JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

159.89.12.166

Recent Activity

Abuse confidence score ?

100% Critical

9,322 reports

1,170 reporters · latest 52 minutes ago

ISP	DigitalOcean, LLC
Usage Type	Data Center/Web Hosting/Transit
ASN	AS14061
Hostname(s)	c5d51acfea.scan.leakix.org
Domain Name	digitalocean.com
Country	🇩🇪 Germany
City	Frankfurt am Main, Hesse

ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report Whois

Reports Activity

Example preview

Report Categories (Last 60 Days)

Example preview

Top Reporter Countries (Last 60 Days)

Example preview

Account required for the enhanced features Log in Sign up

IP Abuse Reports for 159.89.12.166

Export CSV

This IP address has been reported a total of 9,322 times from 1,170 distinct sources. 159.89.12.166 was first reported on October 18th 2023, and the most recent report was 52 minutes ago. In the last 60 days, the top reporter locations were: Poland with 208 reports; United States of America with 199 reports; Germany with 186 reports. The most common categories in these recent reports were: Web App Attack 785 times; Bad Web Bot 425 times; Brute-Force 232 times; Hacking 211 times; Port Scan 189 times; Other 112 times.

Reporter	IoA Timestamp (UTC)	Comment	Categories
Anonymous	2026-10-25 21:51:30 (52 minutes ago)	2026-10-25T23:51:28.886681+02:00 aion wordpress[1509927]: Blocked user enumeration attempt from 159. ... show more 2026-10-25T23:51:28.886681+02:00 aion wordpress[1509927]: Blocked user enumeration attempt from 159.89.12.166 ... show less	Hacking Brute-Force
🇳🇱 ams_sec_user	2026-10-25 21:05:17 (1 hour ago)	Automated requests against a hosted website: 24 requests between 20:00 and 20:59 UTC; 4 probes for e ... show more Automated requests against a hosted website: 24 requests between 20:00 and 20:59 UTC; 4 probes for exposed secrets/config files (/.env, /.git/config). Reported automatically. show less	Hacking Bad Web Bot Web App Attack
🇷🇴 clauss	2026-10-25 20:08:40 (2 hours ago)	159.89.12.166 - - [25/Oct/2026:22:08:39 +0200] "GET /server-status HTTP/2.0" 404 4784 "-" "Mozilla/5 ... show more 159.89.12.166 - - [25/Oct/2026:22:08:39 +0200] "GET /server-status HTTP/2.0" 404 4784 "-" "Mozilla/5.0 (l9scan/2.0.132323e24393e21323e2430313; +https://leakix.net)" ... show less	Web App Attack
Anonymous	2026-10-25 19:29:29 (3 hours ago)	Illegal access attempt blocked by WAF on /.vscode/sftp.json, /?rest_route=/wp/v2/users/, /debug/defa ... show more Illegal access attempt blocked by WAF on /.vscode/sftp.json, /?rest_route=/wp/v2/users/, /debug/default/view?panel=config, /@vite/env, /trace.axd, /console/, /server, /server-status, /about, /login.action, /___proxy_subdomain_whm/login, /___proxy_subdomain_cpanel, /v2/_catalog, /.DS_Store, /.env, /ecp/Current/exporttool/microsoft.exchange.ediscovery.exporttool.application, /.git/config, /api, /graphql/api, /graphql, /api/graphql, /api/gql, /s/637313e2830323e23383e20393/_/;/META-INF/maven/com.atlassian.jira/jira-webapp-dist/pom.properties, /config.json, /telescope/requests, /php/login.php, /info.php, /.well-known/security.txt, /actuator/env show less	Hacking Web App Attack
Anonymous	2026-10-25 18:41:30 (4 hours ago)	Banned by Fail2Ban on server	Web App Attack
🇺🇸 SYSMarshal	2026-10-25 17:29:50 (5 hours ago)	SYSMarshal detection: Port Scanning, Web Application Attack, DDoS Attack, DNS Attack, Bad Bot [Port: ... show more SYSMarshal detection: Port Scanning, Web Application Attack, DDoS Attack, DNS Attack, Bad Bot [Port:443, Proto:TCP, EventID:5152] show less	Port Scan Web App Attack Bad Web Bot
🇵🇱 Budyn	2026-10-25 17:20:19 (5 hours ago)	Automated threat detected by Budyn Honeypot Sinkhole. Attack type: Enterprise & Framework Recon Scan ... show more Automated threat detected by Budyn Honeypot Sinkhole. Attack type: Enterprise & Framework Recon Scanner. Malicious scanner triggered a security trap targeting emulated vulnerabilities. Evidence: HOST: backup.teddypot.cloud \| URI: /.git/config \| UA: Mozilla/5.0 (l9scan/2.0.4393e2937313e27363e2237313; +https://leakix.net) \| BODY: [Empty / GET Request] \| HEADERS: {"X-Forwarded-Proto":"https","Cf-Visitor":"{\"scheme\":\"https\"}","Cf-Ipcountry":"DE","Cf-Connecting-Ip":"159.89.12.166","Cdn-Loop":"cloudflare; loops=1","Cf-Ray":"a502e42b1c4777d1-FRA","Connection":"Keep-Alive","Accept-Encoding":"gzip, br","X-Forwarded-For":"159.89.12.166"} show less	Bad Web Bot Web App Attack
