JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 173.239.216.98

173.239.216.98 was found in our database!

This IP was reported 38 times. Confidence of Abuse is 100%: ?

100%

ISP	LogicWeb Inc.
Usage Type	Data Center/Web Hosting/Transit
ASN	AS206092
Domain Name	logicweb.com
Country	🇨🇭 Switzerland
City	Zurich, Zurich

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 173.239.216.98

Whois 173.239.216.98

IP Abuse Reports for 173.239.216.98:

This IP address has been reported a total of 38 times from 34 distinct sources. 173.239.216.98 was first reported on June 9th 2026, and the most recent report was 22 hours ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇫🇷 dynamix	2026-10-16 03:40:42 (22 hours ago)	WordPress XMLRPC Brute Force Attack	Brute-Force Web App Attack
🇸🇪 vaia.cloud	2026-10-16 03:35:01 (22 hours ago)	crowdsecurity/http-bf-wordpress_bf	Brute-Force Web App Attack
🇳🇱 Site.eu	2026-10-16 03:06:49 (23 hours ago)	Repeated wp-login/xmlrpc attempts	Brute-Force SSH
🇦🇺 screwlooseit.com.au	2026-10-15 21:56:43 (1 day ago)	Blocked by CSF 13 firewall - Rule: XMLRPC US/United States/-	Web App Attack
🇩🇪 ger-stg-sifi1	2026-10-15 21:02:59 (1 day ago)	(wordpress) Failed wordpress login using wp-login.php or xmlrpc.php	Web App Attack
Anonymous	2026-10-12 16:30:23 (4 days ago)	Failed login attempt detected by Fail2Ban in plesk-postfix jail	Brute-Force
🇺🇸 Starburst SysOp Team	2026-10-08 07:44:52 (1 week ago)	Host header is a numeric IP address. Pattern match "(?:^( (920350-mnz6-3)	Hacking Bad Web Bot
🇳🇱 DrLex0	2026-10-08 07:33:57 (1 week ago)	Probing for various exploits, distributed attack from multiple IPs in shitty 173.239.216.0/24 netwo ... show more Probing for various exploits, distributed attack from multiple IPs in shitty 173.239.216.0/24 network range 173.239.216.98 443 - [08/Oct/2026:07:33:57 +0000] "POST /.env HTTP/1.1" 400 5363 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Safari/537.36" show less	Brute-Force Bad Web Bot Web App Attack
🇫🇷 Kejult	2026-10-08 05:47:57 (1 week ago)	Honeypot Finding: repeated HTTP/web-application probing captured by Tanner on TCP/80; 74 request eve ... show more Honeypot Finding: repeated HTTP/web-application probing captured by Tanner on TCP/80; 74 request event(s), 67 distinct path(s), 13 request(s) to suspicious path(s). Examples: /.env, /info.php, /owncloud/apps/graphapi/vendor/microsoft/microsoft-graph/tests/GetPhpInfo.php, /phpinfo.php, /.env.prod. show less	Hacking Bad Web Bot Web App Attack
🇫🇷 Kejult	2026-10-08 05:47:57 (1 week ago)	Honeypot Finding: verified TCP multi-port scan/probing; 75 application-level events across 2 target ... show more Honeypot Finding: verified TCP multi-port scan/probing; 75 application-level events across 2 target ports and 2 source port(s). Ports: 80/HTTP, 443/HTTPS. Sensors: Tanner, H0neytr4p. show less	Port Scan
🇩🇪 Tamsy	2026-10-07 23:03:33 (1 week ago)	HTTPD - 4xx scan	Web App Attack
🇺🇸 Starburst SysOp Team	2026-10-07 22:15:06 (1 week ago)	Host header is a numeric IP address. Pattern match "(?:^( (920350-mnz6-1)	Hacking Bad Web Bot
🇸🇪 SkyDancer	2026-10-07 21:00:14 (1 week ago)	Multiple unauthorized attempts to access using wrong credentials. Attack automatically blocked by Sk ... show more Multiple unauthorized attempts to access using wrong credentials. Attack automatically blocked by SkyDancer Ai. EXT-SYS-Vx show less	Hacking Brute-Force SSH
🇩🇪 McClay	2026-10-07 20:59:27 (1 week ago)	HTTP-404 spam:173.239.216.98 - - [07/Oct/2026:22:59:18 +0200] "GET /env.js HTTP/1.1" 404 1051 "-" "M ... show more HTTP-404 spam:173.239.216.98 - - [07/Oct/2026:22:59:18 +0200] "GET /env.js HTTP/1.1" 404 1051 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.0 Safari/605.1.15" 173.239.216.98 - - [07/Oct/2026:22:59:19 +0200] "GET /env.prod.js HTTP/1.1" 404 1050 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.0 Safari/605.1.15" 173.239.216.98 - - [07/Oct/2026:22:59:19 +0200] "GET /env.production.js HTTP/1.1" 404 1050 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.0 Safari/605.1.15" 173.239.216.98 - - [07/Oct/2026:22:59:20 +0200] "GET /..;/env.dev.js HTTP/1.1" 404 1050 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.0 Safari/605.1.15" 173.239.216.98 - - [07/Oct/2026:22:59:20 +0200] "GET /..;/env.development.js HTTP/1.1" 404 1050 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit ... show less	Web App Attack
🇳🇱 0xffffffff	2026-10-07 19:57:14 (1 week ago)	[2026-10-07 22:57:09.288073] [authz_core:error] [pid 4080376:tid 125277451564736] [client 173.239.21 ... show more [2026-10-07 22:57:09.288073] [authz_core:error] [pid 4080376:tid 125277451564736] [client 173.239.216.98:26453] AH01630: client denied by server configuration: /var/www//app_dev.php , error_notes:php-path_info , URI:'/app_dev.php/_profiler/open?file=app/config/parameters.yml' [2026-10-07 22:57:10.689894] [authz_core:error] [pid 4080376:tid 125277578168000] [client 173.239.216.98:26453] AH01630: client denied by server configuration: /var/www//_profiler , error_notes:symfony_profiler , URI:'/_profiler/open?file=app/config/parameters.yml' [2026-10-07 22:57:11.490226] [authz_core:error] [pid 4080376:tid 125277443172032] [client 173.239.216.98:26453] AH01630: client denied by server configuration: /var/www//app , error_notes:sensitive-files , URI:'/app/config/parameters.yml' [2026-10-07 22:57:12.238630] [authz_core:error] [pid 4080376:tid 125277434779328] [client 173.239.216.98:26453] AH01630: client denied by server configuration: /var/www//config , error_notes:sensitive-files , URI:'/config/parameters.yml' show less	Web App Attack Bad Web Bot

Showing 1 to 15 of 38 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇨🇳 223.109.252.238

🇹🇼 198.235.24.37

🇨🇳 113.248.111.122

🇧🇩 103.159.2.113

🇨🇦 85.217.149.46

🇫🇷 45.141.22.36

🇺🇸 34.23.56.252

🇺🇸 216.25.89.98

🇫🇷 212.47.75.202

🇺🇸 205.210.31.75

🇩🇪 194.88.98.99

🇲🇽 189.144.13.181

🇳🇱 185.224.128.16

🇸🇬 185.200.116.79

🇫🇮 178.20.210.152

🇮🇩 163.7.11.155

🇺🇸 162.216.149.225

🇨🇳 120.48.71.14

🇨🇦 85.217.149.44

🇺🇸 65.130.249.93