JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 213.209.159.223

213.209.159.223 was found in our database!

This IP was reported 1,875 times. Confidence of Abuse is 100%: ?

100%

ISP	Feo Prest SRL
Usage Type	Data Center/Web Hosting/Transit
ASN	AS208137
Domain Name	feoprest.life
Country	🇩🇪 Germany
City	Aachen, North Rhine-Westphalia

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 213.209.159.223

Whois 213.209.159.223

IP Abuse Reports for 213.209.159.223:

This IP address has been reported a total of 1,875 times from 518 distinct sources. 213.209.159.223 was first reported on April 18th 2026, and the most recent report was 5 hours ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
Anonymous	2026-06-03 19:23:55 (21 hours ago)	213.209.159.223 - - [04/Jun/2026:03:23:53 +0800] "GET /.env HTTP/1.1" 404 396 "-" "Mozilla/5.0 (Wind ... show more 213.209.159.223 - - [04/Jun/2026:03:23:53 +0800] "GET /.env HTTP/1.1" 404 396 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/59.0.3071.115 Safari/537.36 OPR/46.0.2597.57" 213.209.159.223 - - [04/Jun/2026:03:23:53 +0800] "GET /api/.env HTTP/1.1" 404 396 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/59.0.3071.115 Safari/537.36 OPR/46.0.2597.57" 213.209.159.223 - - [04/Jun/2026:03:23:53 +0800] "GET /backend/.env HTTP/1.1" 404 396 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/59.0.3071.115 Safari/537.36 OPR/46.0.2597.57" 213.209.159.223 - - [04/Jun/2026:03:23:53 +0800] "GET /phpinfo.php HTTP/1.1" 404 396 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/59.0.3071.115 Safari/537.36 OPR/46.0.2597.57" 213.209.159.223 - - [04/Jun/2026:03:23:53 +0800] "GET /admin/.env HTTP/1.1" 404 396 "-" "Mozilla/5.0 (Windows NT ... show less	Web App Attack
🇨🇦 john doe	2026-06-03 19:17:52 (21 hours ago)	SentinelBot: Env File Hunting (score: 73)	Bad Web Bot
🇫🇷 largo-it.net	2026-06-03 18:36:31 (21 hours ago)	Jun 3 20:36:30 vps-9f3cdc33 haproxy[192056]: 213.209.159.223:60940 [03/Jun/2026:20:36:30.521] www_f ... show more Jun 3 20:36:30 vps-9f3cdc33 haproxy[192056]: 213.209.159.223:60940 [03/Jun/2026:20:36:30.521] www_frontend~ sso1_cluster/sso1_https 0/0/1/12/13 404 1250 - - ---- 57/7/0/0/0 0/0 "GET /.env HTTP/1.1" Jun 3 20:36:30 vps-9f3cdc33 haproxy[192056]: 213.209.159.223:60940 [03/Jun/2026:20:36:30.553] www_frontend~ sso1_cluster/sso1_https 0/0/1/11/12 404 1250 - - ---- 57/7/0/0/0 0/0 "GET /api/.env HTTP/1.1" Jun 3 20:36:30 vps-9f3cdc33 haproxy[192056]: 213.209.159.223:60940 [03/Jun/2026:20:36:30.584] www_frontend~ sso1_cluster/sso1_https 0/0/1/12/13 404 1250 - - ---- 57/7/0/0/0 0/0 "GET /backend/.env HTTP/1.1" Jun 3 20:36:30 vps-9f3cdc33 haproxy[192056]: 213.209.159.223:60940 [03/Jun/2026:20:36:30.615] www_frontend~ sso1_cluster/sso1_https 0/0/1/11/12 404 1250 - - ---- 57/7/0/0/0 0/0 "GET /phpinfo.php HTTP/1.1" Jun 3 20:36:30 vps-9f3cdc33 haproxy[192056]: 213.209.159.223:60940 [03/Jun/2026:20:36:30.647] www_frontend~ sso1_cluster/sso1_https 0/0/0/10/10 404 1250 - - ---- 57/7/0/0/0 0/0 "GET /a ... show less	Hacking Bad Web Bot Web App Attack
🇩🇪 itsolon	2026-06-03 18:32:47 (21 hours ago)	[03/Jun/2026:20:32:46 +0200] 178051156681.795753 213.209.159.223 46668 217.154.7.177 80 [03/Jun/2026 ... show more [03/Jun/2026:20:32:46 +0200] 178051156681.795753 213.209.159.223 46668 217.154.7.177 80 [03/Jun/2026:20:32:46 +0200] 178051156655.310181 213.209.159.223 53616 217.154.7.177 443 [03/Jun/2026:20:32:46 +0200] 178051156630.574226 213.209.159.223 46668 217.154.7.177 80 [03/Jun/2026:20:32:46 +0200] 178051156633.548208 213.209.159.223 39834 217.154.7.177 80 [03/Jun/2026:20:32:46 +0200] 178051156627.979799 213.209.159.223 53616 217.154.7.177 443 ... show less	Port Scan Hacking Brute-Force Web App Attack
🇬🇧 Oakley	2026-06-03 18:22:27 (22 hours ago)	(confirmed_bot_sig) Confirmed bot	Hacking
