JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 38.9.221.21

38.9.221.21 was found in our database!

This IP was reported 24 times. Confidence of Abuse is 33%: ?

33%

ISP	SOMOS NETWORKS COLOMBIA S.A.S. BIC
Usage Type	Fixed Line ISP
ASN	AS271957
Hostname(s)	dinamic-somos-38-9-221-21.somosinternet.co
Domain Name	somos.com
Country	🇨🇴 Colombia
City	Medellin, Antioquia

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 38.9.221.21

Whois 38.9.221.21

IP Abuse Reports for 38.9.221.21:

This IP address has been reported a total of 24 times from 16 distinct sources. 38.9.221.21 was first reported on October 19th 2025, and the most recent report was 1 day ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇫🇷 Tilellit.PRO	2026-10-22 02:30:35 (1 day ago)	PrestaShop faceted search filter flooding attempt	DDoS Attack Bad Web Bot
Anonymous	2026-10-16 05:36:28 (1 week ago)	apache vulnerability scan	Web App Attack
🇺🇸 TPI-Abuse	2026-10-04 00:22:50 (2 weeks ago)	(mod_security) mod_security (id:210350) triggered by 38.9.221.21 (Dinamic-Somos-38-9-221-21.somosint ... show more (mod_security) mod_security (id:210350) triggered by 38.9.221.21 (Dinamic-Somos-38-9-221-21.somosinternet.co): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 03 20:22:45.992859 2026] [security2:error] [pid 27879:tid 27879] [client 38.9.221.21:33188] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close\|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close\|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found\|\|rockhillcounselors.com\|F\|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rockhillcounselors.com"] [uri "/"] [unique_id "asGcVXSTdzpisTwEZmWrNgAAAAY"], referer: https://backlinktracker.online/dir/backlink-building-services-178021 show less	Brute-Force Bad Web Bot Web App Attack
🇮🇹 A000Z	2026-09-22 00:18:42 (1 month ago)	Fail2Ban: 38.9.221.21 was banned for Aggressive Bad Bot detected by Nginx/Fail2Ban. UA: Mozilla/5.0 ... show more Fail2Ban: 38.9.221.21 was banned for Aggressive Bad Bot detected by Nginx/Fail2Ban. UA: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 show less	Bad Web Bot
Anonymous	2026-09-21 10:38:02 (1 month ago)	WEB attack	Brute-Force
🇺🇸 鬼影233	2026-09-05 04:56:34 (1 month ago)	Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Sa ... show more Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 show less	Bad Web Bot
🇺🇸 鬼影233	2026-09-02 16:11:35 (1 month ago)	Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Sa ... show more Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36 show less	Bad Web Bot
🇩🇪 pltcldvlpr	2026-08-31 03:56:25 (1 month ago)	Bogus Useragent: 38.9.221.21 - - [31/Aug/2026:05:56:24 +0200] "GET /protocol?id=hh_17_54&paragraph=5 ... show more Bogus Useragent: 38.9.221.21 - - [31/Aug/2026:05:56:24 +0200] "GET /protocol?id=hh_17_54&paragraph=5873110&seq=860 HTTP/1.1" 444 0 "-" "Mozilla/5.0 (compatible; MSIE 6.0; Windows NT 5.0; Trident/3.1)" asn=271957 org="SOMOS NETWORKS COLOMBIA S.A.S. BIC" country=CO ... show less	Bad Web Bot
🇺🇸 kosada.com	2026-08-26 18:54:48 (1 month ago)	Web bot: denial-of-service flood	DDoS Attack Bad Web Bot
🇺🇸 鬼影233	2026-08-26 06:31:44 (1 month ago)	Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0. ... show more Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 show less	Bad Web Bot
🇸🇬 garrymenata	2026-08-24 02:14:50 (1 month ago)	38.9.221.21 - - [24/Aug/2026:02:40:35 +0700] "GET / HTTP/1.1" 403 3258 "-" "Dalvik/2.1.0 (Linux; U; ... show more 38.9.221.21 - - [24/Aug/2026:02:40:35 +0700] "GET / HTTP/1.1" 403 3258 "-" "Dalvik/2.1.0 (Linux; U; Android 12; Dcolor GD2 Build/SGZ4.240805.001)" 38.9.221.21 - - [24/Aug/2026:02:40:37 +0700] "GET / HTTP/1.1" 403 3258 "-" "Dalvik/2.1.0 (Linux; U; Android 12; Dcolor GD2 Build/SGZ4.240805.001)" 38.9.221.21 - - [24/Aug/2026:02:40:39 +0700] "GET / HTTP/1.1" 403 3258 "-" "Dalvik/2.1.0 (Linux; U; Android 12; Dcolor GD2 Build/SGZ4.240805.001)" ... show less	DDoS Attack Bad Web Bot
🇫🇷 Sklurk	2026-08-22 20:36:14 (2 months ago)	Web App Attack	Web App Attack
🇫🇷 Zkillu	2026-08-19 20:29:09 (2 months ago)	UDP flood (DDoS) vs AS215599: 700 pkts / 1 MB to UDP 80/8443 across 216 dst IP(s), 2026-08-19 21:46 ... show more UDP flood (DDoS) vs AS215599: 700 pkts / 1 MB to UDP 80/8443 across 216 dst IP(s), 2026-08-19 21:46 to 2026-08-20 00:36 CEST. No legitimate service on these UDP ports (7-day baseline 0 GB/day). Carpet-bombing of a /24, likely botnet-compromised host. Evidence: sFlow + hardware ACL counters. show less	DDoS Attack Exploited Host
🇫🇷 HaloAgencySAS	2026-08-19 20:29:09 (2 months ago)	UDP flood (DDoS) vs AS215599: 700 pkts / 1 MB to UDP 80/8443 across 216 dst IP(s), 2026-08-19 21:46 ... show more UDP flood (DDoS) vs AS215599: 700 pkts / 1 MB to UDP 80/8443 across 216 dst IP(s), 2026-08-19 21:46 to 2026-08-20 00:36 CEST. No legitimate service on these UDP ports (7-day baseline 0 GB/day). Carpet-bombing of a /24, likely botnet-compromised host. Evidence: sFlow + hardware ACL counters. show less	DDoS Attack Exploited Host
🇫🇷 Sklurk	2026-08-18 08:17:45 (2 months ago)	Web App Attack	Web App Attack

Showing 1 to 15 of 24 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇩🇰 198.167.206.135

🇬🇧 185.247.137.99

🇬🇧 185.216.145.183

🇨🇴 181.51.89.42

🇨🇳 180.101.149.231

🇩🇪 165.22.22.165

🇨🇳 121.43.53.237

🇨🇳 121.41.164.30

🇷🇸 109.92.31.249

🇮🇶 93.180.222.57

🇺🇸 23.134.168.19

🇺🇸 209.145.49.159

🇺🇿 198.163.192.183

🇳🇱 195.178.110.247

🇨🇳 182.242.168.49

🇮🇩 182.10.137.208

🇦🇷 181.46.9.7

🇷🇺 176.112.110.158

🇺🇸 172.233.179.122

🇩🇪 161.35.68.120