This IP address has been reported a total of
21
times from
14 distinct
sources.
217.98.99.102 was first reported on
, and the most recent report was
.
In the last 60 days, the top reporter locations were:
Germany
with 7
reports;
Brazil
with 3
reports;
Spain
with 3
reports.
The most common categories in these recent reports were:
Port Scan
14
times;
Hacking
8
times;
Web App Attack
4
times;
Bad Web Bot
4
times;
Brute-Force
2
times;
Other
9
times.
Recent Reports
We have received reports of abusive activity from this IP address within the last week. It is
potentially still actively engaged in abusive activities.
{"ClientAddr":"217.98.99.102:54134","ClientHost":"217.98.99.102","ClientPort":"54134","ClientUsernam ...
show more{"ClientAddr":"217.98.99.102:54134","ClientHost":"217.98.99.102","ClientPort":"54134","ClientUsername":"-","DownstreamContentSize":19,"DownstreamStatus":404,"Duration":32985,"GzipRatio":0,"OriginContentSize":0,"OriginDuration":0,"OriginStatus":0,"Overhead":32985,"RequestAddr":"202.61.244.136:80","RequestContentSize":0,"RequestCount":93872,"RequestHost":"202.61.244.136","RequestMethod":"GET","RequestPath":"/phpmyadmin/index.php?lang=en","RequestPort":"80","RequestProtocol":"HTTP/1.1","RequestScheme":"http","RetryAttempts":0,"StartLocal":"2026-10-16T07:43:29.499022198+02:00","StartUTC":"2026-10-16T05:43:29.499022198Z","entryPointName":"web","level":"info","msg":"","time":"2026-10-16T07:43:29+02:00"}
{"ClientAddr":"217.98.99.102:54134","ClientHost":"217.98.99.102","ClientPort":"54134","ClientUsername":"-","DownstreamContentSize":19,"DownstreamStatus":404,"Duration":643066,"GzipRatio":0,"OriginContentSize":0,"OriginDuration":0,"OriginStatus":0,"Overhead":643066,"RequestAddr":"202.61.244.13
...
show less
(directadmin) Failed DirectAdmin phpMyAdmin login from 217.98.99.102 (PL/-/-): 5 in the last 3600 se ...
show more(directadmin) Failed DirectAdmin phpMyAdmin login from 217.98.99.102 (PL/-/-): 5 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_DIRECTADMIN; Logs: Oct 16 00:53:19 phpmyadmin: user denied: magento (mysql-denied) from 217.98.99.102
Oct 16 00:53:22 phpmyadmin: user denied: user (mysql-denied) from 217.98.99.102
Oct 16 00:53:23 phpmyadmin: user denied: langfuse (mysql-denied) from 217.98.99.102
Oct 16 00:53:24 phpmyadmin: user denied: laravel (mysql-denied) from 217.98.99.102
Oct 16 00:53:28 phpmyadmin: user denied: phpmyadmin (mysql-denied) from 217.98.99.102
show less
[AUTORAVALT][[09/10/2026 - 06:36:36 -03:00 UTC]
Attack from [217.98.99.102] Action: BLocKed
DDoS At ...
show more[AUTORAVALT][[09/10/2026 - 06:36:36 -03:00 UTC]
Attack from [217.98.99.102] Action: BLocKed
DDoS Attack -> Participating in distributed denial-of-service.
Phishing -> Phishing websites and/or email.
Web Spam -> Comment/forum spam, HTTP referer spam, or other CMS spam.
Blog Spam -> CMS blog comment spam.
Web App Attack -> Attempts to probe for or exploit instal]
...
show less
DDoS Attack
Phishing
Web Spam
Blog Spam
Web App Attack
Vulnerability scanning | method: GET | path: /_phpmyadmin/index.php, /phpMyadmin/index.php, /phpMyAd ...
show moreVulnerability scanning | method: GET | path: /_phpmyadmin/index.php, /phpMyadmin/index.php, /phpMyAdmin-latest/index.php (+11 more) | ua: Go Web Pentest Tool
show less
Wazuh Alert | Rule ID: 100199 | Desc: Suricata: (ET SCAN Suspicious inbound to PostgreSQL port 5432) ...
show moreWazuh Alert | Rule ID: 100199 | Desc: Suricata: (ET SCAN Suspicious inbound to PostgreSQL port 5432) detectado de 217.98.99.102
show less
Port Scan on Honeypot | Ports: 5432/PostgreSQL | Proto: TCP(1) | Flags: all SYN | TTL: 54 | Len: 60B ...
show morePort Scan on Honeypot | Ports: 5432/PostgreSQL | Proto: TCP(1) | Flags: all SYN | TTL: 54 | Len: 60B | Win: 64240(1) | F2B/ufw-honeypot@2026-09-28T13:07:28Z
show less
