JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 159.89.3.52

159.89.3.52 was found in our database!

This IP was reported 18 times. Confidence of Abuse is 20%: ?

20%

ISP	DigitalOcean, LLC
Usage Type	Data Center/Web Hosting/Transit
ASN	AS14061
Hostname(s)	110335.forestengine.net
Domain Name	digitalocean.com
Country	🇩🇪 Germany
City	Frankfurt am Main, Hesse

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 159.89.3.52

Whois 159.89.3.52

IP Abuse Reports for 159.89.3.52:

This IP address has been reported a total of 18 times from 13 distinct sources. 159.89.3.52 was first reported on January 26th 2026, and the most recent report was 15 hours ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇧🇪 taivas.nl	2026-10-26 12:36:29 (15 hours ago)	Site scraper	Web App Attack
🇳🇱 e.fierstra	2026-10-26 12:18:36 (15 hours ago)	excessive HTTP 404 errors	Bad Web Bot
🇺🇸 TPI-Abuse	2026-09-23 19:42:18 (1 month ago)	(mod_security) mod_security (id:210492) triggered by 159.89.3.52 (-): 1 in the last 300 secs; Ports: ... show more (mod_security) mod_security (id:210492) triggered by 159.89.3.52 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Sep 23 15:42:14.859563 2026] [security2:error] [pid 10598:tid 10598] [client 159.89.3.52:40444] ModSecurity: Access denied with code 403 (phase 1). Matched phrase ".htaccess" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "needtoorder.us"] [uri "/USE-To-BLOCKwww.countryipblocks.net.htaccess"] [unique_id "arQrlvTsQ22W74mt7LtSbAAAAAk"] show less	Brute-Force Bad Web Bot Web App Attack
🇳🇱 homeshowdomain.nl	2026-04-20 22:01:50 (6 months ago)	Auto-ban: >3000 req/min op 2026-04-20	Web App Attack SSH Hacking
🇺🇸 Jason Howell	2026-04-20 21:22:40 (6 months ago)	159.89.3.52 - - [20/Apr/2026:15:48:52 -0500] "POST /wp-login.php HTTP/1.1" 200 8268 "-" "Mozilla/5.0 ... show more 159.89.3.52 - - [20/Apr/2026:15:48:52 -0500] "POST /wp-login.php HTTP/1.1" 200 8268 "-" "Mozilla/5.0" 159.89.3.52 - - [20/Apr/2026:15:48:52 -0500] "POST /wp-login.php HTTP/1.1" 200 7425 "-" "Mozilla/5.0" 159.89.3.52 - - [20/Apr/2026:16:05:45 -0500] "POST /wp-login.php HTTP/1.1" 200 7424 "-" "Mozilla/5.0" 159.89.3.52 - - [20/Apr/2026:16:05:45 -0500] "POST /wp-login.php HTTP/1.1" 200 8267 "-" "Mozilla/5.0" 159.89.3.52 - - [20/Apr/2026:16:22:39 -0500] "POST /wp-login.php HTTP/1.1" 200 7425 "-" "Mozilla/5.0" ... show less	Web App Attack
🇧🇪 cmbplf	2026-04-20 20:33:34 (6 months ago)	3.004 POST requests with url.path */wp-login.php	Brute-Force Bad Web Bot
🇺🇸 Jason Howell	2026-04-20 19:43:16 (6 months ago)	159.89.3.52 - - [20/Apr/2026:14:11:26 -0500] "POST /wp-login.php HTTP/1.1" 200 7425 "-" "Mozilla/5.0 ... show more 159.89.3.52 - - [20/Apr/2026:14:11:26 -0500] "POST /wp-login.php HTTP/1.1" 200 7425 "-" "Mozilla/5.0" 159.89.3.52 - - [20/Apr/2026:14:27:22 -0500] "POST /wp-login.php HTTP/1.1" 200 7424 "-" "Mozilla/5.0" 159.89.3.52 - - [20/Apr/2026:14:27:22 -0500] "POST /wp-login.php HTTP/1.1" 200 8266 "-" "Mozilla/5.0" 159.89.3.52 - - [20/Apr/2026:14:43:14 -0500] "POST /wp-login.php HTTP/1.1" 200 7425 "-" "Mozilla/5.0" 159.89.3.52 - - [20/Apr/2026:14:43:14 -0500] "POST /wp-login.php HTTP/1.1" 200 8266 "-" "Mozilla/5.0" ... show less	Web App Attack
