JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

159.89.54.136

Activity Trending Down

Abuse Confidence Score

16% Caution

11 reports

10 reporters · latest 2 weeks ago

ISP: DigitalOcean, LLC
Usage Type: Data Center/Web Hosting/Transit
ASN: AS14061
Domain Name: digitalocean.com
Country: 🇺🇸 United States of America
City: North Bergen, New Jersey

ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report Whois

Example preview

Account required for the enhanced features Log in Sign up

Abuse Reports

Export reports CSV

Total reports

11 from 10 distinct reporters

First reported

October 15th 2023

Most recent report

2 weeks ago

Last 60 days

Top reporter locations 🇫🇷 France 1 🇯🇵 Japan 1 🇺🇸 United States of America 1

Most common categories Port Scan 3

Old reports The most recent abuse report for this IP address is from 2 weeks ago. It is possible that this IP is no longer involved in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
Anonymous	2026-10-26 06:32:08 UTC · (2 weeks ago)	Port scan / connection attempts on port 465/TCP to unused IP	Port Scan
🇫🇷 Kejult	2026-10-26 06:00:35 UTC · (2 weeks ago)	Honeypot Finding: repeated TCP service probing on TCP/7777 (service); 2 application-level events across 2 source port(s). Sensor(s): Honeytrap.	Port Scan
🇺🇸 LockBlock	2026-10-06 14:39:44 UTC · (1 month ago)	2026-10-06 14:39:43: Port scan detected from 159.89.54.136 on port 12345 of racknerd-e7e1a9	Port Scan
Anonymous	2024-11-22 11:05:28 UTC · (1 year ago)		Web App Attack
🇫🇷 COMAITE	2024-09-16 22:19:14 UTC · (2 years ago)	Multiple web server 400 error codes from same source ip 159.89.54.136.	Web App Attack
🇺🇸 ChamberofCommerce.com	2024-09-12 13:57:35 UTC · (2 years ago)	Unauthorized Scraping Attempt - More then 225 Pages Requested in a 24 hour period - Total Requested Before Block:226	Bad Web Bot
🇷🇺 sms.ru	2024-09-09 20:04:19 UTC · (2 years ago)	/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php	Web App Attack
🇺🇸 TPI-Abuse	2024-09-03 18:47:34 UTC · (2 years ago)	(mod_security) mod_security (id:210492) triggered by 159.89.54.136 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 03 14:47:26.488868 2024] [security2:error] [pid 14584:tid 14584] [client 159.89.54.136:49748] [ ... show more (mod_security) mod_security (id:210492) triggered by 159.89.54.136 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 03 14:47:26.488868 2024] [security2:error] [pid 14584:tid 14584] [client 159.89.54.136:49748] [client 159.89.54.136] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "192.64.150.244"] [uri "/.env"] [unique_id "ZtdZvnUD0AsomOx_7o8MPQAAAAA"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2024-09-03 18:32:10 UTC · (2 years ago)	(mod_security) mod_security (id:210492) triggered by 159.89.54.136 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 03 14:32:05.197033 2024] [security2:error] [pid 4113280:tid 4113286] [client 159.89.54.136:4876 ... show more (mod_security) mod_security (id:210492) triggered by 159.89.54.136 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 03 14:32:05.197033 2024] [security2:error] [pid 4113280:tid 4113286] [client 159.89.54.136:48764] [client 159.89.54.136] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "192.64.150.79"] [uri "/.env"] [unique_id "ZtdWJZylyz9rILppjuSrAAAAAMM"] show less	Brute-Force Bad Web Bot Web App Attack
🇵🇱 nfsec.pl	2024-09-02 22:44:40 UTC · (2 years ago)	159.89.54.136 - - [03/Sep/2024:00:44:38 +0200] "GET /.env HTTP/1.1" 404 427 "-" "Mozilla/5.0 (Linux; U; Android 4.4.2; en-US; HM NOTE 1W Build/KOT49H) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 UCBrowser/11.0.5.850 U3/0.8.0 Mobile Safari/534. ... show more 159.89.54.136 - - [03/Sep/2024:00:44:38 +0200] "GET /.env HTTP/1.1" 404 427 "-" "Mozilla/5.0 (Linux; U; Android 4.4.2; en-US; HM NOTE 1W Build/KOT49H) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 UCBrowser/11.0.5.850 U3/0.8.0 Mobile Safari/534.30" 159.89.54.136 - - [03/Sep/2024:00:44:38 +0200] "POST / HTTP/1.1" 403 430 "-" "Mozilla/5.0 (Linux; U; Android 4.4.2; en-US; HM NOTE 1W Build/KOT49H) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 UCBrowser/11.0.5.850 U3/0.8.0 Mobile Safari/534.30" 159.89.54.136 - - [03/Sep/2024:00:44:38 +0200] "GET /.env HTTP/1.1" 403 4061 "-" "Mozilla/5.0 (Linux; U; Android 4.4.2; en-US; HM NOTE 1W Build/KOT49H) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 UCBrowser/11.0.5.850 U3/0.8.0 Mobile Safari/534.30" 159.89.54.136 - - [03/Sep/2024:00:44:39 +0200] "POST / HTTP/1.1" 403 4061 "-" "Mozilla/5.0 (Linux; U; Android 4.4.2; en-US; HM NOTE 1W Build/KOT49H) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 UCBrowser/11.0.5.850 U3/0.8.0 Mobile Saf ... show less	Exploited Host Web App Attack
Anonymous	2023-10-15 12:52:33 UTC · (3 years ago)	Aggressive web scan	Web App Attack

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown

Recently Reported IPs:

🇻🇳 222.254.171.105

🇮🇳 209.38.120.179

🇧🇷 186.201.240.42

🇮🇩 103.191.165.229

🇵🇱 89.174.70.29

🇫🇷 45.134.79.110

🇦🇲 5.77.133.173

🇲🇾 202.165.26.170

🇺🇸 199.165.159.198

🇹🇷 102.135.106.115

🇫🇷 85.217.140.9

🇺🇸 73.40.112.253

🇳🇱 51.158.205.203

🇦🇷 190.105.160.5

🇵🇱 162.158.172.3

🇩🇪 151.243.11.146

🇧🇷 138.59.84.254

🇸🇬 47.82.11.123

🇵🇱 45.138.12.16

🇦🇺 34.40.145.110