JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 196.210.229.217

196.210.229.217 was found in our database!

This IP was reported 26 times. Confidence of Abuse is 73%: ?

73%

ISP	Dimension Data
Usage Type	Fixed Line ISP
ASN	AS20011
Hostname(s)	196-210-229-217.ftth.web.africa
Domain Name	global.ntt
Country	🇿🇦 South Africa
City	Johannesburg, Gauteng

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 196.210.229.217

Whois 196.210.229.217

IP Abuse Reports for 196.210.229.217:

This IP address has been reported a total of 26 times from 20 distinct sources. 196.210.229.217 was first reported on November 26th 2025, and the most recent report was 3 days ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇺🇸 kosada.com	2026-08-25 01:15:43 (3 days ago)	Web bot: denial-of-service flood	DDoS Attack Bad Web Bot
🇧🇷 noconex	2026-08-24 06:37:17 (4 days ago)	Wazuh Alert \| Rule ID: 100199 \| Desc: Suricata: (ET SCAN Potential SSH Scan) detectado de 196.210.22 ... show more Wazuh Alert \| Rule ID: 100199 \| Desc: Suricata: (ET SCAN Potential SSH Scan) detectado de 196.210.229.217 show less	Port Scan Brute-Force SSH
🇺🇸 MPL	2026-08-24 04:54:16 (4 days ago)	tcp/22	Port Scan
🇸🇬 garrymenata	2026-08-23 18:44:26 (4 days ago)	196.210.229.217 - - [24/Aug/2026:00:52:20 +0700] "GET / HTTP/1.1" 403 3258 "-" "Dalvik/2.1.0 (Linux; ... show more 196.210.229.217 - - [24/Aug/2026:00:52:20 +0700] "GET / HTTP/1.1" 403 3258 "-" "Dalvik/2.1.0 (Linux; U; Android 12; Dcolor GD2 Build/SGZ4.240805.001)" 196.210.229.217 - - [24/Aug/2026:00:52:23 +0700] "GET / HTTP/1.1" 403 3258 "-" "Dalvik/2.1.0 (Linux; U; Android 12; Dcolor GD2 Build/SGZ4.240805.001)" 196.210.229.217 - - [24/Aug/2026:00:52:25 +0700] "GET / HTTP/1.1" 403 3258 "-" "Dalvik/2.1.0 (Linux; U; Android 12; Dcolor GD2 Build/SGZ4.240805.001)" ... show less	DDoS Attack Bad Web Bot
🇨🇦 senkodev	2026-08-23 05:33:02 (5 days ago)	2026-08-23T05:32:56.538699Z [cowrie.ssh.factory.CowrieSSHFactory] New connection: 196.210.229.217:34 ... show more 2026-08-23T05:32:56.538699Z [cowrie.ssh.factory.CowrieSSHFactory] New connection: 196.210.229.217:34910 (158.69.22.11:2222) [session: 136ceaf613a9] 2026-08-23T05:33:01.721854Z [cowrie.telnet.factory.HoneyPotTelnetFactory] New connection: 196.210.229.217:44984 (158.69.22.11:2223) [session: d2ba1a02b992] ... show less	Brute-Force SSH
🇺🇸 NetVexor	2026-08-22 20:50:12 (5 days ago)	Attack source identified and submitted via NetVexor BGP Blackhole Network	Port Scan Hacking Brute-Force
🇷🇸 Scan	2026-08-21 02:14:34 (1 week ago)	MultiHost/MultiPort Probe, Scan, Hack -	Port Scan Hacking
🇺🇸 MPL	2026-08-21 02:04:14 (1 week ago)	tcp ports: 22,23 (7 or more attempts)	Port Scan
🇫🇮 GamesGames	2026-08-20 02:17:34 (1 week ago)	SSH login attempts	Brute-Force SSH
