JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

138.68.99.201

Neutral Activity

Abuse Confidence Score

0% Low Risk

37 reports

26 reporters · latest 10 months ago

ISP: DigitalOcean, LLC
Usage Type: Data Center/Web Hosting/Transit
ASN: AS14061
Domain Name: digitalocean.com
Country: 🇩🇪 Germany
City: Frankfurt am Main, Hesse

ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report Whois

No reports in the last 60 days

138.68.99.201 has been reported 37 times. The most recent report is from 10 months ago.

The full history is preserved below and remains searchable. A 0% score reflects the absence of recent activity, but this is not a guarantee that earlier reports were invalid. Abuse confidence score decays, naturally, over time, when the abusive activity stops.

Abuse Reports

Export reports CSV

Total reports

37 from 26 distinct reporters

First reported

October 2nd 2025

Most recent report

10 months ago

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇨🇳 ThreatBook.io	2025-12-14 22:40:52 UTC · (10 months ago)	ThreatBook Intelligence: vpn_proxy more details on http://threatbook.io/ip/138.68.99.201 2025-12-14 19:13:28 /	Web App Attack
Anonymous	2025-12-14 11:42:55 UTC · (10 months ago)	2025-12-14T12:42:54.359066+01:00 vps kernel: [27452890.812597] [PORTSCAN DETECTED] IN=ens3 OUT= MAC=fa:16:3e:66:f6:24:02:37:19:0d:c2:f3:08:00 SRC=138.68.99.201 DST=54.37.14.118 LEN=44 TOS=0x00 PREC=0x00 TTL=238 ID=29229 PROTO=TCP SPT=61007 DPT=8082 W ... show more 2025-12-14T12:42:54.359066+01:00 vps kernel: [27452890.812597] [PORTSCAN DETECTED] IN=ens3 OUT= MAC=fa:16:3e:66:f6:24:02:37:19:0d:c2:f3:08:00 SRC=138.68.99.201 DST=54.37.14.118 LEN=44 TOS=0x00 PREC=0x00 TTL=238 ID=29229 PROTO=TCP SPT=61007 DPT=8082 WINDOW=1025 RES=0x00 SYN URGP=0 ... show less	Port Scan Brute-Force
🇺🇸 TPI-Abuse	2025-11-13 15:59:41 UTC · (11 months ago)	(mod_security) mod_security (id:210730) triggered by 138.68.99.201 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 13 10:59:37.781356 2025] [security2:error] [pid 5378:tid 5378] [client 138.68.99.201:51744] Mod ... show more (mod_security) mod_security (id:210730) triggered by 138.68.99.201 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 13 10:59:37.781356 2025] [security2:error] [pid 5378:tid 5378] [client 138.68.99.201:51744] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy\|\|vaxd.org\|F\|2"] [data ".xsd"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "vaxd.org"] [uri "/vendor/phpunit/phpunit/phpunit.xsd"] [unique_id "aRYAaVuEThk-iqjZp6LRQQAAABM"] show less	Brute-Force Bad Web Bot Web App Attack
🇩🇪 conseilgouz	2025-11-13 14:26:58 UTC · (11 months ago)	mae-22 : 8G : REQUEST_URI error=>//vendor/phpunit/phpunit/phpunit.xsd	Hacking
🇺🇸 TPI-Abuse	2025-11-13 12:42:56 UTC · (11 months ago)	(mod_security) mod_security (id:210730) triggered by 138.68.99.201 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 13 07:42:51.415506 2025] [security2:error] [pid 26681:tid 26681] [client 138.68.99.201:0] ModSe ... show more (mod_security) mod_security (id:210730) triggered by 138.68.99.201 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 13 07:42:51.415506 2025] [security2:error] [pid 26681:tid 26681] [client 138.68.99.201:0] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy\|\|ard.global\|F\|2"] [data ".xsd"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "ard.global"] [uri "/vendor/phpunit/phpunit/phpunit.xsd"] [unique_id "aRXSS28f_RfvdHzWG647CwAAAAE"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 Sylvyon	2025-11-13 12:00:23 UTC · (11 months ago)	Triggered Cloudflare WAF (firewallCustom) from DE. Action taken: MANAGED_CHALLENGE Protocol: HTTP/1.1 (GET method) Endpoint: /vendor/phpunit/phpunit/phpunit.xsd UA: Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Firefox/52.0 This report was ... show more Triggered Cloudflare WAF (firewallCustom) from DE. Action taken: MANAGED_CHALLENGE Protocol: HTTP/1.1 (GET method) Endpoint: /vendor/phpunit/phpunit/phpunit.xsd UA: Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Firefox/52.0 This report was generated by: https://github.com/sefinek/Cloudflare-WAF-To-AbuseIPDB show less	Bad Web Bot
