JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 38.134.138.109

38.134.138.109 was found in our database!

This IP was reported 16 times. Confidence of Abuse is 47%: ?

47%

ISP	Cogent Communications, LLC
Usage Type	Fixed Line ISP
ASN	AS136336
Domain Name	cogentco.com
Country	🇮🇳 India
City	Chennai, Tamil Nadu

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 38.134.138.109

Whois 38.134.138.109

IP Abuse Reports for 38.134.138.109:

This IP address has been reported a total of 16 times from 9 distinct sources. 38.134.138.109 was first reported on July 25th 2025, and the most recent report was 21 hours ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇺🇸 kosada.com	2026-07-26 17:20:11 (21 hours ago)	Web bot: denial-of-service flood	DDoS Attack Bad Web Bot
🇬🇧 Apache	2026-07-21 10:04:50 (6 days ago)	(mod_security) mod_security (id:240335) triggered by 38.134.138.109 (IN/India/-): 5 in the last 300 ... show more (mod_security) mod_security (id:240335) triggered by 38.134.138.109 (IN/India/-): 5 in the last 300 secs show less	Brute-Force Web App Attack
🇺🇸 TPI-Abuse	2026-07-21 10:03:46 (6 days ago)	(mod_security) mod_security (id:240335) triggered by 38.134.138.109 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:240335) triggered by 38.134.138.109 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jul 21 06:03:40.318728 2026] [security2:error] [pid 2595994:tid 2595994] [client 38.134.138.109:5854] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 38.134.138.109 (+1 hits since last alert)\|bosdkbook.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "bosdkbook.com"] [uri "/xmlrpc.php"] [unique_id "al9D_IbuErhC4e0gH4JI_AAAAAA"] show less	Brute-Force Bad Web Bot Web App Attack
Anonymous	2026-07-21 10:00:19 (6 days ago)	Bot / scanning and/or hacking attempts: POST /xmlrpc.php HTTP/1.1	Hacking Web App Attack
🇩🇪 abdubhai	2026-07-21 08:27:44 (6 days ago)	38.134.138.109 - - [21/Jul/2026: ...	Brute-Force
Anonymous	2026-07-21 07:56:46 (6 days ago)	[redacted] 38.134.138.109 - - [21/Jul/2026:09:56:03 +0200] "POST /xmlrpc.php HTTP/1.1" 405 428 "-" " ... show more [redacted] 38.134.138.109 - - [21/Jul/2026:09:56:03 +0200] "POST /xmlrpc.php HTTP/1.1" 405 428 "-" "WordPress.com; https://wordpress.com" [redacted] 38.134.138.109 - - [21/Jul/2026:09:56:13 +0200] "POST /xmlrpc.php HTTP/1.1" 405 428 "-" "Jetpack/12.5; WordPress/6.1; http://site35891253.com" [redacted] 38.134.138.109 - - [21/Jul/2026:09:56:23 +0200] "POST /xmlrpc.php HTTP/1.1" 405 428 "-" "Jetpack by WordPress.com" [redacted] 38.134.138.109 - - [21/Jul/2026:09:56:34 +0200] "POST /xmlrpc.php HTTP/1.1" 405 428 "-" "Jetpack by WordPress.com" [redacted] 38.134.138.109 - - [21/Jul/2026:09:56:45 +0200] "POST /xmlrpc.php HTTP/1.1" 405 428 "-" "WordPress.com; https://wordpress.com" ... show less	Hacking Web App Attack
🇺🇸 TPI-Abuse	2026-07-21 06:56:54 (6 days ago)	(mod_security) mod_security (id:240335) triggered by 38.134.138.109 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:240335) triggered by 38.134.138.109 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jul 21 02:56:47.730795 2026] [security2:error] [pid 6821:tid 6821] [client 38.134.138.109:4825] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 38.134.138.109 (+1 hits since last alert)\|talkingmess.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "talkingmess.com"] [uri "/xmlrpc.php"] [unique_id "al8YL1PMUAc7liNRTg-m_gAAAAQ"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-07-21 05:54:13 (6 days ago)	(mod_security) mod_security (id:240335) triggered by 38.134.138.109 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:240335) triggered by 38.134.138.109 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jul 21 01:54:07.147023 2026] [security2:error] [pid 31014:tid 31014] [client 38.134.138.109:18867] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 38.134.138.109 (+1 hits since last alert)\|ucommsi.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "ucommsi.com"] [uri "/xmlrpc.php"] [unique_id "al8JfxUSRLuKDY2JpElA5gAAAAU"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 stechusa	2026-07-12 04:09:34 (2 weeks ago)	ELEVATED_THREAT \| 10 IPs targeting /category.html \| Facet request during elevated threat (facet_rati ... show more ELEVATED_THREAT \| 10 IPs targeting /category.html \| Facet request during elevated threat (facet_ratio=0.99, unique_ips=610) \| Recv-Q=1489 bytes on ESTABLISHED connection (threshold=1000) show less	Bad Web Bot DDoS Attack
🇩🇪 dbmwebdesign	2026-06-30 04:10:44 (3 weeks ago)	WordPress login brute-force detected by Fail2Ban in plesk-wordpress jail	Brute-Force Web App Attack
🇳🇱 exxos	2025-07-30 01:26:16 (11 months ago)	http-no-verb	Hacking
🇳🇱 exxos	2025-07-29 00:57:11 (11 months ago)	http-no-verb	Hacking
🇳🇱 exxos	2025-07-28 02:40:41 (11 months ago)	http-no-verb	Hacking
🇳🇱 exxos	2025-07-27 23:26:54 (11 months ago)	http-no-verb	Hacking
🇳🇱 exxos	2025-07-27 22:57:14 (11 months ago)	http-no-verb	Hacking

Showing 1 to 15 of 16 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇨🇳 218.25.89.208

🇺🇸 104.28.240.189

🇺🇸 104.28.208.188

🇦🇱 79.98.114.27

🇺🇸 23.95.80.215

🇺🇸 132.148.132.251

🇨🇳 118.123.1.32

🇺🇸 109.105.209.18

🇮🇩 103.148.79.138

🇺🇸 2a01:111:f403:c112::5

🇨🇳 175.30.48.20

🇧🇷 147.15.20.173

🇨🇳 120.52.92.86

🇹🇼 114.35.59.237

🇨🇳 106.13.38.13

🇷🇴 2.57.121.112

🇨🇳 220.167.232.180

🇮🇩 180.247.60.177

🇫🇷 85.217.140.3

🇨🇴 69.6.234.27