This IP address has been reported a total of
129
times from
60 distinct
sources.
20.215.89.22 was first reported on
, and the most recent report was
.
Recent Reports:
We have received reports of abusive activity from this IP address within the last week. It is
potentially still actively engaged in abusive activities.
Port scan from this IP. Firewall dropped every packet. Targeted TCP ports: 6379. Single burst at 202 ...
show morePort scan from this IP. Firewall dropped every packet. Targeted TCP ports: 6379. Single burst at 2026-06-03 20:29 UTC.
show less
byebyte.space auth: TCP packet to port 6379 (Redis) at 2026-06-03T20:29:05Z. Source port 2944. TCP f ...
show morebyebyte.space auth: TCP packet to port 6379 (Redis) at 2026-06-03T20:29:05Z. Source port 2944. TCP flags: SYN. Packet: 60B, TTL 48, window 64240, IP id 25250. Single packet, dropped at firewall. p0f: OS Linux 2.2.x-3.x (generic match), 16 hops, link IPIP or SIT.
show less
[TueJun0206:07:53.4840232026][security2:error][pid3746632:tid3746724][client20.215.89.22:0]ModSecuri ...
show more[TueJun0206:07:53.4840232026][security2:error][pid3746632:tid3746724][client20.215.89.22:0]ModSecurity:Accessdeniedwithcode403\(phase2\).Patternmatch\"\(\?:\\\\\\\\\$\(\?:\\\\\\\\\(\(\?:\\\\\\\\\(.\*\\\\\\\\\)\|.\*\)\\\\\\\\\)\|\\\\\\\\{.\*\\\\\\\\}\)\|[\<\>]\\\\\\\\\(.\*\\\\\\\\\)\)\"atARGS:0.[file\"/etc/apache2/conf.d/modsec_rules/10_asl_rules.conf\"][line\"396\"][id\"393655\"][rev\"17\"][msg\"Atomicorp.comWAFRules:PossibleRemoteCommandExecution:UnixShellExpressionFound\"][data\"MatchedData:\${encodeuricomponent\(string\(res\)\)}307\`}\)_chunks:\$q2_formdata:{get:\$1:constructor:constructor}}}foundwithinARGS:0:{then:\$1:__proto__:thenstatus:resolved_modelreason:-1value:{then:\$b1337}_response:{_prefix:varres=\(function\(\){var_r=typeofrequire\!==undefined\?require:\(process.mainmodule\?process.mainmodule.require.bind\(process.mainmodule\):\(typeofglobalthis.require\!==undefined\?globalthis.require:null\)\)return12899339148110000}\)\(\)throwobject.assign\(newerror\(next_redirect\){...\"][tag\"attack-rce\"][h
show less
(modsec_5080) ModSec 5080: Infrastructure subdomain probe from 20.215.89.22 (PL/Poland/-): 1 in the ...
show more(modsec_5080) ModSec 5080: Infrastructure subdomain probe from 20.215.89.22 (PL/Poland/-): 1 in the last 3600 secs (0-195)
show less
Blocked by UFW (TCP on 6379)
Source port: 10816
TTL: 36
Packet length: 60
TOS: 0x00
This report (fo ...
show moreBlocked by UFW (TCP on 6379)
Source port: 10816
TTL: 36
Packet length: 60
TOS: 0x00
This report (for 20.215.89.22) was generated by:
https://github.com/sefinek/UFW-AbuseIPDB-Reporter
show less
Port Scan
Showing 1 to
15
of 129 reports
Think this IP has been falsely reported? You may request to have the associated
reports reviewed and removed.
Request Takedown 🚩