JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 209.99.189.24

209.99.189.24 was found in our database!

This IP was reported 113 times. Confidence of Abuse is 80%: ?

80%

ISP	SKN Subnet & Telecom Ltd
Usage Type	Data Center/Web Hosting/Transit
ASN	AS402253
Domain Name	skntelecom.com
Country	🇨🇭 Switzerland
City	Zurich, Zurich

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 209.99.189.24

Whois 209.99.189.24

IP Abuse Reports for 209.99.189.24:

This IP address has been reported a total of 113 times from 26 distinct sources. 209.99.189.24 was first reported on April 2nd 2026, and the most recent report was 23 hours ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇫🇮 notelseit	2026-06-23 10:39:56 (23 hours ago)	2026-06-23T12:39:56.176364+02:00 mail postfix/submission/smtpd[3215405]: warning: unknown[209.99.189 ... show more 2026-06-23T12:39:56.176364+02:00 mail postfix/submission/smtpd[3215405]: warning: unknown[209.99.189.24]: SASL login authentication failed: (reason unavailable), [email protected] 2026-06-23T12:39:56.251825+02:00 mail postfix/submission/smtpd[3215405]: NOQUEUE: reject: RCPT from unknown[209.99.189.24]: 450 4.7.25 Client host rejected: cannot find your hostname, [209.99.189.24]; from=<[email protected]> to=<[email protected]> proto=ESMTP helo=<WIN-D2B8VC1E9I0> 2026-06-23T12:39:56.289658+02:00 mail postfix/submission/smtpd[3215405]: lost connection after RCPT from unknown[209.99.189.24] ... show less	Brute-Force Email Spam
Anonymous	2026-06-22 06:30:21 (2 days ago)	6x FTP auth failed (on 3 different accounts)	FTP Brute-Force
🇺🇸 TPI-Abuse	2026-06-22 04:46:33 (2 days ago)	(mod_security) mod_security (id:210492) triggered by 209.99.189.24 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:210492) triggered by 209.99.189.24 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jun 22 00:46:17.594447 2026] [security2:error] [pid 10802:tid 10802] [client 209.99.189.24:0] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "antitribu.com"] [uri "/core/.env"] [unique_id "aji-GdWX8_ovmwL5dfKEewAAAAg"] show less	Brute-Force Bad Web Bot Web App Attack
🇫🇷 dynamix	2026-06-22 03:08:39 (2 days ago)	Multiple WAF Violations	Web App Attack
🇫🇮 notelseit	2026-06-21 09:10:09 (3 days ago)	2026-06-21T11:10:09.197506+02:00 mail postfix/submission/smtpd[2887395]: warning: unknown[209.99.189 ... show more 2026-06-21T11:10:09.197506+02:00 mail postfix/submission/smtpd[2887395]: warning: unknown[209.99.189.24]: SASL login authentication failed: (reason unavailable), [email protected] 2026-06-21T11:10:09.273241+02:00 mail postfix/submission/smtpd[2887395]: NOQUEUE: reject: RCPT from unknown[209.99.189.24]: 450 4.7.25 Client host rejected: cannot find your hostname, [209.99.189.24]; from=<[email protected]> to=<[email protected]> proto=ESMTP helo=<WIN-D2B8VC1E9I0> 2026-06-21T11:10:09.318020+02:00 mail postfix/submission/smtpd[2887395]: lost connection after RCPT from unknown[209.99.189.24] ... show less	Brute-Force Email Spam
🇩🇪 ghostwarriors	2026-06-20 23:20:08 (3 days ago)	Unauthorized connection to FTP port 21	FTP Brute-Force Brute-Force
🇺🇸 ambor	2026-06-20 14:51:38 (3 days ago)	Honeypot access: Environment file access attempt. Path: /.env	Web App Attack
🇩🇪 _ArminS_	2026-06-20 10:08:13 (3 days ago)	SP-Scan 63298:21 detected 2026.06.20 12:08:13 blocked until 2026.08.09 05:11:00	Port Scan
🇨🇦 zXero	2026-06-18 21:13:45 (5 days ago)	Fail2Ban automatic report - jail: no-wordpress	Brute-Force SSH DDoS Attack
🇪🇸 el-brujo	2026-06-18 05:55:03 (6 days ago)	Cloudflare WAF: Request Path: /core/.env Request Query: Host: ns2.elhacker.net userAgent: Action: ... show more Cloudflare WAF: Request Path: /core/.env Request Query: Host: ns2.elhacker.net userAgent: Action: block Source: firewallManaged ASN Description: SKN Subnet & Telecom Ltd Country: CH Method: GET Timestamp: 2026-06-18T05:55:03Z ruleId: 23548ee2b36547a1be09bb2c0550c529. Report generated by Cloudflare-WAF-to-AbuseIPDB (https://github.com/MHG-LAB/Cloudflare-WAF-to-AbuseIPDB). show less	Hacking SQL Injection Web App Attack
🇦🇺 FireGuard Server	2026-06-17 05:15:06 (1 week ago)	Blocked by OPNsense firewall; 3 hits, proto=tcp, ports=2096	Port Scan Hacking
🇨🇦 zXero	2026-06-17 04:02:44 (1 week ago)	Fail2Ban automatic report - jail: no-wordpress	Brute-Force SSH DDoS Attack
🇧🇷 KingHost	2026-06-16 20:31:47 (1 week ago)		Brute-Force
🇪🇸 el-brujo	2026-06-13 05:30:22 (1 week ago)	Cloudflare WAF: Request Path: /core/.env Request Query: Host: ns2.elhacker.net userAgent: Action: ... show more Cloudflare WAF: Request Path: /core/.env Request Query: Host: ns2.elhacker.net userAgent: Action: block Source: firewallManaged ASN Description: SKN Subnet & Telecom Ltd Country: CH Method: GET Timestamp: 2026-06-13T05:30:22Z ruleId: 23548ee2b36547a1be09bb2c0550c529. Report generated by Cloudflare-WAF-to-AbuseIPDB (https://github.com/MHG-LAB/Cloudflare-WAF-to-AbuseIPDB). show less	Hacking SQL Injection Web App Attack
🇩🇰 ScamAware	2026-06-06 14:47:23 (2 weeks ago)	Detected by Cloudflare Security Events via WordPress automation. Detection: sensitive_files (Sensiti ... show more Detected by Cloudflare Security Events via WordPress automation. Detection: sensitive_files (Sensitive files, source control, config, and backups). Hits from same IP in last 60 minutes: 3. Unique request paths counted internally: 3. Cloudflare action: block. Cloudflare source: firewallCustom. show less	Web App Attack

Showing 1 to 15 of 113 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇫🇷 85.217.140.29

🇫🇷 85.217.140.2

🇻🇳 42.118.236.168

🇭🇰 152.32.135.217

🇻🇳 116.110.148.164

🇹🇯 62.89.208.249

🇸🇬 47.245.117.221

🇸🇬 47.236.233.159

🇺🇸 45.134.140.18

🇺🇸 20.29.24.90

🇩🇪 213.209.159.226

🇮🇳 182.78.86.62

🇮🇳 150.107.213.135

🇩🇪 138.246.253.24

🇨🇳 113.194.203.31

🇮🇹 78.209.253.248

🇦🇿 188.253.213.50

🇸🇬 188.166.215.16

🇫🇷 176.31.40.175

🇪🇪 159.253.22.85