This IP address has been reported a total of
54
times from
29 distinct
sources.
159.89.82.212 was first reported on
, and the most recent report was
.
In the last 60 days, the top reporter locations were:
United States of America
with 29
reports;
Germany
with 7
reports;
Netherlands
with 5
reports.
The most common categories in these recent reports were:
Web App Attack
48
times;
Brute-Force
27
times;
Bad Web Bot
25
times;
Hacking
10
times;
Port Scan
4
times;
Other
3
times.
Recent Reports
We have received reports of abusive activity from this IP address within the last week. It is
potentially still actively engaged in abusive activities.
Honeypot hit: HTTP/1.1 request on 7890
GET /
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKi ...
show moreHoneypot hit: HTTP/1.1 request on 7890
GET /
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate; 7890 [2] TCP
show less
Blocked by UFW (TCP on 7443)
Source port: 61014
TTL: 241
Packet length: 44
TOS: 0x00
This report (f ...
show moreBlocked by UFW (TCP on 7443)
Source port: 61014
TTL: 241
Packet length: 44
TOS: 0x00
This report (for 159.89.82.212) was generated by:
https://github.com/sefinek/UFW-AbuseIPDB-Reporter
show less
Port Scan
Anonymous
Unauthorized connection to SSH port 22
Port Scan
SSH
Anonymous
fail2ban jail apache-secrets-probe: startupian.com:80 159.89.82.212 - - [01/Oct/2026:04:48:25 -0700] ...
show morefail2ban jail apache-secrets-probe: startupian.com:80 159.89.82.212 - - [01/Oct/2026:04:48:25 -0700] "GET /.git/config HTTP/1.1" 301 593 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.129 Safari/537.36"
show less
Auto-ban: single probe for restricted files (.env / backups / admin endpoints). Likely mass-scan on ...
show moreAuto-ban: single probe for restricted files (.env / backups / admin endpoints). Likely mass-scan on 2026-10-01.
show less
Automated honeypot detection. honeypot against a Next.js application. Paths: /.git/config. Blocked a ...
show moreAutomated honeypot detection. honeypot against a Next.js application. Paths: /.git/config. Blocked at the edge.
show less
[FriOct0209:53:08.1276272026][security2:error][pid537821:tid537899][client159.89.82.212:0]ModSecurit ...
show more[FriOct0209:53:08.1276272026][security2:error][pid537821:tid537899][client159.89.82.212:0]ModSecurity:Accessdeniedwithcode403\(phase1\).Matchedphrase\".git\"atREQUEST_URI.[file\"/etc/apache2/conf.d/modsec_custom_rules.conf\"][line\"710\"][id\"960720\"][msg\"Forbiddenfileaccess\"][hostname\"ristrutturazione-case.ch\"][uri\"/.git/config\"][unique_id\"ar9i5DmqXkfM90_IBMwDBwAAAQI\"]
show less
[02/Oct/2026:09:26:47 +0300] -- 159.89.82.212 Ban reason: Scanner [CMS_GENERIC] | Request: GET /.git ...
show more[02/Oct/2026:09:26:47 +0300] -- 159.89.82.212 Ban reason: Scanner [CMS_GENERIC] | Request: GET /.git/config HTTP/1.1
show less
