JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

84.32.63.139

Recent Activity

Abuse confidence score ?

100% Critical

50 reports

39 reporters · latest 10 hours ago

ISP	UAB Nacionalinis Telekomunikaciju Tinklas
Usage Type	Data Center/Web Hosting/Transit
ASN	AS204770
Hostname(s)	ip-84-32-63-139.004.ptr.cherryservers.net
Domain Name	ntt.lt
Country	🇺🇸 United States of America
City	Chicago, Illinois

ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report Whois

Reports Activity

Example preview

Report Categories (Last 60 Days)

Example preview

Top Reporter Countries (Last 60 Days)

Example preview

Account required for the enhanced features Log in Sign up

IP Abuse Reports for 84.32.63.139

Export CSV

This IP address has been reported a total of 50 times from 39 distinct sources. 84.32.63.139 was first reported on October 25th 2026, and the most recent report was 10 hours ago. In the last 60 days, the top reporter locations were: United States of America with 29 reports; United Kingdom of Great Britain and Northern Ireland with 9 reports; Australia with 5 reports. The most common categories in these recent reports were: Port Scan 43 times; Hacking 10 times; Web App Attack 8 times; Brute-Force 7 times; Bad Web Bot 2 times; Other 4 times.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇺🇸 LSPCCU	2026-10-27 12:02:28 (10 hours ago)	TSEC Honeypot Network report. Threat score: 72/100. Categories: Port Scan, Hacking, Brute-Force, Web ... show more TSEC Honeypot Network report. Threat score: 72/100. Categories: Port Scan, Hacking, Brute-Force, Web App Attack, SSH. Honeypot: h0neytr4p. Context: 84.32.63.139 classified as botnet node participating in coordinated attack campaigns (high confidence). show less	Port Scan Hacking Brute-Force Web App Attack SSH
🇺🇸 3rdKey	2026-10-27 09:30:03 (13 hours ago)	OpenCanary honeypot hit on port 443 (no legitimate service runs there); logtype 3000. Automated repo ... show more OpenCanary honeypot hit on port 443 (no legitimate service runs there); logtype 3000. Automated report. show less	Port Scan Web App Attack
🇺🇸 conrad10781	2026-10-27 09:29:37 (13 hours ago)	nginx-direct-ip	Port Scan
🇺🇸 HamSammich	2026-10-27 09:27:25 (13 hours ago)	Automated sensor: 4 HTTPS connection/probe attempts over the last 24h (latest 2026-10-27T09:27Z).	Port Scan Web App Attack
🇺🇸 brantknudson.org	2026-10-27 09:26:09 (13 hours ago)	Incorrect Host header	Web App Attack Brute-Force
🇨🇦 lakered	2026-10-27 09:25:10 (13 hours ago)	Detectors: [NGINX] \| Reasons: Nginx: Default server trap hit \| Evidence: Malformed-Connection-Struct ... show more Detectors: [NGINX] \| Reasons: Nginx: Default server trap hit \| Evidence: Malformed-Connection-Structure, High-Criminality-Signature (ja4:t13i130900 - Ratio:0.95), High-Criminality-Signature (p0f::64:0::mss*44,10:mss,sok,ts,nop,ws:df,id+:0 - Ratio:0.81), OS-Signature-Mismatch (UA:Windows/p0f:Linux) \| UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:140.0) Gecko/20100101 Firefox/140.0 \| TCP Fingerprint: Modern Linux (Kernel 3.x+) (Link:PPPoE, Uptime:0m) show less	Port Scan Exploited Host
🇹🇼 taiwanfrp.me	2026-10-27 09:23:10 (13 hours ago)	taiwanfrp NewUserConn auto-ban: reason=ip_over_target_scan_limit_60s1, conn10s=1, targets10m=1, targ ... show more taiwanfrp NewUserConn auto-ban: reason=ip_over_target_scan_limit_60s1, conn10s=1, targets10m=1, target=proxy:kiwicanary.MinecraftJava62osdfvgdfgrsgrg\|port:- show less	Port Scan Hacking
