JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

159.89.236.70

Neutral Activity

Abuse confidence score ?

0% Low Risk

184 reports

102 reporters · latest 10 months ago

ISP	DigitalOcean, LLC
Usage Type	Data Center/Web Hosting/Transit
ASN	AS14061
Domain Name	digitalocean.com
Country	🇺🇸 United States of America
City	North Bergen, New Jersey

ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report Whois

No reports in the last 60 days

159.89.236.70 has been reported 184 times. The most recent report is from 10 months ago.

The full history is preserved below and remains searchable. A 0% score reflects the absence of recent activity, but this is not a guarantee that earlier reports were invalid. Abuse confidence score decays, naturally, over time, when the abusive activity stops.

IP Abuse Reports for 159.89.236.70

Export CSV

This IP address has been reported a total of 184 times from 102 distinct sources. 159.89.236.70 was first reported on January 28th 2022, and the most recent report was 10 months ago.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇺🇸 sumnone	2025-12-15 07:17:35 (10 months ago)	Port probing on unauthorized port 8082	Port Scan Hacking Exploited Host
🇫🇮 6kilowatti	2025-12-15 06:52:52 (10 months ago)	Blocked by UFW on mummo [8082/tcp] Source port: 61009 TTL: 240 Packet length: 44 TOS: 0x00 This rep ... show more Blocked by UFW on mummo [8082/tcp] Source port: 61009 TTL: 240 Packet length: 44 TOS: 0x00 This report was generated by: https://github.com/sefinek/UFW-AbuseIPDB-Reporter show less	Port Scan
🇩🇪 DAILYKANBAN.COM	2022-09-05 14:23:23 (4 years ago)	(mod_security) mod_security (id:949110) triggered by 159.89.236.70 (US/United States/-): 2 in the la ... show more (mod_security) mod_security (id:949110) triggered by 159.89.236.70 (US/United States/-): 2 in the last 600 secs (CF_ENABLE); Ports: *; Direction: inout; Trigger: LF_MODSEC; Logs: [Mon Sep 05 18:23:07.606794 2022] [:error] [pid 2655978:tid 22867573917440] [client 159.89.236.70:17528] [client 159.89.236.70] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "93"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.2"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "alfons.innerindustry.com"] [uri "/wp-22.php"] [unique_id "YxY-iys6jK6gIAgkV_0QcwAAARU"] [Mon Sep 05 18:23:17.786754 2022] [:error] [pid 2655978:tid 22867607537408] [client 159.89.236.70:47822] [client 159.89.236.70] ModSecurity: Access denied with code 403 (phase 2). Operator GE mat show less	Web App Attack
🇦🇺 advena	2022-09-05 11:45:14 (4 years ago)	159.89.236.70 (AS14061 DIGITALOCEAN-ASN) was intercepted at 2022-09-05T15:39:27Z after violating WAF ... show more 159.89.236.70 (AS14061 DIGITALOCEAN-ASN) was intercepted at 2022-09-05T15:39:27Z after violating WAF directive: 100026 (PHP, vBulletin, jQuery File Upload - Code Injection, Dangerous File Upload - CVE:CVE-2018-9206, CVE:CVE-2019-17132). Pre-cautionary/corrective action applied: block. show less	Web Spam Hacking Brute-Force Web App Attack
🇳🇱 mawan	2022-09-05 07:49:22 (4 years ago)	Suspected of having performed illicit activity on AMS server.	Web App Attack
🇩🇪 OiledAmoeba	2022-09-02 08:45:35 (4 years ago)	2022/09/02 14:31:41 [error] 26504#26504: 6156580 open() "/etc/nginx/html/wp-22.php" failed (2: No s ... show more 2022/09/02 14:31:41 [error] 26504#26504: 6156580 open() "/etc/nginx/html/wp-22.php" failed (2: No such file or directory), client: 159.89.236.70, server: fhem.ruhnke.cloud, request: "GET /wp-22.php?sfilename=on.php&sfilecontent=<%3F%3D409723%2A20%3B&supfiles=on.php HTTP/1.1", host: "fhem.ruhnke.cloud" 2022/09/02 14:45:33 [error] 26504#26504: *6158670 open() "/usr/local/www/nginx/wp-22.php" failed (2: No such file or directory), client: 159.89.236.70, server: mta-sts.ruhnke.cloud, request: "GET /wp-22.php?sfilename=on.php&sfilecontent=<%3F%3D409723%2A20%3B&supfiles=on.php HTTP/1.1", host: "mta-sts.ruhnke.cloud" ... show less	Brute-Force
