AbuseIPDB » 217.138.202.61

217.138.202.61 was found in our database!

This IP was reported 386 times. Confidence of Abuse is 42%: ?

42%

ISP	M247 LTD Sofia Infrastructure
Usage Type	Data Center/Web Hosting/Transit
Domain Name	m247.com
Country	Bulgaria
City	Sofia, Sofia-Capital

Report 217.138.202.61

Whois 217.138.202.61

IP Abuse Reports for 217.138.202.61:

This IP address has been reported a total of 386 times from 80 distinct sources. 217.138.202.61 was first reported on January 9th 2021, and the most recent report was 2 days ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp in UTC	Comment	Categories
TPI-Abuse	2024-07-01 07:51:07 (5 months ago)	(mod_security) mod_security (id:210492) triggered by 217.138.202.61 (-): 1 in the last 300 secs; Por ... show more(mod_security) mod_security (id:210492) triggered by 217.138.202.61 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jul 01 03:51:02.991677 2024] [security2:error] [pid 23579:tid 47026365331200] [client 217.138.202.61:3303] [client 217.138.202.61] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.fishrapper.com"] [uri "/sftp-config.json"] [unique_id "ZoJf5jCyA7gChOqOuY4JXwAAAMI"] show less	Brute-Force Bad Web Bot Web App Attack
MAGIC	2024-06-29 18:00:10 (5 months ago)	VM1 Bad user agents ignoring web crawling rules. Draing bandwidth	DDoS Attack Bad Web Bot
TPI-Abuse	2024-06-28 04:30:12 (5 months ago)	(mod_security) mod_security (id:210492) triggered by 217.138.202.61 (-): 1 in the last 300 secs; Por ... show more(mod_security) mod_security (id:210492) triggered by 217.138.202.61 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jun 28 00:30:08.910720 2024] [security2:error] [pid 31061] [client 217.138.202.61:46081] [client 217.138.202.61] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "asiabeef.network"] [uri "/bak/sftp-config.json"] [unique_id "Zn48UJ_BozrfekmzuotmYgAAAAE"] show less	Brute-Force Bad Web Bot Web App Attack
CryptoYakari	2024-06-24 21:20:59 (5 months ago)	217.138.202.61 - - [25/Jun/2024:00:20:53 +0300] "GET /bak.zip HTTP/1.0" 404 28965 "-" "-" 217. ... show more217.138.202.61 - - [25/Jun/2024:00:20:53 +0300] "GET /bak.zip HTTP/1.0" 404 28965 "-" "-" 217.138.202.61 - - [25/Jun/2024:00:20:53 +0300] "GET /bak/bak.zip HTTP/1.0" 404 28998 "-" "-" 217.138.202.61 - - [25/Jun/2024:00:20:54 +0300] "HEAD /restore/dump.sql HTTP/1.0" 404 436 "-" "-" 217.138.202.61 - - [25/Jun/2024:00:20:56 +0300] "GET /backups/bak.tar HTTP/1.0" 404 29038 "-" "-" 217.138.202.61 - - [25/Jun/2024:00:20:57 +0300] "GET /old/wallet.zip HTTP/1.0" 404 29025 "-" "-" ... show less	Web Spam Blog Spam Bad Web Bot Web App Attack
hbrks	2024-06-21 19:45:11 (5 months ago)	HEAD http://p4u.xyz/__MACOSX.zip	Web Spam Web Spam Hacking Hacking Bad Web Bot Bad Web Bot
hostseries	2024-06-19 20:36:52 (5 months ago)	Trigger: LF_DISTATTACK	Brute-Force Brute-Force
TPI-Abuse	2024-06-18 14:10:29 (5 months ago)	(mod_security) mod_security (id:210730) triggered by 217.138.202.61 (-): 1 in the last 300 secs; Por ... show more(mod_security) mod_security (id:210730) triggered by 217.138.202.61 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jun 18 10:10:21.849098 2024] [security2:error] [pid 8710] [client 217.138.202.61:63775] [client 217.138.202.61] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy\|\|sailingcharterburma.com\|F\|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "sailingcharterburma.com"] [uri "/www.sql"] [unique_id "ZnGVTQro-IyuaXKdOp4U0AAAAAc"] show less	Brute-Force Brute-Force Bad Web Bot Bad Web Bot Web App Attack Web App Attack
CryptoYakari	2024-06-15 13:28:00 (5 months ago)	217.138.202.61 - - [15/Jun/2024:16:27:54 +0300] "HEAD /backup/config.json HTTP/1.0" 404 436 "-" "-"< ... show more217.138.202.61 - - [15/Jun/2024:16:27:54 +0300] "HEAD /backup/config.json HTTP/1.0" 404 436 "-" "-" 217.138.202.61 - - [15/Jun/2024:16:27:56 +0300] "HEAD /bak/credentials.txt HTTP/1.0" 404 399 "-" "-" 217.138.202.61 - - [15/Jun/2024:16:27:56 +0300] "GET /backup/website.zip HTTP/1.0" 404 29064 "-" "-" 217.138.202.61 - - [15/Jun/2024:16:27:57 +0300] "GET /bak/website.gz HTTP/1.0" 404 29025 "-" "-" 217.138.202.61 - - [15/Jun/2024:16:27:58 +0300] "GET /backups/public_html.tar HTTP/1.0" 404 29110 "-" "-" ... show less	Web Spam Web Spam Blog Spam Blog Spam Bad Web Bot Bad Web Bot Web App Attack Web App Attack
