JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 159.89.18.16

159.89.18.16 was found in our database!

This IP was reported 15 times. Confidence of Abuse is 85%: ?

85%

ISP	DigitalOcean, LLC
Usage Type	Data Center/Web Hosting/Transit
ASN	AS14061
Domain Name	digitalocean.com
Country	🇩🇪 Germany
City	Frankfurt am Main, Hesse

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 159.89.18.16

Whois 159.89.18.16

IP Abuse Reports for 159.89.18.16:

This IP address has been reported a total of 15 times from 15 distinct sources. 159.89.18.16 was first reported on March 20th 2025, and the most recent report was 9 minutes ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇭🇺 bcsaba	2026-09-16 07:25:49 (9 minutes ago)	Probing for /backup 159.89.18.16 - - [16/Sep/2026:09:25:46 +0200] "HEAD /backup/ HTTP/2.0" 404 0 "ht ... show more Probing for /backup 159.89.18.16 - - [16/Sep/2026:09:25:46 +0200] "HEAD /backup/ HTTP/2.0" 404 0 "https://REDACTED/backup/" "Mozilla/5.0 (iPad; CPU OS 17_4 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.4 Mobile/15E148 Safari/604.1" show less	Web App Attack
🇺🇸 cwytech	2026-09-16 06:58:37 (36 minutes ago)	Fleet-wide ban from the Ghostfleet 👻. Triggered by scenario: cwy/wordpress-geofence-sus.	Bad Web Bot Web App Attack
🇳🇱 e.fierstra	2026-09-16 06:50:57 (44 minutes ago)	excessive HTTP 404 errors	Bad Web Bot
🇫🇷 Zundapper	2026-09-16 05:58:56 (1 hour ago)	159.89.18.16 - - [16/Sep/2026:07:58:55 +0200] "HEAD /new/ HTTP/2.0" 404 0 "http://cosedagatto.it/new ... show more 159.89.18.16 - - [16/Sep/2026:07:58:55 +0200] "HEAD /new/ HTTP/2.0" 404 0 "http://cosedagatto.it/new/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 15_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.6422.141 Safari/537.36" 159.89.18.16 - - [16/Sep/2026:07:58:55 +0200] "HEAD /backup/ HTTP/2.0" 404 0 "http://cosedagatto.it/backup/" "Mozilla/5.0 (Linux; U; Android 10; en-US; CPH2015) AppleWebKit/537.36 (KHTML, like Gecko) UCBrowser/13.5.8.1311 Mobile Safari/537.36" 159.89.18.16 - - [16/Sep/2026:07:58:55 +0200] "HEAD /wp/ HTTP/2.0" 404 0 "http://cosedagatto.it/wp/" "Mozilla/5.0 (Linux; Android 11; moto g31) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.96 Mobile Safari/537.36" 159.89.18.16 - - [16/Sep/2026:07:58:55 +0200] "HEAD /old/ HTTP/2.0" 404 0 "http://cosedagatto.it/old/" "Mozilla/5.0 (Linux; U; Android 10; en-US; CPH2015) AppleWebKit/537.36 (KHTML, like Gecko) UCBrowser/13.5.8.1311 Mobile Safari/537.36" 159.89.18.16 - - [16/Sep/2026:07:58:55 +0200] "HEAD /wordpress/ HTT ... show less	Web App Attack Port Scan
Anonymous	2026-09-16 05:44:24 (1 hour ago)	LH-Watcher: BRUTE_FORCE	Bad Web Bot
🇩🇪 LRob	2026-09-16 05:29:03 (2 hours ago)	Walking a list of paths that do not exist (scanning) \| method: HEAD \| path: /new/ (+5 more) \| 2026-0 ... show more Walking a list of paths that do not exist (scanning) \| method: HEAD \| path: /new/ (+5 more) \| 2026-09-16 05:29 UTC show less	Port Scan Web App Attack
🇩🇪 FeG Deutschland	2026-09-16 05:27:25 (2 hours ago)	Looking for CMS/PHP/SQL vulnerablilities/excessive crawling - 1247	Exploited Host Web App Attack
🇺🇸 mnsf	2026-09-16 05:05:22 (2 hours ago)	Too many Status 40X (18)	Brute-Force Web App Attack
🇨🇿 ddw	2026-09-16 04:57:50 (2 hours ago)	Access Violation Attempts - Multiple 403 Forbidden responses.	Hacking Bad Web Bot Web App Attack
🇩🇪 Trueforce Threat Report	2026-09-16 04:49:05 (2 hours ago)	Automated report, trolling for resource vulnerabilities	Bad Web Bot Web App Attack
Anonymous	2026-09-16 04:47:04 (2 hours ago)	Unauthorized access (80/tcp/http)	Port Scan Web App Attack
🇺🇸 TPI-Abuse	2026-09-16 02:54:34 (4 hours ago)	(mod_security) mod_security (id:210730) triggered by 159.89.18.16 (-): 1 in the last 300 secs; Ports ... show more (mod_security) mod_security (id:210730) triggered by 159.89.18.16 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 15 22:54:30.860015 2026] [security2:error] [pid 6316:tid 6316] [client 159.89.18.16:43300] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy\|\|www.azcrittergetter.com\|F\|2"] [data ".com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.azcrittergetter.com"] [uri "/csfitz.com"] [unique_id "aqoE5uVgByYGj3Gz-nIw4QAAAAY"], referer: http://csfitz.com/ show less	Brute-Force Bad Web Bot Web App Attack
🇩🇪 ghostwarriors	2026-09-16 02:50:20 (4 hours ago)	Webpage scraping	Brute-Force Bad Web Bot Web App Attack
🇫🇷 ✨	2026-09-16 02:25:12 (5 hours ago)	Domain : d-cc.co.uk Rule : Method-Head 2026-09-16 02:24:19 W3SVC29 PLESK76 217.194.212.111 HEAD / - ... show more Domain : d-cc.co.uk Rule : Method-Head 2026-09-16 02:24:19 W3SVC29 PLESK76 217.194.212.111 HEAD / - 443 - 159.89.18.16 HTTP/2.0 Mozilla/5.0 (Macintosh; Intel Mac OS X 15_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.6422.141 Safari/537.36 - http://d-cc.co.uk/ d-cc.co.uk 200 0 0 555 231 35 - - show less	Port Scan
🇺🇸 MPL	2025-03-20 05:17:59 (1 year ago)	tcp/8090 (2 or more attempts)	Port Scan

Showing 1 to 15 of 15 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇧🇬 109.160.32.82

🇺🇿 84.54.71.204

🇺🇸 54.183.240.122

🇺🇸 52.90.113.213

🇰🇷 221.159.239.160

🇺🇿 213.230.92.74

🇧🇩 182.161.67.58

🇺🇸 159.223.192.26

🇺🇸 66.132.195.22

🇺🇸 34.69.233.217

🇦🇷 200.225.118.195

🇦🇷 200.127.235.27

🇺🇸 195.184.76.13

🇩🇪 194.88.98.125

🇲🇾 183.171.236.23

🇦🇪 176.204.4.142

🇭🇰 152.32.135.214

🇳🇬 105.116.7.250

🇺🇸 71.6.233.252

🇳🇱 45.148.10.141