JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 142.147.89.237

142.147.89.237 was found in our database!

This IP was reported 184 times. Confidence of Abuse is 68%: ?

68%

ISP	Mullvad VPN AB
Usage Type	Data Center/Web Hosting/Transit
ASN	AS6233
Hostname(s)	142.147.89.237.static.xtom.com
Domain Name	mullvad.net
Country	🇺🇸 United States of America
City	San Jose, California

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 142.147.89.237

Whois 142.147.89.237

IP Abuse Reports for 142.147.89.237:

This IP address has been reported a total of 184 times from 39 distinct sources. 142.147.89.237 was first reported on July 13th 2024, and the most recent report was 2 days ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇺🇸 Jakub Sikora	2026-06-02 06:00:50 (2 days ago)	PHP webshell scanner detected by honeytrap. Threat score: 30, total requests: 6. Probed paths: /.env ... show more PHP webshell scanner detected by honeytrap. Threat score: 30, total requests: 6. Probed paths: /.env. Triggered honeypots: canary_env. show less	Bad Web Bot Web App Attack
🇺🇸 1cyb3rpunk	2026-06-02 01:46:31 (2 days ago)	Honeypot trap [method_not_allowed_probe] on sectrace.org — path: /.env stage: recon. Automated scann ... show more Honeypot trap [method_not_allowed_probe] on sectrace.org — path: /.env stage: recon. Automated scanner/attacker activity. show less	Port Scan Brute-Force Bad Web Bot Web App Attack
🇺🇸 whatda	2026-06-01 19:55:17 (2 days ago)	HTTP tarpit triggered at /__debug__/render_panel/?panel_id=SettingsPanel. Scanner trapped for ~30s. ... show more HTTP tarpit triggered at /__debug__/render_panel/?panel_id=SettingsPanel. Scanner trapped for ~30s. UA: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0. show less	Bad Web Bot Web App Attack
🇨🇦 1gz	2026-06-01 19:34:43 (2 days ago)	Triggered Cloudflare WAF (firewallManaged) from US. Action taken: BLOCK Protocol: HTTP/1.1 (POST met ... show more Triggered Cloudflare WAF (firewallManaged) from US. Action taken: BLOCK Protocol: HTTP/1.1 (POST method) Endpoint: / UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 This report was generated by: https://github.com/sefinek/Cloudflare-WAF-To-AbuseIPDB show less	Bad Web Bot
🇺🇸 ambor	2026-06-01 17:07:04 (2 days ago)	Attack type: honeypot_lure \| Target: /.env \| UA: Mozilla/5.0 (Windows NT 10.0; rv:105.0) Gecko/2010 ... show more Attack type: honeypot_lure \| Target: /.env \| UA: Mozilla/5.0 (Windows NT 10.0; rv:105.0) Gecko/2010 \| Method: POST \| Country: US show less	Hacking
🇺🇸 Sling	2026-06-01 15:36:58 (2 days ago)	Automated detection: IP accessed 2 sensitive endpoints within 30s on spotify.slingexe.com. Paths: /. ... show more Automated detection: IP accessed 2 sensitive endpoints within 30s on spotify.slingexe.com. Paths: /.env, /.env.production. UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36. show less	Web App Attack Bad Web Bot Hacking
🇫🇷 Dorian GRANDHAY	2026-06-01 14:01:04 (2 days ago)	(smtpauth) Failed SMTP AUTH login from 142.147.89.237 (US/United States/142.147.89.237.static.xtom.c ... show more (smtpauth) Failed SMTP AUTH login from 142.147.89.237 (US/United States/142.147.89.237.static.xtom.com): 5 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_SMTPAUTH; Logs: 2026-06-01 16:00:47 dovecot_plain authenticator failed for H=([10.140.106.169]) [142.147.89.237]:37393: 535 Incorrect authentication data ([email protected]) 2026-06-01 16:00:51 dovecot_login authenticator failed for H=([10.140.106.169]) [142.147.89.237]:37393: 535 Incorrect authentication data ([email protected]) 2026-06-01 16:00:55 dovecot_plain authenticator failed for H=([10.140.106.169]) [142.147.89.237]:37541: 535 Incorrect authentication data ([email protected]) 2026-06-01 16:00:58 dovecot_login authenticator failed for H=([10.140.106.169]) [142.147.89.237]:37541: 535 Incorrect authentication data ([email protected]) 2026-06-01 16:01:03 dovecot_plain authenticator failed for H=([10.140.106.169]) [142.147.89.237]:37663: 535 Incorrect authentication data ([email protected]) show less	Port Scan
🇺🇸 seanwall	2026-06-01 11:31:11 (2 days ago)	Automated scanner/attacker probing war-room. Paths: ['/.env', '/.env']. UA: ['Mozilla/5.0 (X11; Linu ... show more Automated scanner/attacker probing war-room. Paths: ['/.env', '/.env']. UA: ['Mozilla/5.0 (X11; Linux x86_64; rv:105.0) Gecko/20100101 Firefox/105.0'] show less	Port Scan Bad Web Bot Web App Attack
🇺🇸 ambor	2026-06-01 10:58:42 (2 days ago)	Attack type: honeypot_lure \| Target: /.env \| UA: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 ... show more Attack type: honeypot_lure \| Target: /.env \| UA: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 \| Method: POST \| Country: US show less	Hacking
🇺🇸 ambor	2026-06-01 07:54:25 (2 days ago)	Honeypot triggered: /.env on ifebridge.com. User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv ... show more Honeypot triggered: /.env on ifebridge.com. User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0. Method: POST show less	Web App Attack
🇺🇸 ambor	2026-06-01 05:47:02 (3 days ago)	Honeypot triggered: /.env on ifebridge.com. User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) Ap ... show more Honeypot triggered: /.env on ifebridge.com. User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Safari/537.36. Method: POST show less	Web App Attack
🇺🇸 whatda	2026-06-01 05:35:11 (3 days ago)	HTTP tarpit triggered at /__debug__/render_panel/?panel_id=SettingsPanel. Scanner trapped for ~30s. ... show more HTTP tarpit triggered at /__debug__/render_panel/?panel_id=SettingsPanel. Scanner trapped for ~30s. UA: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16. show less	Bad Web Bot Web App Attack
🇺🇸 ambor	2026-06-01 04:38:14 (3 days ago)	Honeypot triggered: /.env on ifebridge.com. User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15 ... show more Honeypot triggered: /.env on ifebridge.com. User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Safari/537.36. Method: POST show less	Web App Attack
🇺🇸 moppetto	2026-06-01 04:05:07 (3 days ago)	Node.js .env file credential scraping; POST /.env	Bad Web Bot Hacking
🇺🇸 ambor	2026-06-01 03:21:44 (3 days ago)	Honeypot access: Environment file access attempt. Path: /.env	Web App Attack

Showing 1 to 15 of 184 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇺🇸 208.87.242.107

🇮🇳 139.59.30.229

🇨🇴 45.179.200.156

🇵🇰 39.32.39.132

🇳🇱 195.178.110.30

🇬🇧 193.163.125.87

🇻🇪 186.96.74.216

🇩🇪 185.220.101.177

🇨🇴 181.234.29.66

🇧🇷 168.181.49.236

🇮🇩 103.84.5.9

🇷🇴 80.94.92.186

🇩🇿 41.111.218.240

🇨🇳 14.103.113.212

🇮🇳 202.53.94.246

🇺🇸 195.184.76.245

🇮🇳 182.95.111.46

🇨🇳 180.153.236.58

🇳🇱 176.65.139.130

🇺🇸 162.216.149.241