JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

38.60.191.243

Neutral Activity

Abuse confidence score ?

0% Low Risk

49 reports

28 reporters · latest 8 months ago

ISP	LIGHT NODE LIMITED
Usage Type	Data Center/Web Hosting/Transit
ASN	AS154177
Domain Name	lightnode.com
Country	🇮🇩 Indonesia
City	Jakarta, Jakarta

ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report Whois

No reports in the last 60 days

38.60.191.243 has been reported 49 times. The most recent report is from 8 months ago.

The full history is preserved below and remains searchable. A 0% score reflects the absence of recent activity, but this is not a guarantee that earlier reports were invalid. Abuse confidence score decays, naturally, over time, when the abusive activity stops.

IP Abuse Reports for 38.60.191.243

Export CSV

This IP address has been reported a total of 49 times from 28 distinct sources. 38.60.191.243 was first reported on January 3rd 2026, and the most recent report was 8 months ago.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇬🇧 openstrike.co.uk	2026-01-25 06:13:10 (8 months ago)	4 attacks on password grabbing URLs: GET /.vscode/sftp.json HTTP/1.1	Hacking
🇺🇸 kosada.com	2026-01-24 18:58:33 (8 months ago)	Web vulnerability probing: /sftp-config.json	Web App Attack
🇺🇸 TPI-Abuse	2026-01-24 18:42:08 (8 months ago)	(mod_security) mod_security (id:210492) triggered by 38.60.191.243 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:210492) triggered by 38.60.191.243 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Jan 24 13:42:02.655945 2026] [security2:error] [pid 674:tid 674] [client 38.60.191.243:0] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "abdulhameeds.art"] [uri "/sftp-config.json"] [unique_id "aXUSejmu9ju7SmSf8H2VegAAAA4"] show less	Brute-Force Bad Web Bot Web App Attack
🇮🇹 Progetto1	2026-01-24 18:35:02 (8 months ago)	Website Scanning / Scraping	Bad Web Bot Exploited Host Web App Attack
🇷🇺 loveprod	2026-01-24 17:47:09 (8 months ago)	38.60.191.243 - - [24/Jan/2026:20:47:08 +0300] "GET /sftp-config.json HTTP/1.1" 301 353 "-" "Mozilla ... show more 38.60.191.243 - - [24/Jan/2026:20:47:08 +0300] "GET /sftp-config.json HTTP/1.1" 301 353 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:77.0) Gecko/20100101 Firefox/77.0" 38.60.191.243 - - [24/Jan/2026:20:47:09 +0300] "GET /sftp-config.json HTTP/1.1" 301 360 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:77.0) Gecko/20100101 Firefox/77.0" ... show less	Bad Web Bot
🇦🇺 2000cn.com.au	2026-01-24 12:31:17 (8 months ago)	This IP was detected by CrowdSec triggering crowdsecurity/http-sensitive-files	Hacking Web App Attack
🇺🇸 MPL	2026-01-24 10:35:26 (8 months ago)	tcp/80 (4 or more attempts)	Port Scan
Anonymous	2026-01-21 21:25:34 (8 months ago)	Infected user bad webscan	Exploited Host
🇨🇭 lufi	2026-01-21 18:02:25 (8 months ago)	2026-01-21 19:02:24 38.60.191.243: blacklistedPath: /sftp-config.json ...	Web Spam Hacking Brute-Force Web App Attack
🇺🇸 TPI-Abuse	2026-01-21 16:47:17 (8 months ago)	(mod_security) mod_security (id:210492) triggered by 38.60.191.243 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:210492) triggered by 38.60.191.243 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jan 21 11:47:12.138536 2026] [security2:error] [pid 25724:tid 25724] [client 38.60.191.243:0] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "365soft.top"] [uri "/sftp-config.json"] [unique_id "aXEDEEJzfIIdvMULGL30xwAAAAc"] show less	Brute-Force Bad Web Bot Web App Attack
🇪🇸 latticed5440	2026-01-21 16:44:18 (8 months ago)	Requested unexistent endpoint (Wordpress login, etc.)	Web App Attack
🇷🇺 loveprod	2026-01-21 16:39:36 (8 months ago)	38.60.191.243 - - [21/Jan/2026:19:39:34 +0300] "GET /sftp-config.json HTTP/1.1" 301 358 "-" "Mozilla ... show more 38.60.191.243 - - [21/Jan/2026:19:39:34 +0300] "GET /sftp-config.json HTTP/1.1" 301 358 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:77.0) Gecko/20100101 Firefox/77.0" 38.60.191.243 - - [21/Jan/2026:19:39:36 +0300] "GET /sftp-config.json HTTP/1.1" 404 55356 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:77.0) Gecko/20100101 Firefox/77.0" ... show less	Bad Web Bot
🇫🇷 Baking333	2026-01-21 16:08:33 (8 months ago)	[redacted] 38.60.191.243 - - [21/Jan/2026:17:08:30 +0100] "GET /[redacted] HTTP/1.1" 302 5288 0/4239 ... show more [redacted] 38.60.191.243 - - [21/Jan/2026:17:08:30 +0100] "GET /[redacted] HTTP/1.1" 302 5288 0/42395 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:77.0) Gecko/20100101 Firefox/77.0" [redacted] 38.60.191.243 - - [21/Jan/2026:17:08:32 +0100] "GET /.vscode/[redacted] HTTP/1.1" 302 5288 0/37947 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:77.0) Gecko/20100101 Firefox/77.0" show less	Bad Web Bot Web App Attack
🇬🇧 poundawebsiteltd	2026-01-21 16:00:50 (8 months ago)	Web App Attack (ModSecurity Block). Evidence: [REDACTED_DOMAIN]:443 38.60.191.243 - - [21/Jan/2026:1 ... show more Web App Attack (ModSecurity Block). Evidence: [REDACTED_DOMAIN]:443 38.60.191.243 - - [21/Jan/2026:16:00:48 +0000] GET /.vscode/sftp.json HTTP/1.1 403 2893 - Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:77.0) Gecko/20100101 Firefox/77.0 show less	Web App Attack
🇳🇱 Mangelot Hosting	2026-01-21 12:52:54 (8 months ago)	(modsecurity) srv201 ModSecurity 38.60.191.243 (ID/Indonesia/-): 5 in the last 3600 secs; Ports: ; ... show more (modsecurity) srv201 ModSecurity 38.60.191.243 (ID/Indonesia/-): 5 in the last 3600 secs; Ports: ; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: show less	Web App Attack

Showing 1 to 15 of 49 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇺🇸 162.216.150.58

🇺🇸 136.108.71.251

🇻🇳 42.117.2.215

🇺🇸 2a10:4a01:d55f:bfda:bf9f:9cfe:792:7014

🇷🇺 188.187.56.170

🇨🇱 179.238.35.236

🇺🇸 159.223.189.142

🇺🇸 152.32.236.102

🇨🇦 149.56.133.65

🇨🇳 119.249.100.107

🇮🇹 87.18.172.179

🇸🇬 43.173.175.197

🇺🇸 43.166.247.82

🇺🇸 20.65.178.121

🇫🇷 173.249.13.194

🇬🇧 165.232.45.66

🇮🇩 163.7.1.156

🇮🇳 152.59.47.94

🇺🇸 103.143.11.150

🇨🇦 45.198.224.89