JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

156.239.210.2

Neutral Activity

Abuse Confidence Score

0% Low Risk

9 reports

6 reporters · latest 9 months ago

ISP: Wave Broadband
Usage Type: Fixed Line ISP
ASN: AS11404
Domain Name: astound.com
Country: 🇺🇸 United States of America
City: Santa Clara, California

ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report Whois

No reports in the last 60 days

156.239.210.2 has been reported 9 times. The most recent report is from 9 months ago.

The full history is preserved below and remains searchable. A 0% score reflects the absence of recent activity, but this is not a guarantee that earlier reports were invalid. Abuse confidence score decays, naturally, over time, when the abusive activity stops.

Abuse Reports

Export reports CSV

Total reports

9 from 6 distinct reporters

First reported

April 12th 2025

Most recent report

9 months ago

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇺🇸 TPI-Abuse	2026-02-09 02:55:11 UTC · (9 months ago)	(mod_security) mod_security (id:210350) triggered by 156.239.210.2 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Feb 08 21:55:08.169911 2026] [security2:error] [pid 2809:tid 2809] [client 156.239.210.2:51578] Mod ... show more (mod_security) mod_security (id:210350) triggered by 156.239.210.2 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Feb 08 21:55:08.169911 2026] [security2:error] [pid 2809:tid 2809] [client 156.239.210.2:51578] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close\|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close\|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found\|\|wave94.com\|F\|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "wave94.com"] [uri "/wp-login.php"] [unique_id "aYlMjPNye3mfnKkyWJG-2gAAAA0"], referer: https://wave94.com/wp-login.php show less	Brute-Force Bad Web Bot Web App Attack
🇩🇪 Packets-Decreaser.NET	2025-12-31 00:57:23 UTC · (10 months ago)	Incoming Layer 7 Flood Detected	DDoS Attack Web Spam
🇺🇸 TPI-Abuse	2025-12-23 21:11:24 UTC · (10 months ago)	(mod_security) mod_security (id:210350) triggered by 156.239.210.2 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Dec 23 16:11:16.430199 2025] [security2:error] [pid 1140:tid 1140] [client 156.239.210.2:26904] Mod ... show more (mod_security) mod_security (id:210350) triggered by 156.239.210.2 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Dec 23 16:11:16.430199 2025] [security2:error] [pid 1140:tid 1140] [client 156.239.210.2:26904] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close\|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close\|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found\|\|lawrencehale.com\|F\|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "lawrencehale.com"] [uri "/wp-login.php"] [unique_id "aUsFdBQjkSNnzvoEKEmseAAAAAM"], referer: https://lawrencehale.com/wp-login.php show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2025-12-10 12:56:47 UTC · (11 months ago)	(mod_security) mod_security (id:210350) triggered by 156.239.210.2 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Dec 10 07:56:41.137426 2025] [security2:error] [pid 9305:tid 9383] [client 156.239.210.2:55908] Mod ... show more (mod_security) mod_security (id:210350) triggered by 156.239.210.2 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Dec 10 07:56:41.137426 2025] [security2:error] [pid 9305:tid 9383] [client 156.239.210.2:55908] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close\|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close\|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found\|\|www.landmarkocchealth.com\|F\|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.landmarkocchealth.com"] [uri "/wp-login.php"] [unique_id "aTluCZoAcX6yTsBrOtKSfAAAAVI"], referer: http://www.landmarkocchealth.com/wp-login.php show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2025-11-23 07:59:09 UTC · (11 months ago)	(mod_security) mod_security (id:225170) triggered by 156.239.210.2 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 23 02:59:02.958579 2025] [security2:error] [pid 9803:tid 9803] [client 156.239.210.2:47717] Mod ... show more (mod_security) mod_security (id:225170) triggered by 156.239.210.2 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 23 02:59:02.958579 2025] [security2:error] [pid 9803:tid 9803] [client 156.239.210.2:47717] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)\|\|iconconstructors.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "iconconstructors.com"] [uri "/wp-json/wp/v2/users/"] [unique_id "aSK-xk6LarVwLZYbSlZ2lQAAABM"] show less	Brute-Force Bad Web Bot Web App Attack
🇧🇷 hostseries	2025-10-02 21:08:43 UTC · (1 year ago)	Trigger: LF_DISTATTACK	Brute-Force
🇩🇪 sato	2025-09-30 07:34:24 UTC · (1 year ago)	Port Scan detected from 156.239.210.2 (US/United States/-).	Port Scan
Anonymous	2025-07-31 10:25:39 UTC · (1 year ago)	Attempted brute force login to web vpn 2 time(s); last attempt for 2025.07.31 is noted in report timestamp	Hacking Brute-Force
🇺🇸 TTWebhosting	2025-04-12 14:51:15 UTC · (1 year ago)	(imapd) Failed IMAP login from 156.239.210.2 (US/United States/Texas/Dallas/-/[AS200373 3xK Tech GmbH]): 2 in the last 3600 secs	Port Scan Hacking Brute-Force

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown

Recently Reported IPs:

🇬🇧 192.248.150.180

🇹🇭 118.193.56.184

🇺🇸 192.190.221.7

🇨🇴 190.61.46.245

🇧🇷 177.11.196.84

🇺🇸 151.159.100.10

🇳🇱 45.156.87.127

🇮🇷 37.148.98.127

🇹🇼 198.235.24.43

🇬🇧 185.216.145.174

🇺🇸 184.36.72.111

🇻🇳 116.99.169.71

🇮🇳 103.109.13.50

🇺🇸 96.78.175.36

🇺🇸 91.230.168.178

🇺🇸 74.102.113.37

🇧🇸 65.75.114.221

🇧🇪 35.210.157.247

🇸🇮 31.57.37.52

🇲🇦 196.117.133.133