Anonymous	2026-06-03 18:08:35 (22 hours ago)	[Wed Jun 03 18:08:33.336138 2026] [php:error] [pid 1400594] [client 213.209.159.223:34404] script '/ ... show more [Wed Jun 03 18:08:33.336138 2026] [php:error] [pid 1400594] [client 213.209.159.223:34404] script '/var/www/vhosts/mcdermit.org/BOISD/phpinfo.php' not found or unable to stat [Wed Jun 03 18:08:34.339652 2026] [php:error] [pid 1400598] [client 213.209.159.223:34420] script '/var/www/vhosts/mcdermit.org/BOISD/phpinfo.php' not found or unable to stat [Wed Jun 03 18:08:34.881280 2026] [php:error] [pid 1400624] [client 213.209.159.223:34672] script '/var/www/vhosts/mcdermit.org/BOISD/phpinfo.php' not found or unable to stat [Wed Jun 03 18:08:34.881394 2026] [php:error] [pid 1400622] [client 213.209.159.223:34644] script '/var/www/vhosts/mcdermit.org/BOISD/phpinfo.php' not found or unable to stat [Wed Jun 03 18:08:34.881819 2026] [php:error] [pid 1400621] [client 213.209.159.223:34704] script '/var/www/vhosts/mcdermit.org/BOISD/phpinfo.php' not found or unable to stat ... show less	Brute-Force
🇹🇷 baku.hosting	2026-06-03 17:46:10 (22 hours ago)	CSF Auto Report: (mod_security) mod_security (id:949110) triggered by 213.209.159.223 (DE/Germany/-) ... show more CSF Auto Report: (mod_security) mod_security (id:949110) triggered by 213.209.159.223 (DE/Germany/-): 5 in the last 3600 secs show less	Brute-Force Web App Attack
🇺🇸 almazick	2026-06-03 17:34:42 (22 hours ago)	Fail2Ban jail window on srv1.windowrepair.us banned 213.209.159.223 after 1 attempts	Bad Web Bot Web App Attack
🇳🇱 SysAdmin Dylan	2026-06-03 17:21:47 (23 hours ago)	(mod_security) mod_security (id:210492) triggered by 213.209.159.223 (DE/Germany/-): 10 in the last ... show more (mod_security) mod_security (id:210492) triggered by 213.209.159.223 (DE/Germany/-): 10 in the last 3600 secs show less	Brute-Force
🇫🇮 smallhost_helsinki	2026-06-03 17:12:43 (23 hours ago)	Tried to access non existent path: /.env	Web App Attack
🇬🇧 consul.to	2026-06-03 16:57:04 (23 hours ago)	Web attack/malicious scanning detected	Web App Attack
🇺🇸 uchat-ai.com	2026-06-03 15:58:11 (1 day ago)	IP 213.209.159.223 在过去24小时内进行了 5 次攻击。详细信息: 攻击类型: Restricted File Access Attempt, 攻击信息: No matched da ... show more IP 213.209.159.223 在过去24小时内进行了 5 次攻击。详细信息: 攻击类型: Restricted File Access Attempt, 攻击信息: No matched data found; 攻击类型: Restricted File Access Attempt, 攻击信息: No matched data found; 攻击类型: Restricted File Access Attempt, 攻击信息: No matched data found; 攻击类型: Restricted File Access Attempt, 攻击信息: No matched data found; 攻击类型: Restricted File Access Attempt, 攻击信息: No matched data found show less	Web App Attack
🇩🇪 macrob	2026-06-03 14:58:37 (1 day ago)	2026/06/03 14:58:36 [error] 832607#832607: 278301104 access forbidden by rule, client: 213.209.159. ... show more 2026/06/03 14:58:36 [error] 832607#832607: 278301104 access forbidden by rule, client: 213.209.159.223, server: behemoti.com, request: "GET /.env HTTP/2.0", host: "behemoti.com" 2026/06/03 14:58:36 [error] 832607#832607: 278301128 access forbidden by rule, client: 213.209.159.223, server: behemoti.com, request: "GET /api/.env HTTP/2.0", host: "behemoti.com" 2026/06/03 14:58:36 [error] 832603#832603: 278301164 access forbidden by rule, client: 213.209.159.223, server: behemoti.com, request: "GET /backend/.env HTTP/2.0", host: "behemoti.com" ... show less	Web App Attack
🇨🇿 ptlab	2026-06-03 14:45:39 (1 day ago)	Detected env_leak attack from WP-host.	Hacking Web App Attack
🇩🇪 Live Home Cams	2026-06-03 14:42:10 (1 day ago)	WebApp brute force attack detected. Multiple file scanning attempts from 213.209.159.223. Detected b ... show more WebApp brute force attack detected. Multiple file scanning attempts from 213.209.159.223. Detected by fail2ban. show less	Web App Attack Brute-Force

Showing 46 to 60 of 1875 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇺🇸 172.191.239.155

🇹🇼 116.241.212.237

🇻🇳 116.99.173.102

🇮🇩 69.5.23.222

🇳🇱 45.148.10.147

🇧🇷 43.157.151.226

🇨🇳 222.87.110.69

🇩🇪 167.94.146.79

🇺🇸 166.62.33.9

🇺🇸 2602:fb54:1400::23

🇩🇪 213.209.159.56

🇮🇩 202.65.231.37

🇨🇱 190.161.42.155

🇱🇹 185.2.228.48

🇰🇷 183.103.217.251

🇨🇭 144.2.91.96

🇺🇸 142.248.80.47

🇸🇬 118.26.111.107

🇺🇸 47.204.210.202

🇧🇷 45.205.1.245