JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

159.223.89.20

Neutral Activity

Abuse Confidence Score

0% Low Risk

52 reports

19 reporters · latest 6 months ago

ISP: DigitalOcean, LLC
Usage Type: Data Center/Web Hosting/Transit
ASN: AS14061
Domain Name: digitalocean.com
Country: 🇸🇬 Singapore
City: Singapore

ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report Whois

No reports in the last 60 days

159.223.89.20 has been reported 52 times. The most recent report is from 6 months ago.

The full history is preserved below and remains searchable. A 0% score reflects the absence of recent activity, but this is not a guarantee that earlier reports were invalid. Abuse confidence score decays, naturally, over time, when the abusive activity stops.

Abuse Reports

Export reports CSV

Total reports

52 from 19 distinct reporters

First reported

May 1st 2026

Most recent report

6 months ago

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇺🇸 octageeks.com	2026-05-05 04:08:21 UTC · (6 months ago)	Wordpress malicious attack:[octablocked]	Web App Attack
🇩🇪 Hugopvigo	2026-05-04 21:28:18 UTC · (6 months ago)	[Mon May 04 23:28:11.626788 2026] [authz_core:error] [pid 73433:tid 127218502059712] [client 159.223.89.20:55666] AH01630: client denied by server configuration: /var/www/html/wordpress/sftp-config.json [Mon May 04 23:28:16.918576 2026] [authz_core:e ... show more [Mon May 04 23:28:11.626788 2026] [authz_core:error] [pid 73433:tid 127218502059712] [client 159.223.89.20:55666] AH01630: client denied by server configuration: /var/www/html/wordpress/sftp-config.json [Mon May 04 23:28:16.918576 2026] [authz_core:error] [pid 73432:tid 127218122479296] [client 159.223.89.20:59049] AH01630: client denied by server configuration: /var/www/html/wordpress/.sftp-config.json [Mon May 04 23:28:17.506478 2026] [authz_core:error] [pid 73432:tid 127218105693888] [client 159.223.89.20:61820] AH01630: client denied by server configuration: /var/www/html/wordpress/ftp-sync.json ... show less	Hacking Brute-Force Web App Attack SSH
🇺🇸 TPI-Abuse	2026-05-04 20:55:43 UTC · (6 months ago)	(mod_security) mod_security (id:210492) triggered by 159.223.89.20 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon May 04 16:55:37.019289 2026] [security2:error] [pid 15119:tid 15119] [client 159.223.89.20:57346] M ... show more (mod_security) mod_security (id:210492) triggered by 159.223.89.20 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon May 04 16:55:37.019289 2026] [security2:error] [pid 15119:tid 15119] [client 159.223.89.20:57346] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "ehrlichfamily.net"] [uri "/sftp-config.json"] [unique_id "afkHyRv4GNWa93W8ITrHpwAAAAg"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-05-04 18:49:13 UTC · (6 months ago)	(mod_security) mod_security (id:210492) triggered by 159.223.89.20 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon May 04 14:49:06.954993 2026] [security2:error] [pid 32283:tid 32283] [client 159.223.89.20:61451] M ... show more (mod_security) mod_security (id:210492) triggered by 159.223.89.20 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon May 04 14:49:06.954993 2026] [security2:error] [pid 32283:tid 32283] [client 159.223.89.20:61451] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "eagleoaks.net"] [uri "/sftp-config.json"] [unique_id "afjqIsnt1h2PIQ41OokmygAAAA0"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-05-04 18:16:47 UTC · (6 months ago)	(mod_security) mod_security (id:210492) triggered by 159.223.89.20 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon May 04 14:16:42.633896 2026] [security2:error] [pid 32144:tid 32144] [client 159.223.89.20:57833] M ... show more (mod_security) mod_security (id:210492) triggered by 159.223.89.20 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon May 04 14:16:42.633896 2026] [security2:error] [pid 32144:tid 32144] [client 159.223.89.20:57833] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.al-harbi.com"] [uri "/sftp-config.json"] [unique_id "afjiiisol01qSdkmPo2x6AAAAAM"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-05-04 17:59:19 UTC · (6 months ago)	(mod_security) mod_security (id:210492) triggered by 159.223.89.20 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon May 04 13:59:15.732908 2026] [security2:error] [pid 14166:tid 14166] [client 159.223.89.20:50033] M ... show more (mod_security) mod_security (id:210492) triggered by 159.223.89.20 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon May 04 13:59:15.732908 2026] [security2:error] [pid 14166:tid 14166] [client 159.223.89.20:50033] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "edsantos.biz"] [uri "/sftp-config.json"] [unique_id "afjeczxWEa-5dSqIb18cwwAAACY"] show less	Brute-Force Bad Web Bot Web App Attack
