JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 149.88.103.89

149.88.103.89 was found in our database!

This IP was reported 103 times. Confidence of Abuse is 17%: ?

17%

ISP	Datacamp Limited
Usage Type	Data Center/Web Hosting/Transit
ASN	AS212238
Hostname(s)	unn-149-88-103-89.datapacket.com
Domain Name	datacamp.co.uk
Country	🇯🇵 Japan
City	Tokyo, Tokyo

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 149.88.103.89

Whois 149.88.103.89

IP Abuse Reports for 149.88.103.89:

This IP address has been reported a total of 103 times from 65 distinct sources. 149.88.103.89 was first reported on September 14th 2024, and the most recent report was 19 hours ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇧🇪 cmbplf	2026-10-22 04:19:52 (19 hours ago)	546 requests with user_agent.original Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.2.1) Gecko/20021 ... show more 546 requests with user_agent.original Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.2.1) Gecko/20021208 Debian/1.2.1-2 540 requests with user_agent.original Mozilla/5.0 (iPhone; CPU iPhone OS 16_1_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Mobile/15E148 [LinkedInApp]/9.28.7586 503 requests with user_agent.original AppleCoreMedia/1.0.0.23A344 (Macintosh; U; Intel Mac OS X 14_0; da_dk) 501 requests with user_agent.original Mozilla/5.0 (iPhone; CPU iPhone OS 15_6_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Mobile/19G82 Instagram 306.0.0.20.118 (iPhone12,1; iOS 15_6_1; en_GB; en; scale=2.00; 828x1792; 529083166) NW/3 455 requests with user_agent.original Dalvik/2.1.0 (Linux; U; Android 11; Tibuta_MasterPad-E100 Build/RP1A.201005.006) 450 requests with user_agent.original Mozilla/5.0 (X11; U; Linux i586; en-US; rv:1.0.0) Gecko/20020623 Debian/1.0.0-0.woody.1 438 requests with user_agent.original Mozilla/5.0 (Macintosh; U; PPC; en-US; rv:0.9.3) Gecko/20010802 419 requests with us show less	Brute-Force Bad Web Bot
🇫🇷 Lino Project	2026-09-22 17:02:15 (1 month ago)	149.88.103.89 - - [22/Sep/2026:19:02:07 +0200] "GET /.env HTTP/1.1" 302 505 "-" "Mozilla/5.0 (Linux; ... show more 149.88.103.89 - - [22/Sep/2026:19:02:07 +0200] "GET /.env HTTP/1.1" 302 505 "-" "Mozilla/5.0 (Linux; U; Android 4.4.2; en-US; HM NOTE 1W Build/KOT49H) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 UCBrowser/11.0.5.850 U3/0.8.0 Mobile Safari/534.30" 149.88.103.89 - - [22/Sep/2026:19:02:13 +0200] "GET /.env HTTP/1.1" 404 5682 "-" "Mozilla/5.0 (Linux; U; Android 4.4.2; en-US; HM NOTE 1W Build/KOT49H) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 UCBrowser/11.0.5.850 U3/0.8.0 Mobile Safari/534.30" ... show less	Brute-Force Bad Web Bot Web App Attack
🇫🇷 dynamix	2026-09-22 16:59:42 (1 month ago)	Multiple WAF Violations	Web App Attack
🇯🇵 SentinalX by uzumaru	2026-06-27 01:49:11 (3 months ago)	Detected by SentinelX honeypot: sent HTTP CONNECT request probing for an open proxy. Connection was ... show more Detected by SentinelX honeypot: sent HTTP CONNECT request probing for an open proxy. Connection was hijacked and held in a tarpit to slow down the scan. Probed target: ifconfig.me:443 show less	Open Proxy Port Scan
🇯🇵 SentinalX by uzumaru	2026-06-24 08:49:56 (3 months ago)	Detected by SentinelX honeypot: sent HTTP CONNECT request probing for an open proxy. Connection was ... show more Detected by SentinelX honeypot: sent HTTP CONNECT request probing for an open proxy. Connection was hijacked and held in a tarpit to slow down the scan. Probed target: one.one.one.one:443 show less	Open Proxy Port Scan
