JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 167.172.38.216

167.172.38.216 was found in our database!

This IP was reported 64 times. Confidence of Abuse is 100%: ?

100%

ISP	DigitalOcean, LLC
Usage Type	Data Center/Web Hosting/Transit
ASN	AS14061
Domain Name	digitalocean.com
Country	🇳🇱 Netherlands
City	Amsterdam, North Holland

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 167.172.38.216

Whois 167.172.38.216

IP Abuse Reports for 167.172.38.216:

This IP address has been reported a total of 64 times from 52 distinct sources. 167.172.38.216 was first reported on June 10th 2026, and the most recent report was 2 hours ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇬🇧 WebServ	2026-06-22 15:01:59 (2 hours ago)	Blocked by ufw after 5 attempts in last 300s.	Brute-Force
🇩🇪 ISPLtd	2026-06-22 14:58:44 (2 hours ago)	Jun 22 11:57:19 167.172.38.216 TCP SPT=59759 DPT=3000 SYN Jun 22 11:57:43 167.172.38.216 TCP SPT=597 ... show more Jun 22 11:57:19 167.172.38.216 TCP SPT=59759 DPT=3000 SYN Jun 22 11:57:43 167.172.38.216 TCP SPT=59759 DPT=9090 SYN Jun 22 11:58:43 167.172.38.216 TCP SPT=59759 DPT=8888 ... show less	Port Scan
🇫🇷 Little Iguana	2026-06-22 14:55:00 (2 hours ago)	trying to access non-authorized port	Port Scan
🇩🇪 mondor.ro	2026-06-21 17:43:53 (23 hours ago)	Cluster member 148.251.176.225 (DE/Germany/antares.webyouridea.ro) said, DENY 167.172.38.216, Reason ... show more Cluster member 148.251.176.225 (DE/Germany/antares.webyouridea.ro) said, DENY 167.172.38.216, Reason:[(mod_security) mod_security (id:210492) triggered by 167.172.38.216 (-): 3 in the last 3600 secs]; Ports: *; Direction: inout; Trigger: LF_CLUSTER; Logs: show less	Port Scan
🇩🇪 srtzero	2026-06-21 17:38:35 (23 hours ago)	167.172.38.216 - - [21/Jun/2026:19:38:35 +0200] "GET /.env.local.php HTTP/1.1" 404 162 "-" "Mozilla/ ... show more 167.172.38.216 - - [21/Jun/2026:19:38:35 +0200] "GET /.env.local.php HTTP/1.1" 404 162 "-" "Mozilla/5.0 (compatible)" ... show less	Port Scan Bad Web Bot Web App Attack
🇩🇪 big-cloud.nl	2026-06-21 17:37:46 (23 hours ago)	Try to access /.env	Web App Attack
🇫🇮 oh.mg	2026-06-21 16:00:48 (1 day ago)	[Sun Jun 21 18:00:45.201368 2026] [security2:error] [pid 216450:tid 216461] [client 167.172.38.216:3 ... show more [Sun Jun 21 18:00:45.201368 2026] [security2:error] [pid 216450:tid 216461] [client 167.172.38.216:38032] [client 167.172.38.216] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:blocking_inbound_anomaly_score. [file "/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "233"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 8)"] [ver "OWASP_CRS/4.10.0-dev"] [tag "anomaly-evaluation"] [tag "OWASP_CRS"] [hostname "95.216.72.247"] [uri "/sites/default/settings.php"] [unique_id "ajgKrdR7T9vz3H6b2e-o7wAAAQk"] [Sun Jun 21 18:00:47.702632 2026] [security2:error] [pid 216450:tid 216468] [client 167.172.38.216:38032] [client 167.172.38.216] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:blocking_inbound_anomaly_score. [file "/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "233"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 8)"] [ver "OWASP_C ... show less	Web App Attack Bad Web Bot
Anonymous	2026-06-21 14:58:01 (1 day ago)	[21/Jun/2026:17:58:00 +0300] 178205388014.803143 167.172.38.216 58206 148.251.76.218 80 [21/Jun/2026 ... show more [21/Jun/2026:17:58:00 +0300] 178205388014.803143 167.172.38.216 58206 148.251.76.218 80 [21/Jun/2026:17:58:00 +0300] 178205388058.468404 167.172.38.216 58232 148.251.76.218 80 show less	Web App Attack
🇫🇮 inlink.ltd	2026-06-21 14:04:07 (1 day ago)	dot file probe	Web App Attack
🇫🇮 iamxorum	2026-06-21 13:52:37 (1 day ago)	2026-06-21T13:52:36.417153+00:00 XRM-01 kernel: [HONEYPORT] IN=eth0 OUT= MAC=92:00:06:e6:da:95:d2:74 ... show more 2026-06-21T13:52:36.417153+00:00 XRM-01 kernel: [HONEYPORT] IN=eth0 OUT= MAC=92:00:06:e6:da:95:d2:74:7f:6e:37:e3:08:00 SRC=167.172.38.216 DST=46.62.222.43 LEN=40 TOS=0x00 PREC=0x00 TTL=243 ID=32770 PROTO=TCP SPT=48992 DPT=8080 WINDOW=1024 RES=0x00 SYN URGP=0 ... show less	Port Scan
🇩🇪 sbajic	2026-06-21 13:41:24 (1 day ago)	...	Brute-Force
🇺🇸 Som1ght3n	2026-06-20 12:29:29 (2 days ago)	The IP attempted to access sensitive application configuration files via a GET request to "/.env.pro ... show more The IP attempted to access sensitive application configuration files via a GET request to "/.env.production.local". show less	Web App Attack
🇫🇷 Vaction	2026-06-20 12:05:42 (2 days ago)	167.172.38.216 - - [20/Jun/2026:14:05:41 +0200] "GET /.env HTTP/1.1" 404 381 "-" "Mozilla/5.0 (compa ... show more 167.172.38.216 - - [20/Jun/2026:14:05:41 +0200] "GET /.env HTTP/1.1" 404 381 "-" "Mozilla/5.0 (compatible)" show less	Hacking Bad Web Bot Web App Attack
🇺🇸 masterguru	2026-06-20 06:52:39 (2 days ago)	Host header is a numeric IP address. Pattern match "^ (920350-169)	Hacking Bad Web Bot
🇮🇹 LTM	2026-06-20 06:20:01 (2 days ago)	WebServer - Attempts to exploit	Hacking Brute-Force Web App Attack

Showing 1 to 15 of 64 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇺🇸 8.229.191.33

🇷🇴 2a0b:8800:580::7a

🇮🇳 175.100.177.195

🇿🇦 102.129.51.115

🇨🇿 77.75.78.171

🇺🇸 66.132.224.238

🇳🇱 45.148.10.240

🇳🇱 45.148.10.151

🇳🇱 45.148.10.147

🇬🇧 31.14.254.84

🇺🇸 20.29.24.90

🇺🇸 137.184.220.161

🇰🇷 121.66.245.93

🇨🇦 85.217.149.23

🇺🇸 66.132.224.236

🇹🇼 1.164.224.15

🇺🇸 216.73.216.254

🇲🇽 187.191.48.23

🇫🇷 176.143.163.191

🇰🇷 175.206.1.60