JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 198.44.138.52

198.44.138.52 was found in our database!

This IP was reported 69 times. Confidence of Abuse is 30%: ?

30%

ISP	tzulo, inc.
Usage Type	Data Center/Web Hosting/Transit
ASN	AS11878
Hostname(s)	static-198-44-138-52.cust.tzulo.com
Domain Name	tzulo.com
Country	🇺🇸 United States of America
City	Atlanta, Georgia

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 198.44.138.52

Whois 198.44.138.52

IP Abuse Reports for 198.44.138.52:

This IP address has been reported a total of 69 times from 34 distinct sources. 198.44.138.52 was first reported on April 11th 2025, and the most recent report was 1 day ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇺🇸 jfz-abuse	2026-07-17 17:30:29 (1 day ago)	fail2ban: apache-filepath-recon ...	Web App Attack
🇺🇸 hyena	2026-07-17 01:06:58 (1 day ago)	Repeated mod_security events.	Web App Attack
Anonymous	2026-07-05 02:42:40 (1 week ago)	Try to connect to Port_Scan_34555_stealth	Port Scan
🇩🇪 expandmade.com	2026-06-19 17:09:39 (4 weeks ago)	trolling for installation vulnerabilities [19/Jun/2026:17:09:39 "GET /shop"]	Web App Attack
🇺🇸 LSPCCU	2026-05-31 07:14:35 (1 month ago)	TSEC Honeypot Network report. Threat score: 92/100. Categories: Port Scan, Hacking, Brute-Force, Web ... show more TSEC Honeypot Network report. Threat score: 92/100. Categories: Port Scan, Hacking, Brute-Force, Web App Attack, SSH. Honeypot: cowrie, ssh-telnet. Context: 198. show less	Port Scan Hacking Brute-Force Web App Attack SSH
🇺🇸 rdpguard.com	2026-05-30 00:42:41 (1 month ago)	RdpGuard detected brute-force attempt on HTTP	Brute-Force
🇳🇱 homeshowdomain.nl	2026-05-19 22:00:28 (1 month ago)	Auto-ban: single probe for restricted files (.env / backups / admin endpoints). Likely mass-scan on ... show more Auto-ban: single probe for restricted files (.env / backups / admin endpoints). Likely mass-scan on 2026-05-18. show less	Web App Attack SSH Hacking
🇬🇧 consul.to	2026-05-19 10:12:25 (1 month ago)	Web attack/malicious scanning detected	Web App Attack
🇺🇸 TPI-Abuse	2026-05-19 09:12:10 (1 month ago)	(mod_security) mod_security (id:949110) triggered by 198.44.138.52 (static-198-44-138-52.cust.tzulo. ... show more (mod_security) mod_security (id:949110) triggered by 198.44.138.52 (static-198-44-138-52.cust.tzulo.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue May 19 05:12:03.956698 2026] [security2:error] [pid 26291:tid 26291] [client 198.44.138.52:60840] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.sh-llc.armstrongenvironmental.com"] [uri "/.git/config"] [unique_id "agwpYxtcQ0DV5KsPitvioQAAAAA"] show less	Brute-Force Bad Web Bot Web App Attack
🇦🇹 SchiWaGoA	2026-05-19 08:24:45 (1 month ago)	This IP was detected by CrowdSec trigger from crowdsecurity/http-sensitive-files	Web App Attack Hacking
🇺🇸 TPI-Abuse	2026-05-19 08:08:36 (1 month ago)	(mod_security) mod_security (id:210492) triggered by 198.44.138.52 (static-198-44-138-52.cust.tzulo. ... show more (mod_security) mod_security (id:210492) triggered by 198.44.138.52 (static-198-44-138-52.cust.tzulo.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue May 19 04:08:33.081683 2026] [security2:error] [pid 14079:tid 14079] [client 198.44.138.52:56107] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.network.redtraffic.media"] [uri "/.git/config"] [unique_id "agwagSqEYrMPDixo5jv5RAAAAAY"] show less	Brute-Force Bad Web Bot Web App Attack
