JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 168.199.244.210

168.199.244.210 was found in our database!

This IP was reported 7 times. Confidence of Abuse is 0%: ?

ISP	Darkness Reigns (Holding) B.V.
Usage Type	Data Center/Web Hosting/Transit
ASN	AS60781
Domain Name	darkness-reigns.net
Country	🇳🇱 Netherlands
City	Amsterdam, North Holland

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 168.199.244.210

Whois 168.199.244.210

IP Abuse Reports for 168.199.244.210:

This IP address has been reported a total of 7 times from 3 distinct sources. 168.199.244.210 was first reported on January 31st 2025, and the most recent report was 5 months ago.

Old Reports: The most recent abuse report for this IP address is from 5 months ago . It is possible that this IP is no longer involved in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇺🇸 TPI-Abuse	2026-01-17 00:24:04 (5 months ago)	(mod_security) mod_security (id:210730) triggered by 168.199.244.210 (-): 1 in the last 300 secs; Po ... show more (mod_security) mod_security (id:210730) triggered by 168.199.244.210 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jan 16 19:22:47.345827 2026] [security2:error] [pid 5944:tid 5944] [client 168.199.244.210:59505] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy\|\|ftp.nbcnewsradio.com\|F\|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "ftp.nbcnewsradio.com"] [uri "/db_backup.sql"] [unique_id "aWrWV-bIthP33TtAw_dFtQAAABs"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2025-12-29 19:14:03 (5 months ago)	(mod_security) mod_security (id:210492) triggered by 168.199.244.210 (-): 1 in the last 300 secs; Po ... show more (mod_security) mod_security (id:210492) triggered by 168.199.244.210 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Dec 29 14:13:27.651684 2025] [security2:error] [pid 22842:tid 23013] [client 168.199.244.210:46019] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpcontacts.kettlehill.com"] [uri "/.env.cpcontacts"] [unique_id "aVLS11KoonkfA7MmLZchRwAAAQ0"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2025-11-13 08:54:04 (7 months ago)	(mod_security) mod_security (id:211190) triggered by 168.199.244.210 (-): 1 in the last 300 secs; Po ... show more (mod_security) mod_security (id:211190) triggered by 168.199.244.210 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 13 03:53:57.288569 2025] [security2:error] [pid 26412:tid 26412] [client 168.199.244.210:37615] ModSecurity: Access denied with code 403 (phase 2). Match of "contains cpanel" against "REQUEST_URI" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "55"] [id "211190"] [rev "9"] [msg "COMODO WAF: Remote File Access Attempt\|\|ftp.nbcnewsradio.com\|F\|2"] [data "Matched Data: /etc/ found within REQUEST_URI: /photoalbum/index.php?urlancien&url=../../../../../../../../../../../../etc/passwd%00"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "ftp.nbcnewsradio.com"] [uri "/photoalbum/index.php"] [unique_id "aRWcpV-bdEkUnVedhzYpEwAAAAE"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2025-07-27 00:23:25 (10 months ago)	(mod_security) mod_security (id:212620) triggered by 168.199.244.210 (-): 1 in the last 300 secs; Po ... show more (mod_security) mod_security (id:212620) triggered by 168.199.244.210 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Jul 26 20:22:59.742884 2025] [security2:error] [pid 172499:tid 172630] [client 168.199.244.210:51901] ModSecurity: Access denied with code 403 (phase 2). Pattern match "<script\\\\b" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/07_XSS_XSS.conf"] [line "65"] [id "212620"] [rev "4"] [msg "COMODO WAF: Cross-site Scripting (XSS) Attack\|\|ftp.kettlehill.net\|F\|2"] [data "Matched Data: <script found within REQUEST_URI: /examples/jsp/snp/snoop.jsp;<script>alert(document.domain)</script>test.jsp"] [severity "CRITICAL"] [tag "CWAF"] [tag "XSS"] [hostname "ftp.kettlehill.net"] [uri "/examples/jsp/snp/snoop.jsp;<script>alert(document.domain)</script>test.jsp"] [unique_id "aIVxY4En7YGnahfIo_jLrgAAAVg"], referer: http://ftp.kettlehill.net/examples/jsp/snp/snoop.jsp;%3Cscript%3Ealert%28document.domain%29%3C/script%3Etest.jsp show less	Brute-Force Bad Web Bot Web App Attack
Anonymous	2025-06-22 22:43:35 (1 year ago)	Ports: 2077,2078,2082,2083,2086,2087,2095,2096; Direction: 0; Trigger: LF_DISTATTACK	Brute-Force SSH
🇺🇸 TPI-Abuse	2025-05-29 21:39:11 (1 year ago)	(mod_security) mod_security (id:210492) triggered by 168.199.244.210 (-): 1 in the last 300 secs; Po ... show more (mod_security) mod_security (id:210492) triggered by 168.199.244.210 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu May 29 17:39:07.397493 2025] [security2:error] [pid 3567488:tid 3567488] [client 168.199.244.210:32877] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "webmail.farmers123.com"] [uri "/static../.git/config"] [unique_id "aDjT--2NggczWbnAsH2EOAAAAAQ"] show less	Brute-Force Bad Web Bot Web App Attack
Anonymous	2025-01-31 08:50:04 (1 year ago)	\| Shellshock attack attempt	Hacking SQL Injection Web App Attack

Showing 1 to 7 of 7 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇭🇰 45.142.154.99

🇮🇳 182.95.123.50

🇫🇷 157.173.106.113

🇨🇳 116.228.233.93

🇮🇳 116.73.221.70

🇫🇷 91.196.152.181

🇺🇸 69.63.184.147

🇨🇦 54.39.203.23

🇭🇰 45.192.204.105

🇺🇸 44.170.238.247

🇸🇬 35.247.130.178

🇧🇪 34.62.14.29

🇺🇸 20.65.193.76

🇮🇳 206.1.62.191

🇨🇦 148.113.130.130

🇨🇳 101.126.11.137

🇷🇺 95.25.44.86

🇺🇸 69.63.184.136

🇺🇸 44.20.203.144

🇺🇸 205.210.31.13