JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 89.107.165.63

89.107.165.63 was found in our database!

This IP was reported 12 times. Confidence of Abuse is 58%: ?

58%

ISP	Daten- und Telekommunikations GmbH Dessau
Usage Type	Fixed Line ISP
ASN	AS216451
Hostname(s)	89-107-165-63.dsl-pool.datel-dessau.de
Domain Name	datel-dessau.de
Country	🇩🇪 Germany
City	Dessau, Saxony-Anhalt

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 89.107.165.63

Whois 89.107.165.63

IP Abuse Reports for 89.107.165.63:

This IP address has been reported a total of 12 times from 10 distinct sources. 89.107.165.63 was first reported on July 9th 2026, and the most recent report was 2 days ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇦🇺 AWW-Admin	2026-07-11 08:12:24 (2 days ago)	(mod_security) mod_security triggered on hostname [redacted] 89.107.165.63 (DE/Germany/89-107-165-63 ... show more (mod_security) mod_security triggered on hostname [redacted] 89.107.165.63 (DE/Germany/89-107-165-63.dsl-pool.datel-dessau.de) show less	SQL Injection
🇳🇱 homeshowdomain.nl	2026-07-10 21:59:44 (2 days ago)	Auto-ban: single probe for restricted files (.env / backups / admin endpoints). Likely mass-scan on ... show more Auto-ban: single probe for restricted files (.env / backups / admin endpoints). Likely mass-scan on 2026-07-09. show less	Web App Attack SSH Hacking
🇺🇸 itsnixk	2026-07-10 20:15:28 (2 days ago)	(mod_security) mod_security (id:930130) triggered by 89.107.165.63 (DE/Germany/89-107-165-63.dsl-poo ... show more (mod_security) mod_security (id:930130) triggered by 89.107.165.63 (DE/Germany/89-107-165-63.dsl-pool.datel-dessau.de): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: [Fri Jul 10 16:15:26.207044 2026] [security2:error] [pid 1044:tid 1340] [remote 89.107.165.63:0] ModSecurity: Access denied with code 406 (phase 1). Matched phrase ".env" at REQUEST_FILENAME. [file "/etc/modsecurity.d/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "150"] [id "930130"] [msg "Restricted File Access Attempt"] [redacted] [severity "CRITICAL"] [ver "OWASP_CRS/4.27.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/ATTACK-LFI"] [tag "capec/1000/255/153/126"] [redacted] [uri "/.env"] [unique_id "alFS3uayinSrA2hcdf2kbQAAchk"] show less	Port Scan
🇩🇪 Ba-Yu	2026-07-10 20:01:03 (2 days ago)	General hacking/exploits/scanning	Web Spam Hacking Brute-Force Exploited Host Web App Attack
🇺🇸 TPI-Abuse	2026-07-10 11:19:42 (2 days ago)	(mod_security) mod_security (id:210492) triggered by 89.107.165.63 (89-107-165-63.dsl-pool.datel-des ... show more (mod_security) mod_security (id:210492) triggered by 89.107.165.63 (89-107-165-63.dsl-pool.datel-dessau.de): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jul 10 07:19:35.439086 2026] [security2:error] [pid 25827:tid 25827] [client 89.107.165.63:35092] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "vespaitaliancafe.matteozacchino.dev"] [uri "/.env"] [unique_id "alDVR7lrqVejAzCfwKrhDQAAAAY"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-07-10 10:59:49 (2 days ago)	(mod_security) mod_security (id:210492) triggered by 89.107.165.63 (89-107-165-63.dsl-pool.datel-des ... show more (mod_security) mod_security (id:210492) triggered by 89.107.165.63 (89-107-165-63.dsl-pool.datel-dessau.de): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jul 10 06:59:45.544960 2026] [security2:error] [pid 19350:tid 19350] [client 89.107.165.63:43162] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.thai-tam.com.convoyforkids.com"] [uri "/.env"] [unique_id "alDQobT_iqTjpelSnoSf1wAAAA4"] show less	Brute-Force Bad Web Bot Web App Attack
🇲🇾 Rizzy	2026-07-10 07:01:59 (3 days ago)	Multiple WAF Violations	Brute-Force Web App Attack
Anonymous	2026-07-10 01:10:05 (3 days ago)	Bot / scanning and/or hacking attempts: GET /.env.stage HTTP/1.1, GET /.env.dev HTTP/1.1, GET /.env. ... show more Bot / scanning and/or hacking attempts: GET /.env.stage HTTP/1.1, GET /.env.dev HTTP/1.1, GET /.env.development.local HTTP/1.1, GET /.env.prod.local HTTP/1.1, GET /.env.save HTTP/1.1, GET /.env.backup HTTP/1.1, GET /.env.www HTTP/1.1, GET /.env.live HTTP/1.1, GET /.env_sample HTTP/1.1, GET /.env.production HTTP/1.1, GET /api/.env HTTP/1.1, GET /.env.dev.local HTTP/1.1, GET /.env.production.local HTTP/1.1, GET /.env.old HTTP/1.1, GET /.env.prod HTTP/1.1, GET /.env_1 HTTP/1.1, GET /.env.local HTTP/1.1 show less	Hacking Web App Attack
🇨🇦 john doe	2026-07-09 22:27:59 (3 days ago)	SentinelBot: Env File Hunting (score: 71)	Bad Web Bot
🇳🇱 homeshowdomain.nl	2026-07-09 22:00:51 (3 days ago)	Auto-ban: >3000 req/min op 2026-07-09	Web App Attack SSH Hacking
🇺🇸 infra-monitor	2026-07-09 21:00:04 (3 days ago)	Automated ban via infra-monitor: suspicious-probe, crowdsecurity/http-probing, crowdsecurity/http-se ... show more Automated ban via infra-monitor: suspicious-probe, crowdsecurity/http-probing, crowdsecurity/http-sensitive-files show less	Port Scan Web App Attack
🇩🇪 mravb	2026-07-09 15:04:38 (3 days ago)	89.107.165.63 - - [09/Jul/2026:18:04:37 +0300] "GET /.env HTTP/1.1" 404 335 "-" "req/0.6.2" ...	Web App Attack Hacking

Showing 1 to 12 of 12 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇵🇰 103.82.121.67

🇬🇧 35.203.210.165

🇺🇸 17.241.227.32

🇩🇪 185.242.3.195

🇩🇪 167.94.146.45

🇭🇰 103.30.40.129

🇵🇱 85.219.208.98

🇱🇹 62.60.130.233

🇲🇾 47.250.186.207

🇺🇸 20.64.106.19

🇬🇧 2a09:bac5:3807:1f19::319:ec

🇺🇸 216.180.246.240

🇦🇷 190.244.183.91

🇺🇸 152.32.236.167

🇳🇬 102.88.137.213

🇺🇸 100.29.192.33

🇷🇴 80.94.95.217

🇺🇸 71.6.134.228

🇧🇷 45.205.1.244

🇷🇺 90.151.171.108