JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 159.89.11.217

159.89.11.217 was found in our database!

This IP was reported 97 times. Confidence of Abuse is 88%: ?

88%

ISP	DigitalOcean, LLC
Usage Type	Data Center/Web Hosting/Transit
ASN	AS14061
Domain Name	digitalocean.com
Country	🇩🇪 Germany
City	Frankfurt am Main, Hesse

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 159.89.11.217

Whois 159.89.11.217

IP Abuse Reports for 159.89.11.217:

This IP address has been reported a total of 97 times from 59 distinct sources. 159.89.11.217 was first reported on May 13th 2021, and the most recent report was 2 hours ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇺🇸 ShadowWhisperer	2026-08-24 20:40:03 (2 hours ago)	TELNET port scan / probe. dropped before login	Port Scan IoT Targeted
🇫🇷 GoodOldTOS	2026-08-24 18:36:31 (4 hours ago)	Connection to SSHTarpit	Hacking SSH
🇫🇷 Selckie	2026-08-24 16:03:22 (7 hours ago)	fail2ban: NGINX unusual impact	Web App Attack
🇦🇺 LiftUp Hosting	2026-08-24 13:34:00 (9 hours ago)	Honeypot hit: Unauthorized traffic (4 bytes of payload); 8000 [16] TCP	Port Scan
🇯🇵 ttttomomi	2026-08-24 11:38:57 (11 hours ago)	Unsolicited connection probing of our IMAPS/POP3S service: repeated TLS handshakes that fail immedia ... show more Unsolicited connection probing of our IMAPS/POP3S service: repeated TLS handshakes that fail immediately (non-TLS or wrong TLS version) with no authentication attempted. Reported as an observation; the intent (research or reconnaissance) is not determined. 13 connection attempts to POP3S with no authentication; the TLS handshake failed immediately (non-TLS or wrong TLS version). All within 12 seconds. show less	Port Scan
🇨🇦 Not Fake	2026-08-24 09:24:14 (13 hours ago)	$f2bV_matches	Web App Attack
Anonymous	2026-08-24 01:15:18 (21 hours ago)	159.89.11.217 - - [24/Aug/2026:03:15:17 +0200] "OPTIONS / RTSP/1.0" 400 150 "-" "-" 159.89.11.217 - ... show more 159.89.11.217 - - [24/Aug/2026:03:15:17 +0200] "OPTIONS / RTSP/1.0" 400 150 "-" "-" 159.89.11.217 - - [24/Aug/2026:03:15:17 +0200] "\x16\x03\x01\x02\x00\x01\x00\x01\xFC\x03\x03o\xAB\xE0\xB7\xDER\xEFd\xE3R \xCB\xBFsR\xF9\xF7\x0C\x02\xA3\xA5\xAD\xE0\x97\xD1\xFD\xA7+z\xB9\xD2\x0F \xCD\xF7\xEEf\xDD\x9F\|y\x19Eq\x9A\xB3\x5C4ode" 400 150 "-" "-" 159.89.11.217 - - [24/Aug/2026:03:15:17 +0200] "\x16\x03\x01\x02\x00\x01\x00\x01\xFC\x03\x03\x12U&fb5GiU_\xB4\x13V`U5J#\xBA\x9C:\|\xACeP\x0B\xFE\xC8\xC1Y\xE8\x0E U\x0E%k\xE8G\x17" 400 150 "-" "-" 159.89.11.217 - - [24/Aug/2026:03:15:17 +0200] "\x16\x03\x01\x02\x00\x01\x00\x01\xFC\x03\x03<\x06\x1C\xCC\x8B`+o\x8E+\x91f\xC1\x00\xD1\x17cw\xA7V\x168a+0\xDA\xBEr\x9EY)x \x17]\xA0\x8C{\xD3\xB2Xo\xE7]\xF2\xB7\x1A\xAF\xBF" 400 150 "-" "-" 159.89.11.217 - - [24/Aug/2026:03:15:17 +0200] "\x16\x03\x01\x02\x00\x01\x00\x01\xFC\x03\x034s(2\xDAC\xA0*$\x82qL\xD5&\x22\xB1w\xDC\xB0L\xC0\xCFa\x85\xF71\x07\xC3\x80\x22!\x9A \x83\x22\x1D[\xF5P\x8B\xDE\xD1!\xC7B\xF1U\xB9\xAD\x ... show less	Web App Attack
