇫🇷 172.71.130.99

🇵🇱 109.205.211.110

🇵🇰 103.105.210.74

🇺🇸 23.94.145.109

🇺🇸 205.210.31.33

🇧🇪 198.235.24.208

🇷🇺 178.22.193.238

🇺🇸 162.216.149.122

🇸🇦 142.154.39.252

🇨🇳 123.113.156.111

🇺🇦 46.200.114.230

🇷🇺 5.3.154.197

🇰🇷 221.163.5.228

🇩🇪 213.209.159.223

🇹🇼 198.235.24.94

🇩🇪 109.91.4.177

🇲🇦 81.192.46.32

🇨🇦 69.156.90.239