Anonymous	2026-10-25 16:46:16 (5 hours ago)	CrowdSec detection: crowdsecurity/jira_cve-2021-26086	Hacking Web App Attack
🇺🇸 Aurealize	2026-10-25 15:28:24 (7 hours ago)	Automated Sensitive File discovery attempt detected by a Cloudflare WAF custom rule. Path: /.env.	Web App Attack Hacking
🇵🇱 Budyn	2026-10-25 15:17:54 (7 hours ago)	Automated threat detected by Budyn Honeypot Sinkhole. Attack type: Enterprise & Framework Recon Scan ... show more Automated threat detected by Budyn Honeypot Sinkhole. Attack type: Enterprise & Framework Recon Scanner. Malicious scanner triggered a security trap targeting emulated vulnerabilities. Evidence: HOST: registry.goblinpot.online \| URI: /.env \| UA: Mozilla/5.0 (l9scan/2.0.335323e2539313e27363e2237313; +https://leakix.net) \| BODY: [Empty / GET Request] \| HEADERS: {"X-Forwarded-Proto":"https","Cf-Visitor":"{\"scheme\":\"https\"}","Cf-Ipcountry":"DE","Cf-Connecting-Ip":"159.89.12.166","Cdn-Loop":"cloudflare; loops=1","Cf-Ray":"a50230d49cefd2cb-FRA","Connection":"Keep-Alive","Accept-Encoding":"gzip, br","X-Forwarded-For":"159.89.12.166"} show less	Bad Web Bot Web App Attack
🇫🇷 UnixPrime	2026-10-25 15:02:49 (7 hours ago)	159.89.12.166 - - [25/Oct/2026:16:02:43 +0100] "GET /server-status HTTP/1.1" 404 184 "-" "Mozilla/5. ... show more 159.89.12.166 - - [25/Oct/2026:16:02:43 +0100] "GET /server-status HTTP/1.1" 404 184 "-" "Mozilla/5.0 (l9scan/2.0.233323e2631323e2134323e20383; +https://leakix.net)" 159.89.12.166 - - [25/Oct/2026:16:02:49 +0100] "GET /.env HTTP/1.1" 404 184 "-" "Mozilla/5.0 (l9scan/2.0.233323e2631323e2134323e20383; +https://leakix.net)" ... show less	Bad Web Bot Web App Attack
🇳🇱 Alt255	2026-10-25 14:45:34 (7 hours ago)	[ti-30al] Web exploit scanning: 1 suspicious requests detected by fail2ban jail apache-scanner. Exam ... show more [ti-30al] Web exploit scanning: 1 suspicious requests detected by fail2ban jail apache-scanner. Example: 159.89.12.166 - - [25/Oct/2026:15:45:34 +0100] "GET /.env HTTP/1.1" 301 562 "-" "Mozilla/5.0 (l9scan/2.0.131313e2532323e2434313e2633313; +https://leakix.net)" ... show less	Bad Web Bot Web App Attack
🇳🇱 Alt255	2026-10-25 13:50:36 (8 hours ago)	[ti-01ov] Web exploit scanning: 1 suspicious requests detected by fail2ban jail <name>. Example: 159 ... show more [ti-01ov] Web exploit scanning: 1 suspicious requests detected by fail2ban jail <name>. Example: 159.89.12.166 - - \[22/Oct/2026:13:42:03 +0200\] "GET /.env HTTP/1.1" 301 569 "-" "Mozilla/5.0 \(l9scan/2.0.9393e2535313e2031323e2934313\; +https://leakix.net\)" ... show less	Bad Web Bot Web App Attack
🇺🇸 Sonoflet	2026-10-25 13:15:40 (9 hours ago)	CrowdSec detection \| scenario: http-probing	Port Scan Web App Attack
🇵🇱 Budyn	2026-10-25 11:28:29 (11 hours ago)	Automated threat detected by Budyn Honeypot Sinkhole. Attack type: Enterprise & Framework Recon Scan ... show more Automated threat detected by Budyn Honeypot Sinkhole. Attack type: Enterprise & Framework Recon Scanner. Malicious scanner triggered a security trap targeting emulated vulnerabilities. Evidence: HOST: telemetry.dont-eat-the-pudding.online \| URI: /.env \| UA: Mozilla/5.0 (l9scan/2.0.33e27393e2431313e2838313; +https://leakix.net) \| BODY: [Empty / GET Request] \| HEADERS: {"Connection":"Keep-Alive","X-Forwarded-Proto":"https","Cf-Visitor":"{\"scheme\":\"https\"}","Cf-Ipcountry":"DE","Cf-Connecting-Ip":"159.89.12.166","Cdn-Loop":"cloudflare; loops=1","Cf-Ray":"a500e0ca481ca06a-FRA","Accept-Encoding":"gzip, br","X-Forwarded-For":"159.89.12.166"} show less	Bad Web Bot Web App Attack

Showing 1 to 15 of 9322 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇯🇵 2602:f71d:400::20

🇳🇱 200.138.46.120

🇨🇳 180.165.45.184

🇷🇸 109.245.191.113

🇺🇸 66.132.195.50

🇲🇾 27.125.241.98

🇺🇸 20.169.91.44

🇷🇴 193.46.255.86

🇮🇳 187.127.190.150

🇺🇸 150.136.104.48

🇺🇸 107.21.191.211

🇧🇬 79.124.49.90

🇵🇱 45.138.12.47

🇺🇸 34.174.165.39

🇺🇸 20.40.252.89

🇨🇳 222.161.223.54

🇰🇷 218.156.38.44

🇨🇿 217.138.220.24

🇧🇷 186.208.87.115

🇭🇰 185.227.152.135