Anonymous	2026-08-23 19:10:49 (1 day ago)	SSH tarpit (endlessh) connection from 159.89.11.217	Brute-Force SSH
🇮🇹 CoreTech srl	2026-08-23 18:45:49 (1 day ago)	[DC: IP:151.1.252.27] ntopng alert: blacklisted_client_contact,ndpi_tcp_issues,ndpi_probing_attempt	Hacking
🇹🇷 Threat.live	2026-08-23 16:55:02 (1 day ago)	Threat.live: Web Scan	Web App Attack
🇺🇸 azminawwar	2026-08-23 05:23:32 (1 day ago)	[159.89.11.217] triggered by honeypot on port [80], Timestamp [2026-08-23T05:23:32Z]METHOD=GET PATH= ... show more [159.89.11.217] triggered by honeypot on port [80], Timestamp [2026-08-23T05:23:32Z]METHOD=GET PATH=/ HTTP=HTTP/1.0 UA="-" HOST="-" REF="-" show less	Port Scan Hacking
🇿🇦 voolik.com	2026-08-23 00:03:30 (1 day ago)	2026-08-23T02:03:13.694090+02:00 bla016-truserv-jhb1-001 sshd[657550]: refused connect from 159.89.1 ... show more 2026-08-23T02:03:13.694090+02:00 bla016-truserv-jhb1-001 sshd[657550]: refused connect from 159.89.11.217 (159.89.11.217) 2026-08-23T02:03:19.101869+02:00 bla016-truserv-jhb1-001 sshd[658049]: refused connect from 159.89.11.217 (159.89.11.217) 2026-08-23T02:03:24.239913+02:00 bla016-truserv-jhb1-001 sshd[658250]: refused connect from 159.89.11.217 (159.89.11.217) 2026-08-23T02:03:29.442187+02:00 bla016-truserv-jhb1-001 sshd[658526]: refused connect from 159.89.11.217 (159.89.11.217) ... show less	Brute-Force SSH
🇵🇱 Kitki30.com	2026-08-22 21:28:12 (2 days ago)	Entered SSH Tarpit (endlessh). Log: 2026-08-22T21:28:11.627Z ACCEPT host=::ffff:159.89.11.217 port=2 ... show more Entered SSH Tarpit (endlessh). Log: 2026-08-22T21:28:11.627Z ACCEPT host=::ffff:159.89.11.217 port=25633 fd=7 n=4/4096 show less	Brute-Force SSH Port Scan
🇦🇪 abusiveIntelligence	2026-08-22 18:10:00 (2 days ago)	RDP connect attempt: Nmap Scanner	Brute-Force
🇫🇷 Thaliruth	2026-08-22 14:53:06 (2 days ago)	Aug 22 16:53:06 151 postfix/smtpd[1104179]: lost connection after CONNECT from unknown[159.89.11.217 ... show more Aug 22 16:53:06 151 postfix/smtpd[1104179]: lost connection after CONNECT from unknown[159.89.11.217] ... show less	Hacking Brute-Force

Showing 1 to 15 of 97 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇺🇸 2400:cb00:988:1000:ed02:ac35:e748:be86

🇱🇹 62.60.130.201

🇮🇳 49.43.216.137

🇺🇸 205.210.31.72

🇺🇸 192.3.251.33

🇧🇷 179.99.43.198

🇨🇳 120.48.90.166

🇭🇰 103.229.125.91

🇿🇦 102.129.63.92

🇨🇦 85.217.149.66

🇵🇸 82.102.239.220

🇮🇪 82.25.215.124

🇳🇱 77.91.71.10

🇺🇸 68.51.134.27

🇨🇱 45.4.3.118

🇧🇷 20.226.91.14

🇰🇷 14.46.99.87

🇮🇳 2404:6800:4000:101d::129

🇻🇪 200.59.186.139

🇭🇰 199.45.154.76