🇩🇪 DocNetzwerk	2025-11-13 09:18:28 UTC · (11 months ago)	(mod_security) mod_security triggered on hostname [redacted] 138.68.99.201 (DE/Germany/-)	SQL Injection
🇺🇸 BSG Webmaster	2025-11-13 07:40:57 UTC · (11 months ago)	Hacking Attempt using path //vendor/phpunit/phpunit/phpunit.xsd	Hacking
🇺🇸 TPI-Abuse	2025-11-13 06:55:10 UTC · (11 months ago)	(mod_security) mod_security (id:210730) triggered by 138.68.99.201 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 13 01:55:02.973146 2025] [security2:error] [pid 25650:tid 25650] [client 138.68.99.201:0] ModSe ... show more (mod_security) mod_security (id:210730) triggered by 138.68.99.201 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 13 01:55:02.973146 2025] [security2:error] [pid 25650:tid 25650] [client 138.68.99.201:0] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy\|\|nyemdr-online.com\|F\|2"] [data ".xsd"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "nyemdr-online.com"] [uri "/vendor/phpunit/phpunit/phpunit.xsd"] [unique_id "aRWAxn_MxlrX6dXdQEx0hAAAAA0"] show less	Brute-Force Bad Web Bot Web App Attack
🇹🇷 hostopya.com	2025-11-13 02:44:11 UTC · (11 months ago)	AUTOMATED REPORT: Trying to access PHPUnit scripts: //vendor/phpunit/phpunit/phpunit.xsd	Hacking
🇺🇸 WizardsToolkit	2025-11-12 20:45:43 UTC · (11 months ago)	attempted to access	Web App Attack
🇺🇸 mnsf	2025-11-12 19:05:52 UTC · (11 months ago)	Too many Status 40X (11)	Brute-Force Web App Attack
🇫🇷 digital-plus-experience.com	2025-11-12 15:09:50 UTC · (11 months ago)	Probe for vulnerabilities. Path attempted: /vendor/phpunit/phpunit/phpunit.xsd	Web App Attack
🇺🇸 TPI-Abuse	2025-11-12 13:37:26 UTC · (11 months ago)	(mod_security) mod_security (id:210730) triggered by 138.68.99.201 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 12 08:37:21.529827 2025] [security2:error] [pid 6895:tid 6895] [client 138.68.99.201:64687] Mod ... show more (mod_security) mod_security (id:210730) triggered by 138.68.99.201 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 12 08:37:21.529827 2025] [security2:error] [pid 6895:tid 6895] [client 138.68.99.201:64687] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "4"] [msg "COMODO WAF: URL file extension is restricted by policy\|\|www.casslakeside.org\|F\|2"] [data ".xsd"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.casslakeside.org"] [uri "/vendor/phpunit/phpunit/phpunit.xsd"] [unique_id "aRSNkacLgRbAuFr7p0PI7QAAACE"] show less	Brute-Force Bad Web Bot Web App Attack
🇫🇷 wpwoodo	2025-11-12 05:32:21 UTC · (11 months ago)	Webpage crawler	Bad Web Bot

Showing 1 to 15 of 37 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown

Recently Reported IPs:

🇬🇧 2a01:4020:1:1:102::61a

🇬🇧 2a01:4020:1:1:102::16f

🇺🇸 209.33.45.122

🇺🇸 136.118.164.174

🇵🇱 109.231.34.208

🇬🇧 87.236.176.219

🇳🇱 81.19.216.107

🇵🇱 45.138.12.16

🇬🇧 2a01:4020:1:1:102::751

🇬🇧 2a01:4020:1:1:102::514

🇬🇧 2a01:4020:1:1:102::53

🇳🇱 200.138.46.48

🇨🇳 120.230.80.164

🇵🇰 119.154.232.68

🇬🇫 92.142.124.181

🇨🇳 60.26.3.71

🇧🇪 34.156.152.175

🇬🇧 2a01:4020:1:1:102::678

🇬🇧 2a01:4020:1:1:102::1fa

🇧🇷 186.209.77.235