🇫🇷 Zkillu	2026-08-19 22:30:29 (1 week ago)	UDP flood (DDoS) vs AS215599: 55904 pkts / 79.95 MB to UDP 80/8443 across 668 dst IP(s), 2026-08-19 ... show more UDP flood (DDoS) vs AS215599: 55904 pkts / 79.95 MB to UDP 80/8443 across 668 dst IP(s), 2026-08-19 21:46 to 2026-08-20 00:36 CEST. No legitimate service on these UDP ports (7-day baseline 0 GB/day). Carpet-bombing of a /24, likely botnet-compromised host. Evidence: sFlow + hardware ACL counters. show less	DDoS Attack Exploited Host
🇫🇷 dmallet	2026-08-19 22:30:29 (1 week ago)	UDP flood (DDoS) vs AS215599: 55904 pkts / 79.95 MB to UDP 80/8443 across 668 dst IP(s), 2026-08-19 ... show more UDP flood (DDoS) vs AS215599: 55904 pkts / 79.95 MB to UDP 80/8443 across 668 dst IP(s), 2026-08-19 21:46 to 2026-08-20 00:36 CEST. No legitimate service on these UDP ports (7-day baseline 0 GB/day). Carpet-bombing of a /24, likely botnet-compromised host. Evidence: sFlow + hardware ACL counters. show less	DDoS Attack Exploited Host
🇵🇱 mkey	2026-08-19 11:15:01 (1 week ago)	Verified scan activity detected by local IDS/firewall correlation. SCAN: HIGHRISK_SINGLEPORT \| PORTS ... show more Verified scan activity detected by local IDS/firewall correlation. SCAN: HIGHRISK_SINGLEPORT \| PORTS=22 \| HITS=2 \| IPSET=ADD \| FIRST=2026-08-19 13:13:16 \| LAST=2026-08-19 13:13:16. Last seen 2026-08-19 13:13:16. show less	Port Scan
🇧🇷 noconex	2026-08-18 07:47:27 (1 week ago)	Wazuh Alert \| Rule ID: 100199 \| Desc: Suricata: (ET SCAN Potential SSH Scan) detectado de 196.210.22 ... show more Wazuh Alert \| Rule ID: 100199 \| Desc: Suricata: (ET SCAN Potential SSH Scan) detectado de 196.210.229.217 show less	Port Scan Brute-Force SSH
🇹🇷 SeczarSecureOps	2026-08-17 06:12:47 (1 week ago)	Auto-blocked by Seczar SecureOps — High-Risk Port Probe (admin-managed entries) — SSH (6 events in 5 ... show more Auto-blocked by Seczar SecureOps — High-Risk Port Probe (admin-managed entries) — SSH (6 events in 5min) at 2026-08-17 06:12 show less	Web App Attack
🇺🇸 KelvaTLS	2026-08-17 03:53:03 (1 week ago)	KelvaTLS: TCP connection-limit abuse against TCP port 1194 on our infrastructure. nft veil1194off_co ... show more KelvaTLS: TCP connection-limit abuse against TCP port 1194 on our infrastructure. nft veil1194off_conn: held more concurrent connections to the OpenVPN listener than the per-source limit permits from this source. UTC 2026-08-17T03:53:03Z. incident kelva-20260817-035015Z. show less	DDoS Attack

Showing 1 to 15 of 26 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇵🇾 190.128.224.134

🇯🇵 34.85.28.107

🇲🇩 194.110.247.198

🇪🇨 190.57.149.194

🇺🇸 165.22.180.185

🇧🇬 151.237.115.206

🇺🇸 104.197.109.108

🇯🇵 104.46.209.135

🇺🇸 23.92.26.123

🇳🇱 193.176.31.217

🇺🇸 150.107.36.126

🇨🇳 122.234.226.78

🇩🇪 85.10.194.92

🇺🇸 66.132.172.211

🇺🇸 216.73.160.35

🇳🇱 195.178.110.228

🇺🇸 172.56.192.128

🇫🇮 147.185.133.183

🇺🇸 140.235.2.180

🇰🇷 125.142.32.25