JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 138.97.67.0

138.97.67.0 was found in our database!

This IP was reported 9 times. Confidence of Abuse is 14%: ?

14%

ISP	WESTLINK TECNOLOGIA E COMUNICACAO LTDA. - ME
Usage Type	Fixed Line ISP
ASN	AS61591
Hostname(s)	138-97-67-0.westlink.net.br
Domain Name	westlink.com.br
Country	🇧🇷 Brazil
City	Sao Goncalo, Rio de Janeiro

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 138.97.67.0

Whois 138.97.67.0

IP Abuse Reports for 138.97.67.0:

This IP address has been reported a total of 9 times from 7 distinct sources. 138.97.67.0 was first reported on May 29th 2025, and the most recent report was 2 days ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇺🇸 TPI-Abuse	2026-06-15 20:34:06 (2 days ago)	(mod_security) mod_security (id:240335) triggered by 138.97.67.0 (138-97-67-0.westlink.net.br): 1 in ... show more (mod_security) mod_security (id:240335) triggered by 138.97.67.0 (138-97-67-0.westlink.net.br): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jun 15 16:34:01.964289 2026] [security2:error] [pid 21642:tid 21642] [client 138.97.67.0:51086] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5965"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 138.97.67.0 (+1 hits since last alert)\|pharmaceuticalsalescertifications.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "pharmaceuticalsalescertifications.com"] [uri "/xmlrpc.php"] [unique_id "ajBhubxKHEsRPGkAwKQCzAAAAAU"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-06-15 18:58:14 (2 days ago)	(mod_security) mod_security (id:240335) triggered by 138.97.67.0 (138-97-67-0.westlink.net.br): 1 in ... show more (mod_security) mod_security (id:240335) triggered by 138.97.67.0 (138-97-67-0.westlink.net.br): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jun 15 14:58:10.675525 2026] [security2:error] [pid 12296:tid 12296] [client 138.97.67.0:17725] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5965"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 138.97.67.0 (+1 hits since last alert)\|whodatnation.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "whodatnation.com"] [uri "/xmlrpc.php"] [unique_id "ajBLQs-OPbx-dO1ehDPpPAAAAAk"] show less	Brute-Force Bad Web Bot Web App Attack
🇫🇷 tilellit.pro	2026-06-05 16:01:27 (1 week ago)	Fail2Ban banned 138.97.67.0 for security violations in jail wp-armour. Log: 2026/06/05 16:01:27 [err ... show more Fail2Ban banned 138.97.67.0 for security violations in jail wp-armour. Log: 2026/06/05 16:01:27 [error] FastCGI sent in stderr: "PHP message: [WP_ARMOUR_BAN] IP: 138.97.67.0 \| Target: wplogin" , client: 138.97.67.0, server: [REDACTED], request: "POST /wp-login.php HTTP/1.1", upstream: [REDACTED], host: [REDACTED], referrer: "https://comerciogallego.es/wp-login.php" ... show less	Web Spam
Anonymous	2025-11-20 05:10:56 (6 months ago)	scanning http requests from known botnet	Web App Attack
🇫🇷 bigorre.org	2025-10-23 01:23:10 (7 months ago)	Unidentified crawling: not a self-announced bot in user-agent	Bad Web Bot
Anonymous	2025-08-27 04:12:24 (9 months ago)	DDoS botnet 510.000+ IPs; URL with bing/trustpilot/githubhelp and %C2%A4 or \xc2\xa4. Port 443.	DDoS Attack Bad Web Bot Web App Attack
🇪🇸 Global Cyber Police	2025-07-27 18:34:55 (10 months ago)	Malicious bot activity detected: Hitting honeypot page (200 OK with 258/259 bytes sent).	Port Scan Brute-Force Web App Attack
🇺🇸 ipblock.com	2025-06-27 19:38:00 (11 months ago)	IPBlock protected site ID [4055-d][s=07]. Major crawler impostor. Mozilla/5.0 (Macintosh; Intel Ma ... show more IPBlock protected site ID [4055-d][s=07]. Major crawler impostor. Mozilla/5.0 (Macintosh; Intel Mac OS X 10_7_3) AppleWebKit/537.36 (KHTML, like Gecko, Mediapartners-Google) Chrome/84.0.4147.140 Safari/537.36 show less	Bad Web Bot
🇺🇸 ipblock.com	2025-05-29 22:54:00 (1 year ago)	IPBlock protected site ID [4055-d][s=06]. Major crawler impostor. Mozilla/5.0 (Macintosh; Intel Ma ... show more IPBlock protected site ID [4055-d][s=06]. Major crawler impostor. Mozilla/5.0 (Macintosh; Intel Mac OS X 10_7_3) AppleWebKit/537.36 (KHTML, like Gecko, Mediapartners-Google) Chrome/89.0.4389.93 Safari/537.36 show less	Bad Web Bot

Showing 1 to 9 of 9 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇺🇸 205.210.31.43

🇺🇸 198.62.3.219

🇫🇮 147.185.133.184

🇵🇰 103.213.112.120

🇰🇷 218.145.181.48

🇨🇳 139.9.191.197

🇰🇷 112.216.129.27

🇺🇸 23.27.236.46

🇩🇪 209.38.198.157

🇨🇴 201.184.50.251

🇺🇿 195.158.14.232

🇫🇷 158.178.214.208

🇺🇸 92.204.138.58

🇺🇸 82.40.91.243

🇳🇱 45.148.10.152

🇲🇴 182.93.50.90

🇺🇸 165.22.9.166

🇮🇳 152.59.185.130

🇻🇳 113.160.106.247

🇺🇸 66.132.195.102