JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 213.209.159.223

213.209.159.223 was found in our database!

This IP was reported 1,852 times. Confidence of Abuse is 100%: ?

100%

ISP	Feo Prest SRL
Usage Type	Data Center/Web Hosting/Transit
ASN	AS208137
Domain Name	feoprest.life
Country	🇩🇪 Germany
City	Aachen, North Rhine-Westphalia

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 213.209.159.223

Whois 213.209.159.223

IP Abuse Reports for 213.209.159.223:

This IP address has been reported a total of 1,852 times from 511 distinct sources. 213.209.159.223 was first reported on April 18th 2026, and the most recent report was 2 minutes ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇫🇷 Baking333	2026-06-02 00:45:09 (2 days ago)	[redacted] 213.209.159.223 - - [02/Jun/2026:01:45:07 +0100] "GET /.env HTTP/1.1" 302 5268 0/131725 " ... show more [redacted] 213.209.159.223 - - [02/Jun/2026:01:45:07 +0100] "GET /.env HTTP/1.1" 302 5268 0/131725 "-" "Opera/7.54 (Windows NT 5.1; U) [de]" [redacted] 213.209.159.223 - - [02/Jun/2026:01:45:07 +0100] "GET /.env HTTP/1.1" 302 5288 0/212109 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:2.0b6pre) Gecko/20100907 Firefox/4.0b6pre Camino/2.2a1pre" show less	Bad Web Bot Web App Attack
🇺🇸 mw	2026-06-02 00:01:08 (2 days ago)	GET /.env HTTP/1.1	Web App Attack
🇫🇷 SpaceHost-Server	2026-06-01 22:32:08 (2 days ago)		Brute-Force Web App Attack
🇸🇮 administrator	2026-06-01 22:10:11 (2 days ago)	2026-05-31 00:07:13,092 fail2ban.actions [264721]: NOTICE [apache-auth] Ban 213.209.159.223 ... show more 2026-05-31 00:07:13,092 fail2ban.actions [264721]: NOTICE [apache-auth] Ban 213.209.159.223 ... show less	Bad Web Bot Web Spam Email Spam Blog Spam Port Scan Brute-Force Web App Attack
🇩🇪 macrob	2026-06-01 21:20:40 (2 days ago)	2026/06/01 21:20:39 [error] 562092#562092: 273676521 access forbidden by rule, client: 213.209.159. ... show more 2026/06/01 21:20:39 [error] 562092#562092: 273676521 access forbidden by rule, client: 213.209.159.223, server: binixo.com, request: "GET /.env HTTP/2.0", host: "binixo.com" 2026/06/01 21:20:39 [error] 562092#562092: 273676525 access forbidden by rule, client: 213.209.159.223, server: binixo.com, request: "GET /api/.env HTTP/2.0", host: "binixo.com" 2026/06/01 21:20:39 [error] 562092#562092: 273676525 access forbidden by rule, client: 213.209.159.223, server: binixo.com, request: "GET /backend/.env HTTP/2.0", host: "binixo.com" ... show less	Web App Attack
🇩🇪 Gwyneth Llewelyn	2026-06-01 21:16:30 (2 days ago)	2026/06/01 22:16:28 [error] 1725770#1725770: 1010741 access forbidden by rule, client: 213.209.159. ... show more 2026/06/01 22:16:28 [error] 1725770#1725770: 1010741 access forbidden by rule, client: 213.209.159.223, server: getasecondlife.net, request: "GET /.env HTTP/1.1", host: "getasecondlife.net" 2026/06/01 22:16:28 [error] 1725770#1725770: 1010741 access forbidden by rule, client: 213.209.159.223, server: getasecondlife.net, request: "GET /api/.env HTTP/1.1", host: "getasecondlife.net" 2026/06/01 22:16:28 [error] 1725770#1725770: 1010741 access forbidden by rule, client: 213.209.159.223, server: getasecondlife.net, request: "GET /backend/.env HTTP/1.1", host: "getasecondlife.net" show less	Brute-Force Web App Attack
