JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 198.23.215.165

198.23.215.165 was found in our database!

This IP was reported 12 times. Confidence of Abuse is 21%: ?

21%

ISP	HostPapa
Usage Type	Data Center/Web Hosting/Transit
ASN	AS36352
Hostname(s)	198-23-215-165-host.colocrossing.com
Domain Name	hostpapa.com
Country	🇺🇸 United States of America
City	Los Angeles, California

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 198.23.215.165

Whois 198.23.215.165

IP Abuse Reports for 198.23.215.165:

This IP address has been reported a total of 12 times from 10 distinct sources. 198.23.215.165 was first reported on February 7th 2026, and the most recent report was 1 month ago.

Old Reports: The most recent abuse report for this IP address is from 1 month ago . It is possible that this IP is no longer involved in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇪🇸 Gem	2026-05-22 22:14:41 (1 month ago)	Unauthorized web scan.	Web App Attack
🇳🇱 homeshowdomain.nl	2026-05-21 22:02:36 (1 month ago)	Auto-ban: single probe for restricted files (.env / backups / admin endpoints). Likely mass-scan on ... show more Auto-ban: single probe for restricted files (.env / backups / admin endpoints). Likely mass-scan on 2026-05-20. show less	Web App Attack SSH Hacking
🇺🇸 mnsf	2026-05-21 16:06:53 (1 month ago)	Scanning/Probing (11)	Brute-Force Web App Attack
🇿🇦 Tokolosh Hunters	2026-05-20 23:47:44 (1 month ago)	AutoBlockWindow-Known bad useragent query-2026-05-20 23:47:43	Bad Web Bot
🇮🇩 securejdprop	2026-05-20 22:11:34 (1 month ago)	This IP was detected by CrowdSec triggering crowdsecurity/vpatch-env-access. WAF block: crowdsecurit ... show more This IP was detected by CrowdSec triggering crowdsecurity/vpatch-env-access. WAF block: crowdsecurity/vpatch-env-access from 198.23.215.165 (172.18.0.2) show less	Hacking Web App Attack
🇺🇸 TPI-Abuse	2026-05-20 22:02:21 (1 month ago)	(mod_security) mod_security (id:210492) triggered by 198.23.215.165 (198-23-215-165-host.colocrossin ... show more (mod_security) mod_security (id:210492) triggered by 198.23.215.165 (198-23-215-165-host.colocrossing.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed May 20 18:02:13.471535 2026] [security2:error] [pid 819:tid 819] [client 198.23.215.165:57418] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "3dcounty.com"] [uri "/.env"] [unique_id "ag4vZX5jxiGJvVdUl9lQ2wAAAA4"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-05-20 21:08:02 (1 month ago)	(mod_security) mod_security (id:210492) triggered by 198.23.215.165 (198-23-215-165-host.colocrossin ... show more (mod_security) mod_security (id:210492) triggered by 198.23.215.165 (198-23-215-165-host.colocrossing.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed May 20 17:07:56.920300 2026] [security2:error] [pid 13278:tid 13278] [client 198.23.215.165:62796] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "1954topresent.paleopathologist.com"] [uri "/.env"] [unique_id "ag4irNBIv7thEJU3B8VfawAAAA8"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 apislytics	2026-05-20 21:05:13 (1 month ago)	Automatic hard ban after repeated rate-limit abuse	Brute-Force
🇺🇸 TPI-Abuse	2026-05-20 20:51:02 (1 month ago)	(mod_security) mod_security (id:210492) triggered by 198.23.215.165 (198-23-215-165-host.colocrossin ... show more (mod_security) mod_security (id:210492) triggered by 198.23.215.165 (198-23-215-165-host.colocrossing.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed May 20 16:50:55.785458 2026] [security2:error] [pid 21859:tid 21859] [client 198.23.215.165:59556] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "10bestrealtors.com"] [uri "/.env"] [unique_id "ag4er1ywWommO2s8NoL_4wAAAAc"] show less	Brute-Force Bad Web Bot Web App Attack
Anonymous	2026-05-20 20:27:22 (1 month ago)	(caddyscan) Scanner path probe from 198.23.215.165 (US/United States/198-23-215-165-host.colocrossin ... show more (caddyscan) Scanner path probe from 198.23.215.165 (US/United States/198-23-215-165-host.colocrossing.com): 5 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: [REDACTED] 200 2627 198.23.215.165 - - [20/May/2026:20:26:37 +0000] "GET //.env HTTP/1.1" [REDACTED] 200 2627 198.23.215.165 - - [20/May/2026:20:26:45 +0000] "GET //.env HTTP/1.1" [REDACTED] 200 2627 198.23.215.165 - - [20/May/2026:20:27:17 +0000] "GET //.env HTTP/1.1" [REDACTED] 200 2627 198.23.215.165 - - [20/May/2026:20:27:18 +0000] "GET //.env HTTP/1.1" [REDACTED] 200 2627 198.23.215.165 - - [20/May/2026:20:27:19 +0000] "GET //.env HTTP/1.1" show less	Port Scan
🇪🇸 el-brujo	2026-02-08 13:08:53 (5 months ago)	2026-02-08T14:08:50.504577 ns2.elhacker.net postfix/smtpd[511459]: warning: unknown[198.23.215.165]: ... show more 2026-02-08T14:08:50.504577 ns2.elhacker.net postfix/smtpd[511459]: warning: unknown[198.23.215.165]: SASL PLAIN authentication failed: authentication failure, [email protected] 2026-02-08T14:08:52.955527 ns2.elhacker.net postfix/smtpd[511459]: warning: unknown[198.23.215.165]: SASL LOGIN authentication failed: authentication failure, [email protected] ... show less	Hacking Web App Attack
Anonymous	2026-02-07 13:59:40 (5 months ago)	SMTP brute force - auth failed	Brute-Force Exploited Host

Showing 1 to 12 of 12 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇹🇭 202.29.240.250

🇷🇼 196.216.81.126

🇨🇳 111.225.149.174

🇧🇪 34.38.139.100

🇺🇸 2600:3c02::2000:7fff:fe15:abc1

🇬🇧 206.189.19.19

🇺🇸 199.195.254.215

🇧🇩 182.48.76.75

🇹🇭 159.192.132.36

🇺🇸 142.4.12.164

🇵🇱 94.232.223.180

🇳🇱 86.54.31.40

🇱🇹 45.227.254.170

🇨🇳 36.25.92.154

🇧🇪 34.140.1.203

🇺🇸 20.64.105.169

🇺🇸 2604:a880:400:d1:0:4:6c80:7001

🇵🇰 223.123.42.187

🇹🇭 202.29.224.230

🇲🇽 200.68.173.143