This IP address has been reported a total of
22
times from
17 distinct
sources.
206.189.199.9 was first reported on
, and the most recent report was
.
In the last 60 days, the top reporter locations were:
United States of America
with 5
reports;
Germany
with 2
reports;
France
with 1
report.
The most common categories in these recent reports were:
Port Scan
9
times;
Web App Attack
1
time;
Brute-Force
1
time;
Hacking
1
time.
Recent Reports
We have received reports of abusive activity from this IP address within the last week. It is
potentially still actively engaged in abusive activities.
Honeypot Finding: repeated TCP service probing on TCP/4000 (service); 2 application-level events acr ...
show moreHoneypot Finding: repeated TCP service probing on TCP/4000 (service); 2 application-level events across 2 source port(s). Sensor(s): Honeytrap.
show less
Blocked by UFW (TCP on 4449)
Source port: 61012
TTL: 241
Packet length: 44
TOS: 0x00
This report (f ...
show moreBlocked by UFW (TCP on 4449)
Source port: 61012
TTL: 241
Packet length: 44
TOS: 0x00
This report (for 206.189.199.9) was generated by:
https://github.com/sefinek/UFW-AbuseIPDB-Reporter
show less
UFW blocked a suspicious connection attempt to a closed or denied port. This activity is commonly as ...
show moreUFW blocked a suspicious connection attempt to a closed or denied port. This activity is commonly associated with port scanning, service discovery, or automated internet probing. Technical: source_ip=206.189.199.9; proto=TCP; source_port=61006; target_port=1911; flags=SYN
show less
Honeypot hit: HTTP/1.1 request on 8881
GET /
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKi ...
show moreHoneypot hit: HTTP/1.1 request on 8881
GET /
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate; 8881 [2] TCP
show less
Web App Attack
Anonymous
denied traffic to a honeypot network. destination port 1234.
3 incidents: port scanning. First: 2026-03-25 22:53, Last: 2026-08-20 06:38 UTC. Triggers: non-publi ...
show more3 incidents: port scanning. First: 2026-03-25 22:53, Last: 2026-08-20 06:38 UTC. Triggers: non-public-port,firewall-tcp,unknown.
show less
