JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

2.59.21.99

Recent Activity

Abuse Confidence Score

38% Elevated

9 reports

7 reporters · latest 16 hours ago

ISP: Black HOST Ltd.
Usage Type: Data Center/Web Hosting/Transit
ASN: AS12989
Hostname(s): black.host-99.21.59.2.in-addr.arpa
Domain Name: black.host
Country: 🇦🇹 Austria
City: Vienna, Vienna

ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report Whois

Example preview

Account required for the enhanced features Log in Sign up

Abuse Reports

Export reports CSV

Total reports

9 from 7 distinct reporters

First reported

August 15th 2026

Most recent report

16 hours ago

Last 60 days

Top reporter locations 🇮🇪 Ireland 2 🇸🇪 Sweden 2 🇪🇸 Spain 1

Most common categories Brute-Force 4 Web App Attack 4 SSH 1 Port Scan 1 FTP Brute-Force 1

Recent reports We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇪🇸 WebTejo	2026-11-10 08:51:19 UTC · (16 hours ago)	Detected multiple authentication failures and invalid user attempts from IP address 2.59.21.99 on [ES] Sapphire Node.	Brute-Force SSH
🇮🇪 AutosOnShow	2026-11-10 05:38:05 UTC · (19 hours ago)	blocked for webapp attack \| path requested: /catalog-portal/ui/oauth/verify \| seen at 2026-11-10 05:37:39.615 \|	Web App Attack
🇮🇪 AutosOnShow	2026-11-10 05:23:05 UTC · (19 hours ago)	blocked for webapp attack \| path requested: /wls-wsat/CoordinatorPortType \| seen at 2026-11-10 05:22:44.605 \|	Web App Attack
🇸🇪 vaia.cloud	2026-11-10 04:45:03 UTC · (20 hours ago)	crowdsecurity/http-admin-interface-probing	Brute-Force Web App Attack
🇸🇪 vaia.cloud	2026-11-10 00:40:02 UTC · (1 day ago)	crowdsecurity/http-path-traversal-probing	Brute-Force Web App Attack
🇹🇷 alastyr	2026-11-07 07:59:56 UTC · (3 days ago)	Port scan: probes to 3 unused addresses of AS3188 within 60 s. 2454 further packets from this source blocked during the following ban. Ports: 2702,17988,8099,45100. Detected by Alastyr network sensor (XDP).	Port Scan
Anonymous	2026-10-30 06:53:36 UTC · (1 week ago)	[Fri Oct 30 06:51:03.522197 2026] [php:error] [pid 2259401] [client 2.59.21.99:18974] script '/var/www/vhosts/mcdermit.org/BOISD/card_scan.php' not found or unable to stat [Fri Oct 30 06:51:06.509081 2026] [php:error] [pid 2259401] [client 2.59.21.99 ... show more [Fri Oct 30 06:51:03.522197 2026] [php:error] [pid 2259401] [client 2.59.21.99:18974] script '/var/www/vhosts/mcdermit.org/BOISD/card_scan.php' not found or unable to stat [Fri Oct 30 06:51:06.509081 2026] [php:error] [pid 2259401] [client 2.59.21.99:18974] script '/var/www/vhosts/mcdermit.org/BOISD/card_scan.php' not found or unable to stat [Fri Oct 30 06:53:35.510096 2026] [php:error] [pid 2287268] [client 2.59.21.99:26654] script '/var/www/vhosts/mcdermit.org/BOISD/webauth_operation.php' not found or unable to stat ... show less	Brute-Force
🇫🇷 ✨	2026-10-26 01:43:12 UTC · (2 weeks ago)	Rule : FTP 2026-10-26 01:34:42 2.59.21.99 - *hidden-privacy* 21 - 500 87 0 158 1 0 da05b324-6d46-4236-8720-7ce19a434bee -	FTP Brute-Force
🇩🇪 updown.io	2026-08-15 06:24:17 UTC · (2 months ago)	{"level":"info","ts":1786775008.9914136,"logger":"http.log.access.log1","msg":"handled request","request":{"remote_ip":"2.59.21.99","remote_port":"48310","client_ip":"2.59.21.99","proto":"HTTP/1.1","method":"POST","host":"status.trillianthealth.com", ... show more {"level":"info","ts":1786775008.9914136,"logger":"http.log.access.log1","msg":"handled request","request":{"remote_ip":"2.59.21.99","remote_port":"48310","client_ip":"2.59.21.99","proto":"HTTP/1.1","method":"POST","host":"status.trillianthealth.com","uri":"/soap.cgi?service=whatever-control;curl","headers":{"Opt-Out-Url":["https://www.rootevidence.com/scanners"],"Soapaction":["\"whatever-serviceType#whatever-action\""],"User-Agent":["RootEvidence/1.0"],"Content-Length":["16"],"Accept-Encoding":["identity"],"Content-Type":["text/xml"],"Opt-Out-Email":["[email protected]"],"Connection":["close"]}},"bytes_read":0,"user_id":"","duration":0.00008336,"size":0,"status":308,"resp_headers":{"Location":["https://status.trillianthealth.com/soap.cgi?service=whatever-control;curl"],"Content-Type":[],"Server":["Caddy"],"Connection":["close"]}} {"level":"info","ts":1786775008.9923985,"logger":"http.log.access.log1","msg":"handled request","request":{"remote_ip":"2.59.21.99","remote_port":"482 ... show less	DDoS Attack Web App Attack

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown

Recently Reported IPs:

🇺🇸 2400:cb00:1273:1000:402b:b446:3beb:8663

🇺🇸 172.252.209.23

🇺🇸 172.252.197.246

🇺🇸 172.252.164.35

🇺🇸 172.252.163.185

🇺🇸 172.70.135.55

🇺🇦 95.46.145.208

🇷🇴 92.118.39.14

🇫🇷 91.231.89.83

🇩🇪 77.243.88.182

🇺🇸 71.6.199.23

🇹🇼 61.223.67.238

🇧🇷 205.210.31.225

🇺🇸 172.252.117.157

🇺🇸 172.252.104.195

🇹🇼 172.69.221.94

🇭🇳 168.228.194.219

🇺🇸 104.236.237.3

🇨🇦 85.217.149.13

🇷🇴 80.94.92.234