🇫🇷 masterguru	2026-05-04 17:06:56 UTC · (6 months ago)	Restricted File Access Attempt. Matched phrase "config.json" at REQUEST_FILENAME. (930130-193)	Hacking Web App Attack
🇬🇧 consul.to	2026-05-04 16:55:56 UTC · (6 months ago)	Web attack/malicious scanning detected	Web App Attack
🇳🇱 doarg	2026-05-04 14:17:35 UTC · (6 months ago)	[Mon May 04 16:17:31.325832 2026] [authz_core:error] [pid 464311] [client 159.223.89.20:61972] AH01630: client denied by server configuration: /var/www/doarg.com/.sftp-config.json [Mon May 04 16:17:32.212004 2026] [authz_core:error] [pid 464312] [cli ... show more [Mon May 04 16:17:31.325832 2026] [authz_core:error] [pid 464311] [client 159.223.89.20:61972] AH01630: client denied by server configuration: /var/www/doarg.com/.sftp-config.json [Mon May 04 16:17:32.212004 2026] [authz_core:error] [pid 464312] [client 159.223.89.20:58102] AH01630: client denied by server configuration: /var/www/doarg.com/ftp-sync.json [Mon May 04 16:17:33.122512 2026] [authz_core:error] [pid 463233] [client 159.223.89.20:64130] AH01630: client denied by server configuration: /var/www/doarg.com/.ftp-sync.json [Mon May 04 16:17:34.029119 2026] [authz_core:error] [pid 463235] [client 159.223.89.20:55637] AH01630: client denied by server configuration: /var/www/doarg.com/ftp-config.json [Mon May 04 16:17:34.941516 2026] [authz_core:error] [pid 463236] [client 159.223.89.20:55916] AH01630: client denied by server configuration: /var/www/doarg.com/.ftp-config.json ... show less	Brute-Force
🇺🇸 TPI-Abuse	2026-05-04 13:55:17 UTC · (6 months ago)	(mod_security) mod_security (id:210492) triggered by 159.223.89.20 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon May 04 09:55:14.342535 2026] [security2:error] [pid 3676:tid 3676] [client 159.223.89.20:51160] Mod ... show more (mod_security) mod_security (id:210492) triggered by 159.223.89.20 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon May 04 09:55:14.342535 2026] [security2:error] [pid 3676:tid 3676] [client 159.223.89.20:51160] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "doctorspainmanagement.com"] [uri "/sftp-config.json"] [unique_id "afilQrzSGfs38kzbJR3JDQAAABo"] show less	Brute-Force Bad Web Bot Web App Attack
🇬🇧 thetomtaylor.co.uk	2026-05-04 12:08:01 UTC · (6 months ago)	Fail2Ban - [WEB]Custom exploit pattern detected on customexploits ... [ice02,wa01,wa02]	Hacking Brute-Force Bad Web Bot Web App Attack
🇫🇷 masterguru	2026-05-04 11:32:53 UTC · (6 months ago)	Restricted File Access Attempt. Matched phrase "config.json" at REQUEST_FILENAME. (930130-196)	Hacking Web App Attack
🇩🇪 todix	2026-05-04 07:21:42 UTC · (6 months ago)	WebAttack or semilar from 159.223.89.20	Web App Attack
🇺🇸 TPI-Abuse	2026-05-04 07:20:03 UTC · (6 months ago)	(mod_security) mod_security (id:210492) triggered by 159.223.89.20 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon May 04 03:19:57.500116 2026] [security2:error] [pid 20124:tid 20124] [client 159.223.89.20:65424] M ... show more (mod_security) mod_security (id:210492) triggered by 159.223.89.20 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon May 04 03:19:57.500116 2026] [security2:error] [pid 20124:tid 20124] [client 159.223.89.20:65424] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "drwolberg.com"] [uri "/sftp-config.json"] [unique_id "afhIna1AbiG84AYG4TRVtgAAAAM"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-05-04 06:21:19 UTC · (6 months ago)	(mod_security) mod_security (id:210492) triggered by 159.223.89.20 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon May 04 02:21:12.875437 2026] [security2:error] [pid 16919:tid 16919] [client 159.223.89.20:65086] M ... show more (mod_security) mod_security (id:210492) triggered by 159.223.89.20 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon May 04 02:21:12.875437 2026] [security2:error] [pid 16919:tid 16919] [client 159.223.89.20:65086] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "dougrhodes.com"] [uri "/sftp-config.json"] [unique_id "afg62L8tl3xCVWwfmjPp-QAAABc"] show less	Brute-Force Bad Web Bot Web App Attack

Showing 1 to 15 of 52 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown

Recently Reported IPs:

🇨🇳 118.196.23.247

🇨🇳 118.196.23.199

🇨🇳 118.145.237.236

🇨🇦 85.217.149.72

🇨🇦 85.217.149.46

🇰🇷 59.28.72.111

🇳🇱 31.56.53.195

🇸🇪 217.210.70.99

🇨🇱 179.60.68.170

🇷🇺 176.100.243.133

🇺🇸 167.71.21.171

🇯🇵 118.194.229.94

🇯🇵 118.193.61.170

🇧🇬 78.128.112.74

🇺🇸 66.132.195.192

🇪🇹 196.188.185.126

🇨🇴 181.52.113.102

🇺🇸 172.185.24.228

🇮🇳 163.53.201.45

🇺🇸 136.118.75.246