JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 24.199.121.239

24.199.121.239 was found in our database!

This IP was reported 40 times. Confidence of Abuse is 70%: ?

70%

ISP	DigitalOcean, LLC
Usage Type	Data Center/Web Hosting/Transit
ASN	AS14061
Domain Name	digitalocean.com
Country	🇺🇸 United States of America
City	Santa Clara, California

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 24.199.121.239

Whois 24.199.121.239

IP Abuse Reports for 24.199.121.239:

This IP address has been reported a total of 40 times from 24 distinct sources. 24.199.121.239 was first reported on June 7th 2025, and the most recent report was 40 minutes ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇺🇸 LSPCCU	2026-09-03 14:30:52 (40 minutes ago)	TSEC Honeypot Network report. Threat score: 63/100. Categories: Port Scan, Hacking, Brute-Force, Web ... show more TSEC Honeypot Network report. Threat score: 63/100. Categories: Port Scan, Hacking, Brute-Force, Web App Attack, SSH. Honeypot: h0neytr4p. Context: 24.199.121.239 classified as botnet node participating in coordinated attack campaigns (high confidence). show less	Port Scan Hacking Brute-Force Web App Attack SSH
🇳🇱 Ike57	2026-09-03 11:31:49 (3 hours ago)	Detected activity: Proxycheck.io Risk score: 33%; Multiple WAF violations; Malicious activity detect ... show more Detected activity: Proxycheck.io Risk score: 33%; Multiple WAF violations; Malicious activity detected; Abuse Confidence score over set treshold; Blocked by web application firewall; Datacenter IP detected \| User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 show less	Bad Web Bot Web App Attack
🇺🇸 HamSammich	2026-09-03 02:42:59 (12 hours ago)	Automated sensor: 1 HTTPS connection/probe attempts over the last 24h (latest 2026-09-03T02:42Z).	Brute-Force Web App Attack
🇺🇸 Charlesiv	2026-09-03 02:30:54 (12 hours ago)	Triggered Cloudflare WAF (firewallCustom) from US. Action taken: MANAGED_CHALLENGE ASN: 14061 (Digit ... show more Triggered Cloudflare WAF (firewallCustom) from US. Action taken: MANAGED_CHALLENGE ASN: 14061 (DigitalOcean, LLC) Protocol: HTTP/2 (GET method) Endpoint: /quw-AoaLuwWM5FAgZe Timestamp: 2026-09-03T01:20:08Z Ray ID: a350ee282b4f9811 UA: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36 show less	Bad Web Bot
🇺🇸 TPI-Abuse	2026-09-02 18:27:47 (20 hours ago)	(mod_security) mod_security (id:210730) triggered by 24.199.121.239 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210730) triggered by 24.199.121.239 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Sep 02 14:27:39.863250 2026] [security2:error] [pid 23697:tid 23697] [client 24.199.121.239:58742] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "4"] [msg "COMODO WAF: URL file extension is restricted by policy\|\|planettony.com\|F\|2"] [data ".planettony.com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "planettony.com"] [uri "/recipe/www.planettony.com"] [unique_id "aphqm4BvzJmYYqyfgEzVUwAAABk"], referer: https://www.google.com/search?q=planettony show less	Brute-Force Bad Web Bot Web App Attack
🇩🇪 jbcrn	2026-09-02 11:25:47 (1 day ago)	Blocked by iocaine (nam-shub-of-enki) tarpit. Classified as: Aggressive maze explorers, ruleset: gen ... show more Blocked by iocaine (nam-shub-of-enki) tarpit. Classified as: Aggressive maze explorers, ruleset: generated-url. Requested honeypot path: /deflagration.malacopod/. User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/141.0.0.0 Safari/537.36 show less	Bad Web Bot Web App Attack
🇵🇱 Budyn	2026-09-02 11:12:45 (1 day ago)	Automated threat detected by Budyn Honeypot Sinkhole. Attack type: CRITICAL: ModSecurity WAF Exploit ... show more Automated threat detected by Budyn Honeypot Sinkhole. Attack type: CRITICAL: ModSecurity WAF Exploit Block. Malicious scanner triggered a security trap targeting emulated vulnerabilities. Evidence: HOST: por.budyn.ovh \| URI: /.env \| UA: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36 \| BODY: [Empty / GET Request] show less	Hacking Web App Attack
🇨🇭 backslash	2026-09-02 11:03:02 (1 day ago)	block ruleset CC531825F9395F9A07FB06C1247C46770A2690F8	Bad Web Bot
Anonymous	2026-08-17 02:56:32 (2 weeks ago)	denied traffic to a honeypot network. destination port 6666.	Port Scan Hacking
🇺🇸 RAP	2026-08-17 02:49:40 (2 weeks ago)	2026-08-17 02:49:40 UTC Unauthorized activity to TCP port 8080. Web App	Port Scan Web App Attack
🇬🇧 Nov	2026-08-17 02:24:55 (2 weeks ago)	Unauthorized access attempt (tcp/3306)	Port Scan
🇺🇸 MPL	2026-07-30 14:25:22 (1 month ago)	tcp/7000 (2 or more attempts)	Port Scan
🇺🇸 xmission.com	2026-07-30 13:46:07 (1 month ago)	Blocked by UFW (TCP on 5555) Source port: 61015 TTL: 245 Packet length: 44 TOS: 0x08 This report (f ... show more Blocked by UFW (TCP on 5555) Source port: 61015 TTL: 245 Packet length: 44 TOS: 0x08 This report (for 24.199.121.239) was generated by: https://github.com/sefinek/UFW-AbuseIPDB-Reporter show less	Port Scan
🇩🇪 Admins@FBN	2026-07-30 13:32:10 (1 month ago)	FW-PortScan: Traffic Blocked srcport=61009 dstport=7443	Port Scan
🇩🇪 ValtonTahiri	2026-07-30 13:27:19 (1 month ago)	UFW blocked a suspicious connection attempt to a closed or denied port. This activity is commonly as ... show more UFW blocked a suspicious connection attempt to a closed or denied port. This activity is commonly associated with port scanning, service discovery, or automated internet probing. Technical: source_ip=24.199.121.239; proto=TCP; source_port=61013; target_port=1245; flags=SYN show less	Port Scan

Showing 1 to 15 of 40 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇪🇸 34.175.1.130

🇦🇺 202.62.129.18

🇵🇰 144.48.133.35

🇨🇿 78.44.192.210

🇺🇸 67.205.185.50

🇺🇦 46.151.151.117

🇩🇪 213.209.159.208

🇪🇸 212.0.102.131

🇬🇹 201.216.171.19

🇳🇱 195.178.110.232

🇬🇧 185.152.251.7

🇸🇾 91.144.32.178

🇫🇷 85.25.185.20

🇳🇱 82.170.60.76

🇩🇪 67.213.121.153

🇫🇷 51.255.81.180

🇧🇷 45.170.152.51

🇨🇳 36.153.164.122

🇺🇸 24.199.117.56

🇨🇳 221.1.218.230