TPI-Abuse	2024-06-14 13:12:27 (5 months ago)	(mod_security) mod_security (id:210730) triggered by 217.138.202.61 (-): 1 in the last 300 secs; Por ... show more(mod_security) mod_security (id:210730) triggered by 217.138.202.61 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jun 14 09:12:21.716010 2024] [security2:error] [pid 12066] [client 217.138.202.61:37215] [client 217.138.202.61] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy\|\|lundtrading.com\|F\|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "lundtrading.com"] [uri "/bak/backup.sql"] [unique_id "ZmxBtRfm1oGfJdB8VyRUvwAAAAM"] show less	Brute-Force Brute-Force Bad Web Bot Bad Web Bot Web App Attack Web App Attack
penjaga BRIN	2024-06-13 10:02:45 (5 months ago)	Multiple WP scan detected from same source ip.-111	Brute-Force
TPI-Abuse	2024-06-13 09:14:09 (5 months ago)	(mod_security) mod_security (id:210730) triggered by 217.138.202.61 (-): 1 in the last 300 secs; Por ... show more(mod_security) mod_security (id:210730) triggered by 217.138.202.61 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jun 13 05:14:01.611617 2024] [security2:error] [pid 17704] [client 217.138.202.61:13005] [client 217.138.202.61] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy\|\|crypto-stamps.com\|F\|2"] [data ".dat"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "crypto-stamps.com"] [uri "/backups/wallet.dat"] [unique_id "Zmq4WbMJC04cYRVz7k-CkAAAABE"] show less	Brute-Force Bad Web Bot Web App Attack
TPI-Abuse	2024-06-09 00:02:02 (6 months ago)	(mod_security) mod_security (id:210730) triggered by 217.138.202.61 (-): 1 in the last 300 secs; Por ... show more(mod_security) mod_security (id:210730) triggered by 217.138.202.61 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Jun 08 20:01:58.446223 2024] [security2:error] [pid 55296] [client 217.138.202.61:37599] [client 217.138.202.61] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy\|\|pellman-world.com\|F\|2"] [data ".dat"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "pellman-world.com"] [uri "/wallet.dat"] [unique_id "ZmTw9u1MDNLsx7pI9DUL_AAAABY"] show less	Brute-Force Bad Web Bot Web App Attack
TPI-Abuse	2024-06-08 23:27:05 (6 months ago)	(mod_security) mod_security (id:210730) triggered by 217.138.202.61 (-): 1 in the last 300 secs; Por ... show more(mod_security) mod_security (id:210730) triggered by 217.138.202.61 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Jun 08 19:26:57.336851 2024] [security2:error] [pid 1827045] [client 217.138.202.61:7441] [client 217.138.202.61] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy\|\|otrantocapital.com\|F\|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "otrantocapital.com"] [uri "/bak/dump.sql"] [unique_id "ZmTowQQl7NPo-NxyLhf5WgAAAA0"] show less	Brute-Force Bad Web Bot Web App Attack
hbrks	2024-06-01 09:45:29 (6 months ago)	HEAD http://epay.world/restore/website.tar.gz	Web Spam Hacking Bad Web Bot
TPI-Abuse	2024-06-01 09:44:21 (6 months ago)	(mod_security) mod_security (id:210730) triggered by 217.138.202.61 (-): 1 in the last 300 secs; Por ... show more(mod_security) mod_security (id:210730) triggered by 217.138.202.61 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Jun 01 05:44:16.770555 2024] [security2:error] [pid 16275] [client 217.138.202.61:39289] [client 217.138.202.61] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy\|\|barnesandbrower.com\|F\|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "barnesandbrower.com"] [uri "/restore/mysql.sql"] [unique_id "ZlrtcI7R_WwBv-zCuLE2AgAAAAg"] show less	Brute-Force Bad Web Bot Web App Attack