🇦🇺 LiftUp Hosting	2026-10-27 09:22:07 (13 hours ago)	Honeypot hit: Unauthorized traffic (231 bytes of payload); 12443 [1] TCP	Port Scan
🇩🇪 D3vNu11	2026-10-27 09:20:33 (13 hours ago)	Level: (LOW): Reputation Unknown via CitrixHoneypot IOC Country: United States 1x -> Target Country: ... show more Level: (LOW): Reputation Unknown via CitrixHoneypot IOC Country: United States 1x -> Target Country: Ashburn, USA HTTPS show less	Hacking Web App Attack
🇬🇧 Vluxon, Inc.	2026-10-27 09:20:06 (13 hours ago)	Horizontal TCP service scan detected by honeypot [Vlux-Sensor-04, Vlux-Sensor-08, Vlux-Sensor-13] Ob ... show more Horizontal TCP service scan detected by honeypot [Vlux-Sensor-04, Vlux-Sensor-08, Vlux-Sensor-13] Observed: 2026-10-27T09:16:01.531Z Distinct destination ports (1): 8443 Distinct sensors: 3 Completed TCP connections: 3 Source ports: 47452, 37418, 56028 Submitted by Vlux-Sensor-04, Vlux-Sensor-08, Vlux-Sensor-13 show less	Port Scan
🇺🇸 JustMeHere	2026-10-27 09:19:50 (13 hours ago)	[Tue Oct 27 05:19:45.953018 2026] [security2:error] [pid 44516:tid 44566] [client 84.32.63.139:59354 ... show more [Tue Oct 27 05:19:45.953018 2026] [security2:error] [pid 44516:tid 44566] [client 84.32.63.139:59354] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:blocking_inbound_anomaly_score. [file "/etc/httpd/modsecurity.d/activated_rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "233"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 6)"] [ver "OWASP_CRS/4.15.0"] [tag "anomaly-evaluation"] [tag "OWASP_CRS"] [hostname "73.88.79.72"] [uri "/"] [unique_id "auBssd4TUIGjdpXHJuF2YgAAARY"] ... show less	Web App Attack
🇺🇸 sandra361	2026-10-27 09:17:50 (13 hours ago)	Port scan detected: 5 attempts across 1 port (10444). \| Evidence: REAPER_TARPIT: IN=enp1s0 SRC=84.32 ... show more Port scan detected: 5 attempts across 1 port (10444). \| Evidence: REAPER_TARPIT: IN=enp1s0 SRC=84.32.63.139 LEN=40 TOS=0x00 PREC=0x00 TTL=52 ID=23920 DF PROTO=TCP SPT=37396 DPT=10444 WINDOW=64240 RES=0x00 ACK FIN URGP=0 show less	Port Scan
Anonymous	2026-10-27 09:16:39 (13 hours ago)	tls scan	Port Scan
🇺🇸 TPI-Abuse	2026-10-27 09:16:04 (13 hours ago)	(mod_security) mod_security (id:210350) triggered by 84.32.63.139 (ip-84-32-63-139.004.ptr.cherryser ... show more (mod_security) mod_security (id:210350) triggered by 84.32.63.139 (ip-84-32-63-139.004.ptr.cherryservers.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 27 05:15:59.022062 2026] [security2:error] [pid 738:tid 738] [client 84.32.63.139:60602] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close\|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close\|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found\|\|192.64.150.4:443\|F\|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "192.64.150.4"] [uri "/"] [unique_id "auBrz0tvaeqS6cIGtnNQUgAAAAI"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 donarev419	2026-10-27 09:16:01 (13 hours ago)	Connection to port 5443 with data transfer. Data preview:	Port Scan Hacking

Showing 1 to 15 of 50 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇬🇧 2a06:4880:8000::9c

🇧🇷 177.10.203.106

🇺🇸 152.32.205.7

🇳🇱 151.245.151.40

🇧🇬 145.224.108.222

🇮🇳 103.207.4.222

🇧🇫 102.179.24.5

🇺🇿 89.146.65.69

🇨🇳 52.81.235.120

🇦🇷 45.228.190.124

🇨🇦 45.198.224.125

🇳🇱 45.148.10.157

🇺🇸 43.172.91.126

🇺🇸 23.148.144.69

🇭🇰 20.24.222.184

🇫🇷 13.140.139.95

🇬🇧 195.96.139.113

🇨🇴 191.95.128.74

🇯🇵 180.196.58.117

🇳🇱 176.65.132.239