Anonymous	2026-06-01 21:02:52 (2 days ago)	Configuration snooping (/.env): 213.209.159.223 - - [01/Jun/2026:22:02:52 +0100] "GET /.env HTTP/1. ... show more Configuration snooping (/.env): 213.209.159.223 - - [01/Jun/2026:22:02:52 +0100] "GET /.env HTTP/1.1" 200 234 "-" "Mozilla/5.0 (Windows NT 5.1; rv:17.0) Gecko/20100101 Firefox/17.0" show less	Hacking Web App Attack
🇳🇱 Site.eu	2026-06-01 20:33:34 (2 days ago)	Excessive multi-domain requests	Brute-Force
🇳🇱 debestelapp	2026-06-01 20:32:29 (2 days ago)		Web App Attack
🇿🇦 slartybartfast69420blazit	2026-06-01 20:27:39 (2 days ago)	Fail2ban picked up 213.209.159.223 attacking nginx	Web App Attack
🇪🇸 loadsoporte	2026-06-01 20:16:17 (2 days ago)	RdpGuard detected brute-force attempt on HTTP	Brute-Force
🇺🇸 dtorrer	2026-06-01 20:15:11 (2 days ago)	General vulnerability scan.	Port Scan
🇩🇪 4server	2026-06-01 20:04:58 (2 days ago)	[MonJun0122:04:54.0917682026][security2:error][pid3234999:tid3235114][client213.209.159.223:0]ModSec ... show more [MonJun0122:04:54.0917682026][security2:error][pid3234999:tid3235114][client213.209.159.223:0]ModSecurity:Accessdeniedwithcode403$phase2$.Patternmatch\"$\?:\\\\\\\\b\(\?:\\\\\\\\.\(\?:ht\(\?:access\\|passwd\\|group$\\|www_\?acl\)\\|global\\\\\\\\.asa\\|httpd\\\\\\\\.conf\\|boot\\\\\\\\.ini\\|web.config\)\\\\\\\\b\\|$\\|\^\\|\\\\\\\\.\\\\\\\\.$/etc/\\|/\\\\\\\\.$\?:history\\|bash_history\\|sh_history\\|env$\$\)\"atREQUEST_FILENAME.[file\"/etc/apache2/conf.d/modsec_rules/10_asl_rules.conf\"][line\"204\"][id\"390709\"][rev\"30\"][msg\"Atomicorp.comWAFRules:Attempttoaccessprotectedfileremotely\"][data\"/.env\"][severity\"CRITICAL\"][hostname\"kiteinvest.ch\"][uri\"/api/.env\"][unique_id\"ah3l5vHIVUHPEqnvGdIG5AAAANA\"] show less	Port Scan Brute-Force Web App Attack
Anonymous	2026-06-01 20:01:28 (2 days ago)	213.209.159.223 - - [01/Jun/2026:22:01:25 +0200] "GET /.env HTTP/1.1" 403 5540 "-" "Mozilla/4.0 (com ... show more 213.209.159.223 - - [01/Jun/2026:22:01:25 +0200] "GET /.env HTTP/1.1" 403 5540 "-" "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; GTB7.5; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729; .NET CLR 1.1.4322)" 213.209.159.223 - - [01/Jun/2026:22:01:25 +0200] "GET /api/.env HTTP/1.1" 403 557 "-" "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; GTB7.5; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729; .NET CLR 1.1.4322)" 213.209.159.223 - - [01/Jun/2026:22:01:25 +0200] "GET /backend/.env HTTP/1.1" 403 557 "-" "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; GTB7.5; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729; .NET CLR 1.1.4322)" 213.209.159.223 - - [01/Jun/2026:22:01:25 +0200] "GET /phpinfo.php HTTP/1.1" 404 360 "-" "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; GTB7.5; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729; .NET CLR 1.1.4322)" 213.209.159.223 - - [01/ ... show less	DDoS Attack
🇩🇪 MusicLibrary	2026-06-01 19:47:43 (2 days ago)	Attempted access to sensitive configuration files (.env, .git, etc.)	Bad Web Bot Web App Attack

Showing 151 to 165 of 1852 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇳🇱 213.177.179.126

🇩🇪 213.165.35.72

🇳🇱 204.76.203.222

🇬🇧 185.91.69.65

🇹🇼 128.14.227.52

🇮🇳 116.73.240.74

🇨🇳 106.12.212.9

🇫🇷 94.23.188.193

🇺🇸 66.132.186.185

🇮🇳 64.227.171.209

🇺🇸 64.62.197.166

🇲🇽 46.250.175.6

🇭🇰 23.249.28.115

🇧🇷 191.0.106.37

🇩🇪 185.176.94.38

🇨🇳 106.75.144.134

🇵🇱 87.251.64.141

🇷🇴 80.94.92.187

🇺🇸 67.207.92.95

🇫🇷 54.37.118.76