🇺🇸 Jason Howell	2026-04-20 18:08:42 (6 months ago)	159.89.3.52 - - [20/Apr/2026:12:38:10 -0500] "POST /wp-login.php HTTP/1.1" 200 7424 "-" "Mozilla/5.0 ... show more 159.89.3.52 - - [20/Apr/2026:12:38:10 -0500] "POST /wp-login.php HTTP/1.1" 200 7424 "-" "Mozilla/5.0" 159.89.3.52 - - [20/Apr/2026:12:38:10 -0500] "POST /wp-login.php HTTP/1.1" 200 8267 "-" "Mozilla/5.0" 159.89.3.52 - - [20/Apr/2026:12:53:21 -0500] "POST /wp-login.php HTTP/1.1" 200 8266 "-" "Mozilla/5.0" 159.89.3.52 - - [20/Apr/2026:12:53:21 -0500] "POST /wp-login.php HTTP/1.1" 200 7426 "-" "Mozilla/5.0" 159.89.3.52 - - [20/Apr/2026:13:08:41 -0500] "POST /wp-login.php HTTP/1.1" 200 8267 "-" "Mozilla/5.0" ... show less	Web App Attack
🇺🇸 Jason Howell	2026-04-20 16:24:07 (6 months ago)	159.89.3.52 - - [20/Apr/2026:10:55:17 -0500] "POST /wp-login.php HTTP/1.1" 200 8266 "-" "Mozilla/5.0 ... show more 159.89.3.52 - - [20/Apr/2026:10:55:17 -0500] "POST /wp-login.php HTTP/1.1" 200 8266 "-" "Mozilla/5.0" 159.89.3.52 - - [20/Apr/2026:10:55:17 -0500] "POST /wp-login.php HTTP/1.1" 200 7425 "-" "Mozilla/5.0" 159.89.3.52 - - [20/Apr/2026:11:09:36 -0500] "POST /wp-login.php HTTP/1.1" 200 7426 "-" "Mozilla/5.0" 159.89.3.52 - - [20/Apr/2026:11:09:36 -0500] "POST /wp-login.php HTTP/1.1" 200 8268 "-" "Mozilla/5.0" 159.89.3.52 - - [20/Apr/2026:11:24:06 -0500] "POST /wp-login.php HTTP/1.1" 200 7426 "-" "Mozilla/5.0" ... show less	Web App Attack
🇺🇸 Jason Howell	2026-04-20 14:44:26 (6 months ago)	159.89.3.52 - - [20/Apr/2026:09:16:46 -0500] "POST /wp-login.php HTTP/1.1" 200 7426 "-" "Mozilla/5.0 ... show more 159.89.3.52 - - [20/Apr/2026:09:16:46 -0500] "POST /wp-login.php HTTP/1.1" 200 7426 "-" "Mozilla/5.0" 159.89.3.52 - - [20/Apr/2026:09:30:34 -0500] "POST /wp-login.php HTTP/1.1" 200 7424 "-" "Mozilla/5.0" 159.89.3.52 - - [20/Apr/2026:09:30:34 -0500] "POST /wp-login.php HTTP/1.1" 200 8268 "-" "Mozilla/5.0" 159.89.3.52 - - [20/Apr/2026:09:44:25 -0500] "POST /wp-login.php HTTP/1.1" 200 8267 "-" "Mozilla/5.0" 159.89.3.52 - - [20/Apr/2026:09:44:25 -0500] "POST /wp-login.php HTTP/1.1" 200 7425 "-" "Mozilla/5.0" ... show less	Web App Attack
🇫🇷 masterguru	2026-04-20 13:47:56 (6 months ago)	wp-login request blocked, no referer. Pattern match "wp-login.php" at REQUEST_URI. (88020-193)	Hacking
🇦🇺 screwlooseit.com.au	2026-04-20 13:14:12 (6 months ago)	Blocked by CSF 13 firewall - Rule: WPLOGIN DE/Germany/-	Web App Attack
🇺🇸 Jason Howell	2026-04-20 13:12:41 (6 months ago)	159.89.3.52 - - [20/Apr/2026:07:57:57 -0500] "POST /wp-login.php HTTP/1.1" 200 8266 "-" "Mozilla/5.0 ... show more 159.89.3.52 - - [20/Apr/2026:07:57:57 -0500] "POST /wp-login.php HTTP/1.1" 200 8266 "-" "Mozilla/5.0" 159.89.3.52 - - [20/Apr/2026:07:57:57 -0500] "POST /wp-login.php HTTP/1.1" 200 7425 "-" "Mozilla/5.0" 159.89.3.52 - - [20/Apr/2026:08:05:30 -0500] "POST /wp-login.php HTTP/1.1" 200 7424 "-" "Mozilla/5.0" 159.89.3.52 - - [20/Apr/2026:08:05:30 -0500] "POST /wp-login.php HTTP/1.1" 200 8268 "-" "Mozilla/5.0" 159.89.3.52 - - [20/Apr/2026:08:12:40 -0500] "POST /wp-login.php HTTP/1.1" 200 8268 "-" "Mozilla/5.0" ... show less	Web App Attack
🇮🇹 VHosting	2026-04-20 13:10:03 (6 months ago)	Detected WordPress attack from 4 different servers	Brute-Force Web App Attack
🇳🇱 EGP Abuse Dept	2026-04-20 04:03:10 (6 months ago)	Scanning for web/db/file exploits on topschuifwanden.nl	SQL Injection Bad Web Bot Web App Attack

Showing 1 to 15 of 18 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇮🇳 223.184.192.239

🇨🇳 223.76.225.18

🇺🇸 195.81.138.17

🇦🇷 181.171.144.242

🇯🇵 172.104.94.121

🇺🇸 136.56.34.147

🇩🇪 104.207.58.232

🇫🇷 104.28.196.58

🇨🇳 36.25.251.109

🇩🇪 18.199.138.76

🇧🇷 189.126.28.70

🇦🇷 181.116.177.223

🇧🇷 177.106.56.143

🇺🇸 174.138.177.62

🇩🇪 151.240.174.128

🇫🇮 147.185.133.28

🇺🇸 91.230.168.99

🇫🇷 91.196.152.71

🇺🇸 13.216.63.244

🇩🇪 5.28.107.237