JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 159.89.49.169

159.89.49.169 was found in our database!

This IP was reported 23 times. Confidence of Abuse is 87%: ?

87%

ISP	DigitalOcean, LLC
Usage Type	Data Center/Web Hosting/Transit
ASN	AS14061
Domain Name	digitalocean.com
Country	🇺🇸 United States of America
City	North Bergen, New Jersey

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 159.89.49.169

Whois 159.89.49.169

IP Abuse Reports for 159.89.49.169:

This IP address has been reported a total of 23 times from 16 distinct sources. 159.89.49.169 was first reported on November 19th 2025, and the most recent report was 9 hours ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇧🇷 Peregrine	2026-06-20 03:11:25 (9 hours ago)	Fail2Ban Jail s2: tomcat-honeypot \| Evidence: - 159.89.49.169 - - [17/Jun/2026:00:52:13 -0300] "GET ... show more Fail2Ban Jail s2: tomcat-honeypot \| Evidence: - 159.89.49.169 - - [17/Jun/2026:00:52:13 -0300] "GET /dump.sql HTTP/1.1" 404 414 show less	Bad Web Bot
🇧🇷 Peregrine	2026-06-19 03:09:18 (1 day ago)	Fail2Ban Jail s2: tomcat-honeypot \| Evidence: - 159.89.49.169 - - [17/Jun/2026:00:52:13 -0300] "GET ... show more Fail2Ban Jail s2: tomcat-honeypot \| Evidence: - 159.89.49.169 - - [17/Jun/2026:00:52:13 -0300] "GET /dump.sql HTTP/1.1" 404 414 show less	Bad Web Bot
Anonymous	2026-06-17 18:05:09 (2 days ago)	IP & Port Scan.	SSH Port Scan Brute-Force
🇨🇿 Countryman	2026-06-17 16:14:57 (2 days ago)	repeated unauthorized connection attempts, host sweep, port scan	Port Scan
🇨🇿 Countryman	2026-06-17 16:14:57 (2 days ago)	repeated unauthorized connection attempts, host sweep, port scan	Port Scan
🇹🇷 SeczarSecureOps	2026-06-17 15:14:40 (2 days ago)	Auto-blocked by Seczar SecureOps — Port Scan Detection (8 events in 10min) at 2026-06-17 15:14	Port Scan
🇫🇷 vincent_EUDIER	2026-06-17 14:00:01 (2 days ago)	SURICATA HTTP unable to match response to request	Hacking
🇺🇸 xmission.com	2026-06-17 12:27:57 (2 days ago)	Blocked by UFW (TCP on 2078) Source port: 48582 TTL: 50 Packet length: 60 TOS: 0x08 This report (fo ... show more Blocked by UFW (TCP on 2078) Source port: 48582 TTL: 50 Packet length: 60 TOS: 0x08 This report (for 159.89.49.169) was generated by: https://github.com/sefinek/UFW-AbuseIPDB-Reporter show less	Port Scan
🇧🇷 somosbr	2026-06-17 12:22:21 (2 days ago)	[2026-06-17T12:22:21Z] Unsolicited scan from 159.89.49.169 to port 2096/tcp	Port Scan
🇺🇸 TPI-Abuse	2026-06-17 12:14:53 (3 days ago)	(mod_security) mod_security (id:210492) triggered by 159.89.49.169 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:210492) triggered by 159.89.49.169 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jun 17 08:14:45.925732 2026] [security2:error] [pid 4934:tid 4934] [client 159.89.49.169:45782] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "192.64.150.16"] [uri "/.env"] [unique_id "ajKPteLwFDwc1D3EHY8YWAAAAAQ"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-06-17 11:21:11 (3 days ago)	(mod_security) mod_security (id:210492) triggered by 159.89.49.169 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:210492) triggered by 159.89.49.169 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jun 17 07:21:06.741018 2026] [security2:error] [pid 23833:tid 23833] [client 159.89.49.169:57514] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "192.64.150.87"] [uri "/.git/HEAD"] [unique_id "ajKDIll1JzKQ0hsAPMD8xQAAAAc"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 xmission.com	2026-06-17 08:36:34 (3 days ago)	Blocked by UFW (TCP on 2078) Source port: 59412 TTL: 50 Packet length: 60 TOS: 0x08 This report (fo ... show more Blocked by UFW (TCP on 2078) Source port: 59412 TTL: 50 Packet length: 60 TOS: 0x08 This report (for 159.89.49.169) was generated by: https://github.com/sefinek/UFW-AbuseIPDB-Reporter show less	Port Scan
Anonymous	2026-06-17 08:19:30 (3 days ago)	Honeypot hit: Empty payload (likely service probe); 2078 [1], 2095 [1], 2087 [1], 2077 [1], 2082 [1] ... show more Honeypot hit: Empty payload (likely service probe); 2078 [1], 2095 [1], 2087 [1], 2077 [1], 2082 [1], 2086 [1] TCP Reported by: https://github.com/sefinek/T-Pot-To-AbuseIPDB show less	Port Scan
🇮🇪 AutosOnShow	2026-06-17 07:38:06 (3 days ago)	blocked for webapp attack \| path requested: /.git/config \| seen at 2026-06-17 07:37:22.231 \|	Web App Attack
🇬🇧 thetomtaylor.co.uk	2026-06-17 06:07:03 (3 days ago)	Fail2Ban - [WEB]Custom exploit pattern detected on customexploits ... [ice02,wa01,wa02]	Hacking Brute-Force Bad Web Bot Web App Attack

Showing 1 to 15 of 23 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇺🇸 216.22.5.144

🇨🇿 77.237.158.44

🇹🇭 203.154.158.195

🇺🇸 95.173.221.189

🇱🇹 81.30.98.142

🇻🇳 36.50.134.129

🇬🇧 35.203.210.85

🇻🇪 200.71.154.142

🇨🇦 142.93.158.243

🇨🇳 140.246.137.102

🇨🇳 106.75.144.128

🇨🇳 101.200.91.165

🇷🇴 92.118.39.234

🇻🇳 203.205.37.233

🇲🇽 189.203.163.10

🇳🇱 176.65.139.56

🇵🇰 175.107.233.255

🇹🇼 172.69.221.71

🇹🇳 102.152.22.25

🇳🇱 91.92.40.204