Anonymous	2026-05-19 08:01:03 (1 month ago)	(caddyscan) Scanner path probe from 198.44.138.52 (US/United States/static-198-44-138-52.cust.tzulo. ... show more (caddyscan) Scanner path probe from 198.44.138.52 (US/United States/static-198-44-138-52.cust.tzulo.com): 5 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: [REDACTED] 200 2627 198.44.138.52 - - [19/May/2026:08:00:58 +0000] "GET /.git/config HTTP/1.1" [REDACTED] 200 2627 198.44.138.52 - - [19/May/2026:08:00:58 +0000] "GET /.env HTTP/1.1" [REDACTED] 200 2627 198.44.138.52 - - [19/May/2026:08:00:58 +0000] "GET /.git/config HTTP/1.1" [REDACTED] 200 2627 198.44.138.52 - - [19/May/2026:08:00:58 +0000] "GET /.env.production HTTP/1.1" [REDACTED] 200 2627 198.44.138.52 - - [19/May/2026:08:00:59 +0000] "GET /.env.prod HTTP/1.1" show less	Port Scan
🇺🇸 TPI-Abuse	2026-05-19 04:09:34 (1 month ago)	(mod_security) mod_security (id:210492) triggered by 198.44.138.52 (static-198-44-138-52.cust.tzulo. ... show more (mod_security) mod_security (id:210492) triggered by 198.44.138.52 (static-198-44-138-52.cust.tzulo.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue May 19 00:09:28.880727 2026] [security2:error] [pid 14387:tid 14387] [client 198.44.138.52:60114] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "russiacoin.info"] [uri "/.git/config"] [unique_id "agvieGMu8CR0hN-3xmSzsQAAACs"] show less	Brute-Force Bad Web Bot Web App Attack
Anonymous	2026-05-19 03:46:03 (1 month ago)	Bot / scanning and/or hacking attempts: GET /server.js HTTP/1.1, GET /.git/config HTTP/1.1, GET /src ... show more Bot / scanning and/or hacking attempts: GET /server.js HTTP/1.1, GET /.git/config HTTP/1.1, GET /src/.env HTTP/1.1, GET /.env.production HTTP/1.1, GET /config.env HTTP/1.1, GET /.env.local HTTP/1.1, GET /.env.prod HTTP/1.1 show less	Hacking Web App Attack
🇺🇸 TPI-Abuse	2026-05-18 20:46:01 (2 months ago)	(mod_security) mod_security (id:210492) triggered by 198.44.138.52 (static-198-44-138-52.cust.tzulo. ... show more (mod_security) mod_security (id:210492) triggered by 198.44.138.52 (static-198-44-138-52.cust.tzulo.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon May 18 16:45:53.700551 2026] [security2:error] [pid 23020:tid 23020] [client 198.44.138.52:61370] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.vitality-web.com"] [uri "/.env"] [unique_id "agt6gftVCsNoyoouDHCEugAAABc"] show less	Brute-Force Bad Web Bot Web App Attack

Showing 1 to 15 of 69 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇪🇨 200.24.137.144

🇱🇹 45.227.254.170

🇨🇦 20.151.10.161

🇯🇵 203.25.124.20

🇺🇸 198.57.219.18

🇨🇳 116.177.172.108

🇻🇳 116.110.2.211

🇫🇮 77.105.130.244

🇺🇸 45.146.54.82

🇺🇸 45.146.54.46

🇺🇸 45.146.54.41

🇬🇧 45.133.173.64

🇺🇸 35.237.94.18

🇮🇷 5.202.105.236

🇮🇹 194.60.212.168

🇳🇱 176.65.148.244

🇮🇩 163.7.11.126

🇫🇮 147.185.133.43

🇮🇷 85.133.145.253

🇧🇿 45.227.254.156