JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 198.23.239.16

198.23.239.16 was found in our database!

This IP was reported 9 times. Confidence of Abuse is 0%: ?

ISP	HostPapa
Usage Type	Data Center/Web Hosting/Transit
ASN	AS36352
Hostname(s)	198-23-239-16-host.colocrossing.com
Domain Name	colocrossing.com
Country	🇺🇸 United States of America
City	Buffalo, New York

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 198.23.239.16

Whois 198.23.239.16

IP Abuse Reports for 198.23.239.16:

This IP address has been reported a total of 9 times from 4 distinct sources. 198.23.239.16 was first reported on January 10th 2023, and the most recent report was 4 months ago.

Old Reports: The most recent abuse report for this IP address is from 4 months ago . It is possible that this IP is no longer involved in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇺🇸 TPI-Abuse	2026-02-01 12:53:24 (4 months ago)	(mod_security) mod_security (id:210492) triggered by 198.23.239.16 (198-23-239-16-host.colocrossing. ... show more (mod_security) mod_security (id:210492) triggered by 198.23.239.16 (198-23-239-16-host.colocrossing.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Feb 01 07:53:16.692653 2026] [security2:error] [pid 483:tid 653] [client 198.23.239.16:46741] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "webdisk.kettlehill.com"] [uri "/.env.dev"] [unique_id "aX9MvAMxl-cQ0UzvOvSkKQAAAEc"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-01-16 06:21:41 (4 months ago)	(mod_security) mod_security (id:210730) triggered by 198.23.239.16 (198-23-239-16-host.colocrossing. ... show more (mod_security) mod_security (id:210730) triggered by 198.23.239.16 (198-23-239-16-host.colocrossing.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jan 16 01:21:22.058673 2026] [security2:error] [pid 15517:tid 15517] [client 198.23.239.16:47347] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy\|\|mail.nbcnewsradio.com\|F\|2"] [data ".log"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "mail.nbcnewsradio.com"] [uri "/admin/logs/error.log"] [unique_id "aWnY4r-8yf4X8xvJ0PbwrgAAAB8"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2025-12-03 00:32:41 (6 months ago)	(mod_security) mod_security (id:210730) triggered by 198.23.239.16 (198-23-239-16-host.colocrossing. ... show more (mod_security) mod_security (id:210730) triggered by 198.23.239.16 (198-23-239-16-host.colocrossing.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Dec 02 19:32:35.550399 2025] [security2:error] [pid 24397:tid 24397] [client 198.23.239.16:49611] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy\|\|ftp.farmers123.com\|F\|2"] [data ".key"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "ftp.farmers123.com"] [uri "/host.key"] [unique_id "aS-FIy4FZ9P0uQts72zOnAAAAA4"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2025-10-28 22:49:43 (7 months ago)	(mod_security) mod_security (id:210492) triggered by 198.23.239.16 (198-23-239-16-host.colocrossing. ... show more (mod_security) mod_security (id:210492) triggered by 198.23.239.16 (198-23-239-16-host.colocrossing.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 28 18:49:38.144050 2025] [security2:error] [pid 30664:tid 30664] [client 198.23.239.16:38161] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpcontacts.nbcnewsradio.com"] [uri "/.env.save"] [unique_id "aQFIgrYzD_cHszROVxw0cwAAAAI"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2025-09-22 21:00:41 (8 months ago)	(mod_security) mod_security (id:210492) triggered by 198.23.239.16 (198-23-239-16-host.colocrossing. ... show more (mod_security) mod_security (id:210492) triggered by 198.23.239.16 (198-23-239-16-host.colocrossing.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Sep 22 17:00:35.075599 2025] [security2:error] [pid 12071:tid 12071] [client 198.23.239.16:44527] ModSecurity: Access denied with code 403 (phase 1). Matched phrase ".htaccess" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpcontacts.deandobkin.com"] [uri "/htaccess_for_page_not_found_redirects.htaccess"] [unique_id "aNG4891-Qrnu363ibcdZmQAAAAM"] show less	Brute-Force Bad Web Bot Web App Attack
Anonymous	2025-08-02 06:10:02 (10 months ago)	\| Common web attack.	Hacking SQL Injection Web App Attack
🇺🇸 TPI-Abuse	2025-05-30 16:08:12 (1 year ago)	(mod_security) mod_security (id:211190) triggered by 198.23.239.16 (198-23-239-16-host.colocrossing. ... show more (mod_security) mod_security (id:211190) triggered by 198.23.239.16 (198-23-239-16-host.colocrossing.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri May 30 12:08:08.231086 2025] [security2:error] [pid 340761:tid 340761] [client 198.23.239.16:50327] ModSecurity: Access denied with code 403 (phase 2). Match of "contains cpanel" against "REQUEST_URI" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "55"] [id "211190"] [rev "9"] [msg "COMODO WAF: Remote File Access Attempt\|\|ftp.nbcnewsradio.com\|F\|2"] [data "Matched Data: /etc/ found within REQUEST_URI: /poc.jsp?cmd=cat+%2Fetc%2Fpasswd"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "ftp.nbcnewsradio.com"] [uri "/poc.jsp"] [unique_id "aDnX6EBbyCMj9NQMXmXa_wAAABY"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 oncord	2023-08-28 19:05:47 (2 years ago)	Form spam	Web Spam
🇬🇧 mangomad	2023-01-10 05:16:29 (3 years ago)	Repeated Apache mod_security rule triggers	Brute-Force Web App Attack

Showing 1 to 9 of 9 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇮🇹 185.105.128.156

🇵🇰 119.73.113.58

🇫🇷 109.222.6.85

🇺🇸 107.150.103.12

🇰🇿 89.218.247.234

🇲🇽 38.65.139.252

🇺🇸 195.184.76.139

🇧🇷 186.193.158.139

🇹🇼 125.229.26.99

🇱🇹 81.30.98.62

🇷🇺 81.23.173.32

🇮🇩 69.5.23.222

🇸🇪 52.101.76.143

🇺🇸 50.116.72.11

🇧🇪 35.233.66.253

🇷🇴 2.57.122.238

🇺🇸 2600:3c00::2000:8aff:fe6e:bfaf

🇬🇷 109.242.234.138

🇭🇰 103.103.245.61

🇸🇦 93.112.198.160