JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

159.223.89.141

Neutral Activity

Abuse Confidence Score

0% Low Risk

78 reports

20 reporters · latest 10 months ago

ISP: DigitalOcean, LLC
Usage Type: Data Center/Web Hosting/Transit
ASN: AS14061
Domain Name: digitalocean.com
Country: 🇸🇬 Singapore
City: Singapore

ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report Whois

No reports in the last 60 days

159.223.89.141 has been reported 78 times. The most recent report is from 10 months ago.

The full history is preserved below and remains searchable. A 0% score reflects the absence of recent activity, but this is not a guarantee that earlier reports were invalid. Abuse confidence score decays, naturally, over time, when the abusive activity stops.

Abuse Reports

Export reports CSV

Total reports

78 from 20 distinct reporters

First reported

January 1st 2026

Most recent report

10 months ago

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇳🇱 jjnxpct	2026-01-06 04:47:43 UTC · (10 months ago)	Automated security incident from hosting server. ModSecurity blocked suspicious request targeting URI: /.sftp-config.json (Rule ID: 930130) - Restricted File Access Attempt	Hacking Web App Attack
🇺🇸 TPI-Abuse	2026-01-05 20:56:53 UTC · (10 months ago)	(mod_security) mod_security (id:210492) triggered by 2002:9fdf:598d::9fdf:598d (Unknown): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jan 05 15:56:46.747718 2026] [security2:error] [pid 7539:tid 7539] [client 2002:9 ... show more (mod_security) mod_security (id:210492) triggered by 2002:9fdf:598d::9fdf:598d (Unknown): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jan 05 15:56:46.747718 2026] [security2:error] [pid 7539:tid 7539] [client 2002:9fdf:598d::9fdf:598d:56364] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "3905ccn.org"] [uri "/sftp-config.json"] [unique_id "aVwljqYszAmKsMO7Mv5X8gAAAAA"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-01-05 18:52:34 UTC · (10 months ago)	(mod_security) mod_security (id:210492) triggered by 2002:9fdf:598d::9fdf:598d (Unknown): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jan 05 13:52:26.132239 2026] [security2:error] [pid 14296:tid 14296] [client 2002 ... show more (mod_security) mod_security (id:210492) triggered by 2002:9fdf:598d::9fdf:598d (Unknown): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jan 05 13:52:26.132239 2026] [security2:error] [pid 14296:tid 14296] [client 2002:9fdf:598d::9fdf:598d:49561] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "415test.com"] [uri "/sftp-config.json"] [unique_id "aVwIajThglrg3YL77n_eLgAAAAc"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-01-05 17:21:07 UTC · (10 months ago)	(mod_security) mod_security (id:210492) triggered by 2002:9fdf:598d::9fdf:598d (Unknown): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jan 05 12:21:01.023595 2026] [security2:error] [pid 13834:tid 13834] [client 2002 ... show more (mod_security) mod_security (id:210492) triggered by 2002:9fdf:598d::9fdf:598d (Unknown): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jan 05 12:21:01.023595 2026] [security2:error] [pid 13834:tid 13834] [client 2002:9fdf:598d::9fdf:598d:59268] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "36sovereignchambers.com"] [uri "/sftp-config.json"] [unique_id "aVvy_YQU_bzholA08Mt4wwAAAAI"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-01-05 13:28:15 UTC · (10 months ago)	(mod_security) mod_security (id:210492) triggered by 2002:9fdf:598d::9fdf:598d (Unknown): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jan 05 08:28:06.771795 2026] [security2:error] [pid 14985:tid 14985] [client 2002 ... show more (mod_security) mod_security (id:210492) triggered by 2002:9fdf:598d::9fdf:598d (Unknown): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jan 05 08:28:06.771795 2026] [security2:error] [pid 14985:tid 14985] [client 2002:9fdf:598d::9fdf:598d:55391] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "arcdesign.me"] [uri "/sftp-config.json"] [unique_id "aVu8ZkZ0zr_2t2XkHUTHFwAAABY"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-01-05 12:41:24 UTC · (10 months ago)	(mod_security) mod_security (id:210492) triggered by 159.223.89.141 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jan 05 07:41:16.289486 2026] [security2:error] [pid 32376:tid 32376] [client 159.223.89.141:62944] ... show more (mod_security) mod_security (id:210492) triggered by 159.223.89.141 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jan 05 07:41:16.289486 2026] [security2:error] [pid 32376:tid 32376] [client 159.223.89.141:62944] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "1954topresent.com"] [uri "/sftp-config.json"] [unique_id "aVuxbLVLjGmEmLb74cl_0wAAABs"] show less	Brute-Force Bad Web Bot Web App Attack
🇨🇭 lufi	2026-01-05 08:12:38 UTC · (10 months ago)	2026-01-05 09:12:37 159.223.89.141: blacklistedPath: /sftp-config.json ...	Web Spam Hacking Brute-Force Web App Attack
