JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 209.38.91.12

209.38.91.12 was found in our database!

This IP was reported 125 times. Confidence of Abuse is 0%: ?

ISP	DigitalOcean, LLC
Usage Type	Data Center/Web Hosting/Transit
ASN	AS14061
Domain Name	digitalocean.com
Country	🇦🇺 Australia
City	Sydney, New South Wales

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 209.38.91.12

Whois 209.38.91.12

IP Abuse Reports for 209.38.91.12:

This IP address has been reported a total of 125 times from 81 distinct sources. 209.38.91.12 was first reported on December 30th 2024, and the most recent report was 3 months ago.

Old Reports: The most recent abuse report for this IP address is from 3 months ago . It is possible that this IP is no longer involved in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇹🇷 rtbh.com.tr	2026-03-16 20:12:05 (3 months ago)	list.rtbh.com.tr report: tcp/0	Brute-Force
🇦🇹 urnilxfgbez	2026-03-15 23:45:00 (3 months ago)	Last 24 Hours suspicious: (DPT=445\|DPT=3389\|DPT=22\|DPT=3306\|DPT=8080\|DPT=23\|DPT=5900\|DPT=1433)	Port Scan
🇩🇪 ghostwarriors	2026-03-15 11:50:35 (3 months ago)	Unauthorized connection attempt detected, SSH Brute-Force	Brute-Force Port Scan SSH
🇩🇪 XICTRON	2026-03-15 11:35:03 (3 months ago)	SSH brute-force attempt detected by Fail2Ban	SSH
Anonymous	2026-03-15 11:31:56 (3 months ago)	Mar 15 11:31:53 madrants sshd[2241127]: Invalid user 0000 from 209.38.91.12 port 41352 Mar 15 11:31: ... show more Mar 15 11:31:53 madrants sshd[2241127]: Invalid user 0000 from 209.38.91.12 port 41352 Mar 15 11:31:54 madrants sshd[2241127]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=209.38.91.12 Mar 15 11:31:56 madrants sshd[2241127]: Failed password for invalid user 0000 from 209.38.91.12 port 41352 ssh2 ... show less	Brute-Force SSH
🇷🇺 StalKlim	2026-03-15 11:31:54 (3 months ago)	SSH brute-force attempt	SSH Brute-Force
🇺🇸 TPI-Abuse	2026-02-22 23:27:37 (4 months ago)	(mod_security) mod_security (id:210492) triggered by 209.38.91.12 (-): 1 in the last 300 secs; Ports ... show more (mod_security) mod_security (id:210492) triggered by 209.38.91.12 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Feb 22 18:27:32.422976 2026] [security2:error] [pid 3106:tid 3106] [client 209.38.91.12:59032] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "chatari.ai"] [uri "/.env"] [unique_id "aZuQ5B6MR11ni1wuDGDbNQAAAAM"] show less	Brute-Force Bad Web Bot Web App Attack
🇩🇪 igerman	2026-02-22 23:20:32 (4 months ago)	caddy probes: [web] GET / -> 401 [web] GET /debug/default/index -> 401 [web] GET /blog -> 401 [web] ... show more caddy probes: [web] GET / -> 401 [web] GET /debug/default/index -> 401 [web] GET /blog -> 401 [web] GET /demo -> 401 [web] GET /wp -> 401 [wordpress] GET /wordpress -> 401 [web] GET /new -> 401 [env-probe] GET /.env -> 401 [git-repo] GET /.git/config -> 401 [web] POST /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php -> 401 [web] POST / -> 401 [web] GET /_ignition/execute-solution -> 401 [web] GET /vendor/laravel-filemanager/js/script.js -> 401 [web] GET /public/vendor/laravel-filemanager/js/script.js -> 401 show less	Web App Attack
🇦🇺 Terrier	2026-02-22 23:00:00 (4 months ago)	Blocked for HTTP vulnerability scanning (excessive 40x)	Web App Attack