🇩🇪 big-cloud.nl	2026-06-18 19:15:45 (4 months ago)	Try to access /vendor/phpunit/phpunit/phpunit.xsd	Web App Attack
🇩🇪 FeG Deutschland	2026-06-18 09:06:48 (4 months ago)	Looking for CMS/PHP/SQL vulnerablilities/excessive crawling - 124	Exploited Host Web App Attack
Anonymous	2026-06-17 00:46:49 (4 months ago)	[Firewall Canary] Temporary ban due to firewall rule match [URI:/vendor/]	Bad Web Bot Web App Attack
🇯🇵 SentinalX by uzumaru	2026-05-30 00:55:33 (4 months ago)	Detected by SentinelX honeypot: sent HTTP CONNECT request probing for an open proxy. Connection was ... show more Detected by SentinelX honeypot: sent HTTP CONNECT request probing for an open proxy. Connection was hijacked and held in a tarpit to slow down the scan. Probed target: clients3.google.com:443 show less	Open Proxy Port Scan
🇯🇵 SentinalX by uzumaru	2026-05-24 00:54:10 (4 months ago)	Detected by SentinelX honeypot: sent HTTP CONNECT request probing for an open proxy. Connection was ... show more Detected by SentinelX honeypot: sent HTTP CONNECT request probing for an open proxy. Connection was hijacked and held in a tarpit to slow down the scan. Probed target: connectivitycheck.gstatic.com:443 show less	Open Proxy Port Scan
Anonymous	2026-05-15 07:11:44 (5 months ago)	IM360 WAF: Laravel Apps Leaking Secrets exploit attempt MV:androxgh0st	Web App Attack
Anonymous	2026-05-15 07:11:43 (5 months ago)	IM360 WAF: Direct access to sensitive file or dotfile MV:/.env	Web App Attack
🇩🇪 BlueWire Hosting	2026-05-15 03:17:34 (5 months ago)	Bad bot ignoring robot.txt	Bad Web Bot
🇺🇸 TPI-Abuse	2026-05-07 06:30:46 (5 months ago)	(mod_security) mod_security (id:210730) triggered by 149.88.103.89 (unn-149-88-103-89.datapacket.com ... show more (mod_security) mod_security (id:210730) triggered by 149.88.103.89 (unn-149-88-103-89.datapacket.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu May 07 02:30:42.436778 2026] [security2:error] [pid 19805:tid 19805] [client 149.88.103.89:20561] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy\|\|www.voodooshop.com\|F\|2"] [data ".xsd"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.voodooshop.com"] [uri "/vendor/phpunit/phpunit/phpunit.xsd"] [unique_id "afwxkiYz9qR8l9lb4Y43LQAAAA0"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-05-07 05:51:13 (5 months ago)	(mod_security) mod_security (id:210730) triggered by 149.88.103.89 (unn-149-88-103-89.datapacket.com ... show more (mod_security) mod_security (id:210730) triggered by 149.88.103.89 (unn-149-88-103-89.datapacket.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu May 07 01:51:08.112703 2026] [security2:error] [pid 19283:tid 19283] [client 149.88.103.89:38239] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy\|\|www.rdsparts.com\|F\|2"] [data ".xsd"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.rdsparts.com"] [uri "/vendor/phpunit/phpunit/phpunit.xsd"] [unique_id "afwoTGWRQvxcp0cKAq5h9QAAAA4"] show less	Brute-Force Bad Web Bot Web App Attack

Showing 1 to 15 of 103 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇮🇩 192.42.85.90

🇨🇳 182.43.164.191

🇺🇸 45.130.83.122

🇮🇩 36.68.189.62

🇧🇪 34.52.229.253

🇬🇧 5.102.169.102

🇨🇳 121.229.191.90

🇯🇵 34.85.112.226

🇺🇸 34.44.217.60

🇦🇺 216.226.77.20

🇹🇷 88.248.250.143

🇰🇷 1.227.228.131

🇬🇧 217.42.26.37

🇳🇱 193.47.62.69

🇺🇦 193.33.189.52

🇵🇹 188.81.118.193

🇨🇳 120.237.113.139

🇺🇸 96.78.175.36

🇺🇿 89.126.211.166

🇬🇧 77.67.26.31