JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 172.216.124.210

172.216.124.210 was found in our database!

This IP was reported 12 times. Confidence of Abuse is 62%: ?

62%

ISP	Cyberzone S.A.
Usage Type	Data Center/Web Hosting/Transit
ASN	AS209854
Domain Name	cyberzonehub.com
Country	🇩🇪 Germany
City	Frankfurt am Main, Hesse

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 172.216.124.210

Whois 172.216.124.210

IP Abuse Reports for 172.216.124.210:

This IP address has been reported a total of 12 times from 10 distinct sources. 172.216.124.210 was first reported on June 15th 2026, and the most recent report was 32 minutes ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇧🇷 SOC PR	2026-06-15 04:49:57 (32 minutes ago)	IPS: Cross-Site Scripting (XSS).	Web App Attack
🇦🇺 clapper	2026-06-15 04:48:53 (33 minutes ago)	(mod_security) mod_security (id:949110) triggered by 172.216.124.210 (DE/Germany/-): 5 in the last 6 ... show more (mod_security) mod_security (id:949110) triggered by 172.216.124.210 (DE/Germany/-): 5 in the last 600 secs; ID: rub show less	Brute-Force Bad Web Bot
🇨🇿 ptlab	2026-06-15 04:45:14 (37 minutes ago)	Detected env_leak attack from WP-host.	Hacking Web App Attack
🇺🇸 TPI-Abuse	2026-06-15 04:35:53 (46 minutes ago)	(mod_security) mod_security (id:210492) triggered by 172.216.124.210 (-): 1 in the last 300 secs; Po ... show more (mod_security) mod_security (id:210492) triggered by 172.216.124.210 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jun 15 00:35:47.268414 2026] [security2:error] [pid 12110:tid 12110] [client 172.216.124.210:27306] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "fiyaplatform.com"] [uri "/.env"] [unique_id "ai-BI-nPEnQq7qCaPhZUogAAAAU"] show less	Brute-Force Bad Web Bot Web App Attack
🇪🇸 alferez	2026-06-15 04:21:21 (1 hour ago)	Searching .(env\|sql\|zip\|tar\|rar) files	Hacking Exploited Host Web App Attack
🇹🇼 kk_it_man	2026-06-15 04:00:11 (1 hour ago)		Hacking
🇱🇹 juozaspo	2026-06-15 03:28:59 (1 hour ago)	Automatic Report: Too much requests to non-existing pages, 3 in 2 seconds, auto-banned	Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-06-15 03:28:50 (1 hour ago)	(mod_security) mod_security (id:212620) triggered by 172.216.124.210 (-): 1 in the last 300 secs; Po ... show more (mod_security) mod_security (id:212620) triggered by 172.216.124.210 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Jun 14 23:28:46.534981 2026] [security2:error] [pid 20463:tid 20463] [client 172.216.124.210:42076] ModSecurity: Access denied with code 403 (phase 2). Pattern match "<script\\\\b" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/07_XSS_XSS.conf"] [line "65"] [id "212620"] [rev "4"] [msg "COMODO WAF: Cross-site Scripting (XSS) Attack\|\|www.powerkiteforum.com\|F\|2"] [data "Matched Data: <script found within REQUEST_URI: /viewthread.php?tid=<script>alert('xss')</script>"] [severity "CRITICAL"] [tag "CWAF"] [tag "XSS"] [hostname "www.powerkiteforum.com"] [uri "/viewthread.php"] [unique_id "ai9xbox5ZZzE2wtry8oKiQAAAA0"] show less	Brute-Force Bad Web Bot Web App Attack
🇹🇼 kk_it_man	2026-06-15 03:13:01 (2 hours ago)	ET INFO Request to Hidden Environment File - Inbound ET WEB_SERVER Script tag in URI Possible Cros ... show more ET INFO Request to Hidden Environment File - Inbound ET WEB_SERVER Script tag in URI Possible Cross Site Scripting Attempt GPL WEB_SERVER 403 Forbidden SURICATA HTTP Request unrecognized authorization method show less	Port Scan
🇮🇩 penjaga BRIN	2026-06-15 03:04:07 (2 hours ago)	SQL injection attempt	SQL Injection
🇺🇸 Rayulcifer	2026-06-15 02:54:40 (2 hours ago)	172.216.124.210 - - [14/Jun/2026:21:54:38 -0500] "GET /.env HTTP/1.1" 200 1184 "-" "Mozilla/5.0 (X11 ... show more 172.216.124.210 - - [14/Jun/2026:21:54:38 -0500] "GET /.env HTTP/1.1" 200 1184 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36" ... show less	Open Proxy Port Scan Hacking Web App Attack SSH
🇬🇧 Oakley	2026-06-15 02:49:37 (2 hours ago)	(antiscrape_rule) Web application abuse detected 172.216.124.210 (DE/Germany/-): 5 in the last 900 s ... show more (antiscrape_rule) Web application abuse detected 172.216.124.210 (DE/Germany/-): 5 in the last 900 secs show less	Hacking

Showing 1 to 12 of 12 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇨🇳 175.19.54.10

🇺🇸 173.9.9.142

🇵🇹 149.90.0.54

🇳🇿 121.73.162.77

🇹🇼 111.70.23.222

🇱🇾 102.203.197.6

🇺🇸 72.24.210.58

🇮🇳 59.97.94.239

🇺🇸 50.48.61.39

🇭🇰 23.249.28.115

🇨🇳 14.103.107.221

🇰🇷 222.116.47.157

🇲🇽 186.96.151.198

🇳🇱 172.235.168.35

🇩🇪 130.12.180.174

🇰🇷 112.184.21.155

🇺🇸 108.190.201.155

🇺🇸 92.118.57.209

🇨🇦 85.217.149.10

🇷🇺 81.13.62.77