🇺🇸 TPI-Abuse	2026-02-22 22:50:20 (4 months ago)	(mod_security) mod_security (id:210492) triggered by 209.38.91.12 (-): 1 in the last 300 secs; Ports ... show more (mod_security) mod_security (id:210492) triggered by 209.38.91.12 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Feb 22 17:50:14.226889 2026] [security2:error] [pid 21945:tid 21945] [client 209.38.91.12:36588] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "chat.underraided.com"] [uri "/.env"] [unique_id "aZuIJu07C6aVD4xx-Pj8qAAAABQ"] show less	Brute-Force Bad Web Bot Web App Attack
🇻🇳 trung.fun	2026-02-22 22:47:23 (4 months ago)	DDoS, Hack, Brute Force, Web Attack ...	DDoS Attack Web Spam Hacking Brute-Force Web App Attack
🇳🇱 thedreamer.nl	2026-02-22 22:40:46 (4 months ago)	209.38.91.12 - - [22/Feb/2026:23:37:41 +0100] "GET /.env HTTP/2.0" 404 177 "-" "Mozilla/5.0 (Windows ... show more 209.38.91.12 - - [22/Feb/2026:23:37:41 +0100] "GET /.env HTTP/2.0" 404 177 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" "AU" "Sydney" "-33.89780" "151.18990" 209.38.91.12 - - [22/Feb/2026:23:37:41 +0100] "GET /wp HTTP/2.0" 404 177 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" "AU" "Sydney" "-33.89780" "151.18990" 209.38.91.12 - - [22/Feb/2026:23:37:41 +0100] "GET /.git/config HTTP/2.0" 404 177 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" "AU" "Sydney" "-33.89780" "151.18990" 209.38.91.12 - - [22/Feb/2026:23:37:41 +0100] "GET /debug/default/index HTTP/2.0" 404 177 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" "AU" "Sydney" "-33.89780" "151.18990" ... show less	Brute-Force Bad Web Bot
🇳🇱 melroy89	2026-02-22 21:27:22 (4 months ago)	209.38.91.12 - - [22/Feb/2026:22:16:01 +0100] "GET / HTTP/1.1" 403 9 "-" "Mozilla/5.0 (Windows NT 1 ... show more 209.38.91.12 - - [22/Feb/2026:22:16:01 +0100] "GET / HTTP/1.1" 403 9 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" "chat.libreweb.org" 0.000 209.38.91.12 - - [22/Feb/2026:22:16:02 +0100] "GET /wp HTTP/1.1" 403 9 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" "chat.libreweb.org" 0.000 209.38.91.12 - - [22/Feb/2026:22:16:02 +0100] "GET /blog HTTP/1.1" 403 9 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" "chat.libreweb.org" 0.000 209.38.91.12 - - [22/Feb/2026:22:16:02 +0100] "GET /wordpress HTTP/1.1" 403 9 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" "chat.libreweb.org" 0.000 209.38.91.12 - - [22/Feb/2026:22:16:02 +0100] "GET / HTTP/1.1" 403 9 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/ ... show less	Web App Attack
🇺🇸 TPI-Abuse	2026-02-22 21:09:40 (4 months ago)	(mod_security) mod_security (id:210492) triggered by 209.38.91.12 (-): 1 in the last 300 secs; Ports ... show more (mod_security) mod_security (id:210492) triggered by 209.38.91.12 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Feb 22 16:09:33.963827 2026] [security2:error] [pid 6083:tid 6083] [client 209.38.91.12:39544] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "chat.kleens-uk.com"] [uri "/.env"] [unique_id "aZtwje34EZZYjocKi0p_tgAAAAo"] show less	Brute-Force Bad Web Bot Web App Attack
🇧🇾 lns.bz	2026-02-22 21:03:40 (4 months ago)	.env scanning [BY]	Web App Attack

Showing 1 to 15 of 125 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇸🇬 167.172.93.203

🇮🇳 163.61.33.117

🇵🇰 154.198.108.133

🇨🇳 106.38.99.122

🇫🇷 92.205.213.181

🇵🇰 72.255.59.169

🇺🇸 34.173.148.86

🇳🇵 27.34.70.49

🇨🇦 20.104.50.116

🇨🇳 14.103.112.105

🇲🇽 192.141.244.136

🇪🇨 190.130.136.156

🇺🇸 188.119.190.107

🇮🇶 151.236.188.215

🇧🇩 103.230.62.217

🇹🇳 41.62.183.207

🇨🇦 20.48.255.163

🇬🇧 2a06:4880:6000::78

🇬🇹 190.122.185.187

🇨🇱 186.189.85.50