JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 188.191.42.38

188.191.42.38 was found in our database!

This IP was reported 21 times. Confidence of Abuse is 44%: ?

44%

ISP	UARNet-Eksintech
Usage Type	Fixed Line ISP
ASN	AS3255
Domain Name	uar.net
Country	🇺🇦 Ukraine
City	Lviv, Lviv

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 188.191.42.38

Whois 188.191.42.38

IP Abuse Reports for 188.191.42.38:

This IP address has been reported a total of 21 times from 15 distinct sources. 188.191.42.38 was first reported on May 3rd 2025, and the most recent report was 1 day ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇺🇸 TPI-Abuse	2026-10-15 07:50:46 (1 day ago)	(mod_security) mod_security (id:225170) triggered by 188.191.42.38 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:225170) triggered by 188.191.42.38 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 15 03:50:39.429703 2026] [security2:error] [pid 26522:tid 26522] [client 188.191.42.38:53448] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)\|\|paulsingdahlsen.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "paulsingdahlsen.com"] [uri "/wp-json/wp/v2/users/me"] [unique_id "atCFzw1NgTrYfBwL_KJtAAAAAAA"] show less	Brute-Force Bad Web Bot Web App Attack
🇩🇪 neckaralb-admin.de	2026-10-13 05:53:47 (3 days ago)	(wordpress) Failed login wp-login.php or xmlrpc.php	Web App Attack
🇺🇸 TPI-Abuse	2026-10-12 21:31:49 (3 days ago)	(mod_security) mod_security (id:225170) triggered by 188.191.42.38 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:225170) triggered by 188.191.42.38 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Oct 12 17:31:45.446579 2026] [security2:error] [pid 15447:tid 15447] [client 188.191.42.38:42198] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)\|\|fundingworkingcapital.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "fundingworkingcapital.com"] [uri "/wp-json/wp/v2/users"] [unique_id "as1Rwc-X-V17okupJv6ZHgAAAAw"] show less	Brute-Force Bad Web Bot Web App Attack
🇭🇺 bcsaba	2026-10-12 03:19:40 (4 days ago)	CMS (WordPress or Joomla) login attempt. 188.191.42.38 - - [12/Oct/2026:05:19:38 +0200] "POST /wp-lo ... show more CMS (WordPress or Joomla) login attempt. 188.191.42.38 - - [12/Oct/2026:05:19:38 +0200] "POST /wp-login.php HTTP/2.0" 200 3250 "https://REDACTED.REDACTED/wp-login.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36" show less	Hacking Brute-Force Web App Attack
🇫🇷 LRob	2026-10-11 23:23:04 (4 days ago)	Not following 301 redirects — wasted requests \| method: GET \| path: /wp-login.php \| ua: Mozilla/5.0 ... show more Not following 301 redirects — wasted requests \| method: GET \| path: /wp-login.php \| ua: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36 show less	Bad Web Bot
🇺🇸 TPI-Abuse	2026-10-08 15:42:21 (1 week ago)	(mod_security) mod_security (id:225170) triggered by 188.191.42.38 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:225170) triggered by 188.191.42.38 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 08 11:42:14.613406 2026] [security2:error] [pid 1931:tid 1931] [client 188.191.42.38:46614] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)\|\|www.joelyaucom.studioyau.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "www.joelyaucom.studioyau.com"] [uri "/wp-json/wp/v2/users/me"] [unique_id "ase51m9ODB8hthNeKiV98gAAABE"] show less	Brute-Force Bad Web Bot Web App Attack