🇦🇺 aranguren.org	2026-01-05 08:10:27 UTC · (10 months ago)	159.223.89.141 - - [05/Jan/2026:19:10:24 +1100] "GET /sftp-config.json HTTP/1.1" 404 985 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:77.0) Gecko/20100101 Firefox/77.0" 159.223.89.141 - - [05/Jan/2026:19:10:24 +1100] "GET /.vscode/sftp.json ... show more 159.223.89.141 - - [05/Jan/2026:19:10:24 +1100] "GET /sftp-config.json HTTP/1.1" 404 985 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:77.0) Gecko/20100101 Firefox/77.0" 159.223.89.141 - - [05/Jan/2026:19:10:24 +1100] "GET /.vscode/sftp.json HTTP/1.1" 404 985 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:77.0) Gecko/20100101 Firefox/77.0" 159.223.89.141 - - [05/Jan/2026:19:10:25 +1100] "GET /.vscode/ftp-config.json HTTP/1.1" 404 985 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:77.0) Gecko/20100101 Firefox/77.0" 159.223.89.141 - - [05/Jan/2026:19:10:25 +1100] "GET /.vscode/ftp-sync.json HTTP/1.1" 404 985 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:77.0) Gecko/20100101 Firefox/77.0" 159.223.89.141 - - [05/Jan/2026:19:10:25 +1100] "GET /.sftp-config.json HTTP/1.1" 404 985 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:77.0) Gecko/20100101 Firefox/77.0" 159.223.89.141 - - [05/Jan/2026:19:10:26 +1100] "GET /ftp-sync.json HTTP/1.1" 404 985 "-" "Mozil ... show less	Bad Web Bot
🇺🇸 TPI-Abuse	2026-01-05 07:34:02 UTC · (10 months ago)	(mod_security) mod_security (id:210492) triggered by 159.223.89.141 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jan 05 02:33:56.682098 2026] [security2:error] [pid 22646:tid 22646] [client 159.223.89.141:65144] ... show more (mod_security) mod_security (id:210492) triggered by 159.223.89.141 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jan 05 02:33:56.682098 2026] [security2:error] [pid 22646:tid 22646] [client 159.223.89.141:65144] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "advancedmotorsports.com"] [uri "/sftp-config.json"] [unique_id "aVtpZFYXDSzCelfOtwayUQAAABE"] show less	Brute-Force Bad Web Bot Web App Attack
🇳🇱 ParaBug	2026-01-05 05:15:06 UTC · (10 months ago)	159.223.89.141 - - [05/Jan/2026:06:15:06 +0100] "GET /sftp-config.json HTTP/1.1" 301 517 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:77.0) Gecko/20100101 Firefox/77.0" ...	Phishing Brute-Force Web App Attack
Anonymous	2026-01-05 04:54:12 UTC · (10 months ago)	[Mon Jan 05 05:54:08.879849 2026] [authz_core:error] [pid 11600] [client 159.223.89.141:64198] AH01630: client denied by server configuration: /etc/httpd/htdocs [Mon Jan 05 05:54:11.348401 2026] [authz_core:error] [pid 28857] [client 159.223.89.141:6 ... show more [Mon Jan 05 05:54:08.879849 2026] [authz_core:error] [pid 11600] [client 159.223.89.141:64198] AH01630: client denied by server configuration: /etc/httpd/htdocs [Mon Jan 05 05:54:11.348401 2026] [authz_core:error] [pid 28857] [client 159.223.89.141:64859] AH01630: client denied by server configuration: /etc/httpd/htdocs [Mon Jan 05 05:54:12.055553 2026] [authz_core:error] [pid 11603] [client 159.223.89.141:59183] AH01630: client denied by server configuration: /etc/httpd/htdocs ... show less	Web App Attack
🇺🇸 TPI-Abuse	2026-01-05 04:38:11 UTC · (10 months ago)	(mod_security) mod_security (id:210492) triggered by 2002:9fdf:598d::9fdf:598d (Unknown): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Jan 04 23:38:05.411190 2026] [security2:error] [pid 1796:tid 1796] [client 2002:9 ... show more (mod_security) mod_security (id:210492) triggered by 2002:9fdf:598d::9fdf:598d (Unknown): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Jan 04 23:38:05.411190 2026] [security2:error] [pid 1796:tid 1796] [client 2002:9fdf:598d::9fdf:598d:49971] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "antiradares.net"] [uri "/sftp-config.json"] [unique_id "aVtALSwLKzUCkcwyfoyC2QAAAAM"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-01-05 02:30:04 UTC · (10 months ago)	(mod_security) mod_security (id:210492) triggered by 2002:9fdf:598d::9fdf:598d (Unknown): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Jan 04 21:29:55.138684 2026] [security2:error] [pid 8780:tid 8780] [client 2002:9 ... show more (mod_security) mod_security (id:210492) triggered by 2002:9fdf:598d::9fdf:598d (Unknown): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Jan 04 21:29:55.138684 2026] [security2:error] [pid 8780:tid 8780] [client 2002:9fdf:598d::9fdf:598d:65322] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "amgtr.com"] [uri "/sftp-config.json"] [unique_id "aVsiIwc05SJmKW_JNRZ0ygAAAAY"] show less	Brute-Force Bad Web Bot Web App Attack
🇫🇷 masterguru	2026-01-05 01:45:18 UTC · (10 months ago)	Restricted File Access Attempt. Matched phrase "config.json" at REQUEST_FILENAME. (930130-196)	Hacking Web App Attack
🇫🇷 masterguru	2026-01-05 00:28:05 UTC · (10 months ago)	Restricted File Access Attempt. Matched phrase "config.json" at REQUEST_FILENAME. (930130-195)	Hacking Web App Attack

Showing 1 to 15 of 78 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown

Recently Reported IPs:

🇺🇸 147.185.132.109

🇨🇳 36.152.150.242

🇻🇳 27.77.147.163

🇵🇱 2a02:26f0:d8::6851:3cc3

🇸🇬 188.166.226.125

🇧🇷 187.49.11.84

🇩🇪 185.201.137.193

🇧🇷 177.44.82.151

🇺🇸 142.173.153.119

🇳🇵 103.144.106.72

🇮🇩 103.132.54.150

🇵🇱 85.221.140.21

🇳🇱 74.234.167.211

🇩🇪 69.5.169.67

🇫🇷 51.68.236.59

🇬🇧 35.203.211.43

🇳🇱 213.209.159.26

🇺🇸 213.188.85.185

🇧🇷 168.196.162.74

🇨🇳 113.98.254.50