🇨🇦 Anymous	2022-09-02 02:39:29 (4 years ago)	GET /wp-22.php?sfilename=on.php&sfilecontent=<%3F%3D409723%2A20%3B&supfiles=on.php HTTP/1.1 301 574 ... show more GET /wp-22.php?sfilename=on.php&sfilecontent=<%3F%3D409723%2A20%3B&supfiles=on.php HTTP/1.1 301 574 "-" "Mozilla/5.0 (Linux; Android 10; HRY-LX1) AppleWebKit/537.36 (KHTML show less	Port Scan Web App Attack
🇦🇺 advena	2022-09-01 01:15:11 (4 years ago)	159.89.236.70 (AS14061 DIGITALOCEAN-ASN) was intercepted at 2022-09-01T05:13:05Z after violating WAF ... show more 159.89.236.70 (AS14061 DIGITALOCEAN-ASN) was intercepted at 2022-09-01T05:13:05Z after violating WAF directive: 100026 (PHP, vBulletin, jQuery File Upload - Code Injection, Dangerous File Upload - CVE:CVE-2018-9206, CVE:CVE-2019-17132). Pre-cautionary/corrective action applied: block. show less	Web Spam Hacking Brute-Force Web App Attack
🇩🇪 kommunos	2022-08-31 22:44:36 (4 years ago)	/wp-22.php	Web App Attack
🇺🇸 CollideTech	2022-08-31 19:52:15 (4 years ago)	probing for vulnerabilities	Web App Attack
🇧🇬 pa4080	2022-08-30 20:02:10 (4 years ago)	Detected by ModSecurity. Request URI: /wp-22.php?sfilename=on.php&sfilecontent=<%3F%3D409723%2A20%3B ... show more Detected by ModSecurity. Request URI: /wp-22.php?sfilename=on.php&sfilecontent=<%3F%3D409723%2A20%3B&supfiles=on.php show less	Hacking Web App Attack
🇳🇱 mawan	2022-08-30 15:41:36 (4 years ago)	Suspected of having performed illicit activity on AMS server.	Web App Attack
🇺🇸 dtorrer	2022-08-30 10:00:04 (4 years ago)	This client attempted to login to an administrator account on a Website, or abused from another reso ... show more This client attempted to login to an administrator account on a Website, or abused from another resource. show less	Brute-Force Web App Attack
🇩🇪 DAILYKANBAN.COM	2022-08-29 02:57:16 (4 years ago)	(mod_security) mod_security (id:949110) triggered by 159.89.236.70 (US/United States/-): 2 in the la ... show more (mod_security) mod_security (id:949110) triggered by 159.89.236.70 (US/United States/-): 2 in the last 600 secs (CF_ENABLE); Ports: *; Direction: inout; Trigger: LF_MODSEC; Logs: [Mon Aug 29 06:57:11.840994 2022] [:error] [pid 1768478:tid 22865392264960] [client 159.89.236.70:0] [client 159.89.236.70] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "93"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.2"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "magicalmysteryplanttour.group"] [uri "/wp-22.php"] [unique_id "YwxjRx57XD2iPbe_Wvyb2AAAAAI"] [Mon Aug 29 06:57:14.385380 2022] [:error] [pid 1768442:tid 22865377556224] [client 159.89.236.70:0] [client 159.89.236.70] ModSecurity: Access denied with code 403 (phase 2). Operator GE matche show less	Web App Attack
🇩🇪 conseilgouz	2022-08-28 18:59:28 (4 years ago)	vee-12 : Block return, carriage return, ... characters=>/wp-22.php?sfilename=on.php&sfilecontent ... show more vee-12 : Block return, carriage return, ... characters=>/wp-22.php?sfilename=on.php&sfilecontent=<%3F%3D409723%2A20%3B&supfiles=on.php(<) show less	Hacking

Showing 1 to 15 of 184 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇱🇨 206.214.19.66

🇧🇷 205.210.31.199

🇪🇸 196.196.150.5

🇺🇸 195.58.58.216

🇳🇱 185.167.98.230

🇻🇳 152.32.160.252

🇺🇸 142.93.201.240

🇰🇷 121.184.144.232

🇩🇪 109.160.32.164

🇮🇳 103.24.63.85

🇮🇳 74.225.203.7

🇺🇸 73.152.142.243

🇨🇦 72.251.4.133

🇧🇪 34.14.99.143

🇷🇴 2.57.121.25

🇺🇸 216.73.217.16

🇨🇳 180.102.157.223

🇺🇸 173.239.214.248

🇺🇸 161.35.110.24

🇲🇦 160.178.215.158