🇨🇿 Countryman	2026-10-01 00:10:02 (2 weeks ago)	repeated unauthorized VPN login attempt, user sweep	VPN IP Hacking Brute-Force
🇨🇿 lp	2026-09-30 19:51:21 (2 weeks ago)	Unauthorized VPN login attempts: 1 attempts were recorded from 188.191.42.38 2026-09-30T21:40:37+02: ... show more Unauthorized VPN login attempts: 1 attempts were recorded from 188.191.42.38 2026-09-30T21:40:37+02:00 vpn Access-Reject 'dolezalt' station: 188.191.42.38 auth-type: - realm: vse.cz nas: <redacted> called: <redacted> => address-pool: - msg: '<redacted>' show less	Brute-Force Web App Attack
🇸🇬 garrymenata	2026-08-24 00:46:08 (1 month ago)	188.191.42.38 - - [24/Aug/2026:01:51:05 +0700] "GET / HTTP/1.1" 403 3258 "-" "Dalvik/2.1.0 (Linux; U ... show more 188.191.42.38 - - [24/Aug/2026:01:51:05 +0700] "GET / HTTP/1.1" 403 3258 "-" "Dalvik/2.1.0 (Linux; U; Android 12; Dcolor GD2 Build/SGZ4.240805.001)" 188.191.42.38 - - [24/Aug/2026:01:51:07 +0700] "GET / HTTP/1.1" 403 3258 "-" "Dalvik/2.1.0 (Linux; U; Android 12; Dcolor GD2 Build/SGZ4.240805.001)" 188.191.42.38 - - [24/Aug/2026:01:51:09 +0700] "GET / HTTP/1.1" 403 3258 "-" "Dalvik/2.1.0 (Linux; U; Android 12; Dcolor GD2 Build/SGZ4.240805.001)" ... show less	DDoS Attack Bad Web Bot
🇺🇸 鬼影233	2026-08-20 16:49:20 (1 month ago)	Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Sa ... show more Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36 show less	Bad Web Bot
🇫🇷 Zkillu	2026-08-19 22:29:28 (1 month ago)	UDP flood (DDoS) vs AS215599: 36061 pkts / 51.57 MB to UDP 80/8443 across 586 dst IP(s), 2026-08-19 ... show more UDP flood (DDoS) vs AS215599: 36061 pkts / 51.57 MB to UDP 80/8443 across 586 dst IP(s), 2026-08-19 21:46 to 2026-08-20 00:36 CEST. No legitimate service on these UDP ports (7-day baseline 0 GB/day). Carpet-bombing of a /24, likely botnet-compromised host. Evidence: sFlow + hardware ACL counters. show less	DDoS Attack Exploited Host
🇫🇷 dmallet	2026-08-19 22:29:28 (1 month ago)	UDP flood (DDoS) vs AS215599: 36061 pkts / 51.57 MB to UDP 80/8443 across 586 dst IP(s), 2026-08-19 ... show more UDP flood (DDoS) vs AS215599: 36061 pkts / 51.57 MB to UDP 80/8443 across 586 dst IP(s), 2026-08-19 21:46 to 2026-08-20 00:36 CEST. No legitimate service on these UDP ports (7-day baseline 0 GB/day). Carpet-bombing of a /24, likely botnet-compromised host. Evidence: sFlow + hardware ACL counters. show less	DDoS Attack Exploited Host
🇺🇸 kosada.com	2026-08-16 13:08:48 (2 months ago)	Web bot: DDoS	DDoS Attack Bad Web Bot
🇩🇪 Vegascosmetics	2026-08-07 18:12:11 (2 months ago)	Kingcopy.org AI-IDS (Vegas Cosmetics shop): auto-blocked after deep/obfuscated attack (encoding nest ... show more Kingcopy.org AI-IDS (Vegas Cosmetics shop): auto-blocked after deep/obfuscated attack (encoding nesting / CPU-drain risk). Evidence: DEEP ATTACK: Recursive currentUrl nesting detected show less	Hacking Exploited Host Web App Attack
🇺🇸 kosada.com	2026-07-31 12:05:02 (2 months ago)	Web bot: denial-of-service flood	DDoS Attack Bad Web Bot

Showing 1 to 15 of 21 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇳🇱 151.245.151.137

🇳🇱 151.245.151.74

🇩🇪 57.129.120.143

🇬🇧 2.57.17.4

🇺🇸 209.222.10.172

🇺🇸 205.210.31.26

🇲🇦 196.92.7.246

🇫🇷 185.187.169.232

🇳🇱 151.245.151.216

🇺🇸 147.185.132.35

🇧🇩 116.204.228.109

🇻🇳 115.74.7.119

🇸🇬 109.123.238.248

🇵🇹 85.240.193.104

🇺🇸 38.9.233.76

🇺🇸 35.223.251.25

🇺🇸 35.221.58.74

🇬🇧 35.203.210.46

🇺🇸 20.163.11.72

🇺🇸 13.111.58.249