JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 89.116.72.9

89.116.72.9 was found in our database!

This IP was reported 32 times. Confidence of Abuse is 100%: ?

100%

ISP	Ethernet Servers
Usage Type	Data Center/Web Hosting/Transit
ASN	AS46475
Domain Name	ethernetservers.com
Country	🇩🇪 Germany
City	Frankfurt am Main, Hesse

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 89.116.72.9

Whois 89.116.72.9

IP Abuse Reports for 89.116.72.9:

This IP address has been reported a total of 32 times from 26 distinct sources. 89.116.72.9 was first reported on June 11th 2026, and the most recent report was 8 hours ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇺🇸 mnsf	2026-06-13 09:07:26 (8 hours ago)	Abuse Detected (6)	Brute-Force Web App Attack
🇩🇪 NewGastroline	2026-06-13 05:30:42 (11 hours ago)	Malicious request blocked by CrowdSec on gastro-prod1.boreus.de	Bad Web Bot Web App Attack
🇨🇭 4server	2026-06-13 04:58:34 (12 hours ago)	[SatJun1306:58:28.8694142026][security2:error][pid3719081:tid3719211][client89.116.72.9:0]ModSecurit ... show more [SatJun1306:58:28.8694142026][security2:error][pid3719081:tid3719211][client89.116.72.9:0]ModSecurity:Accessdeniedwithcode403\(phase1\).Matchedphrase\".env\"atREQUEST_URI.[file\"/etc/apache2/conf.d/modsec_custom_rules.conf\"][line\"364\"][id\"960720\"][msg\"Forbiddenfileaccess\"][hostname\"new.fondazionemontgrand.ch\"][uri\"/.env\"][unique_id\"aizjdCOU9Aor920wBcx0MwAAARQ\"] show less	Hacking Web App Attack
🇺🇸 TPI-Abuse	2026-06-13 04:51:30 (12 hours ago)	(mod_security) mod_security (id:210492) triggered by 89.116.72.9 (-): 1 in the last 300 secs; Ports: ... show more (mod_security) mod_security (id:210492) triggered by 89.116.72.9 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Jun 13 00:51:22.776453 2026] [security2:error] [pid 14499:tid 14517] [client 89.116.72.9:38716] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "new.flutelesson.nl"] [uri "/.env.example"] [unique_id "aizhypIFDZMj2SN15AgPuAAAAFA"] show less	Brute-Force Bad Web Bot Web App Attack
🇲🇾 Rizzy	2026-06-13 04:03:44 (13 hours ago)	Multiple WAF Violations	Brute-Force Web App Attack
🇺🇸 kosada.com	2026-06-13 03:41:08 (13 hours ago)	Web vulnerability probing: /backend/.env	Web App Attack
🇫🇮 pixiekat	2026-06-12 23:47:54 (17 hours ago)	[Sat Jun 13 00:47:53.236630 2026] [authz_core:error] [pid 1827962:tid 1828005] [remote 89.116.72.9:4 ... show more [Sat Jun 13 00:47:53.236630 2026] [authz_core:error] [pid 1827962:tid 1828005] [remote 89.116.72.9:48960] AH01630: client denied by server configuration: proxy:http://localhost:13378/ [Sat Jun 13 00:47:53.528671 2026] [authz_core:error] [pid 1827962:tid 1827983] [remote 89.116.72.9:48960] AH01630: client denied by server configuration: proxy:http://localhost:13378/robots.txt [Sat Jun 13 00:47:53.580367 2026] [authz_core:error] [pid 1827962:tid 1827964] [remote 89.116.72.9:48960] AH01630: client denied by server configuration: proxy:http://localhost:13378/.env [Sat Jun 13 00:47:53.586911 2026] [authz_core:error] [pid 1827962:tid 1827965] [remote 89.116.72.9:48960] AH01630: client denied by server configuration: proxy:http://localhost:13378/application.yml [Sat Jun 13 00:47:53.594845 2026] [authz_core:error] [pid 1827962:tid 1827999] [remote 89.116.72.9:48960] AH01630: client denied by server configuration: proxy:http://localhost:13378/google-services.json ... show less	Brute-Force
🇺🇸 TPI-Abuse	2026-06-12 23:25:40 (17 hours ago)	(mod_security) mod_security (id:210492) triggered by 89.116.72.9 (-): 1 in the last 300 secs; Ports: ... show more (mod_security) mod_security (id:210492) triggered by 89.116.72.9 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jun 12 19:25:32.914214 2026] [security2:error] [pid 30913:tid 30913] [client 89.116.72.9:54402] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "newbook.flyingdodopublications.com"] [uri "/.env.example"] [unique_id "aiyVbKqn3ASfAF6BEGN6hgAAAAE"] show less	Brute-Force Bad Web Bot Web App Attack
🇳🇱 e.fierstra	2026-06-12 22:52:22 (18 hours ago)	ModSecurity hits exceeded	Bad Web Bot Web App Attack
🇳🇱 homeshowdomain.nl	2026-06-12 21:59:55 (19 hours ago)	Auto-ban: >3000 req/min op 2026-06-12	Web App Attack SSH Hacking
🇧🇪 cmbplf	2026-06-12 21:47:50 (19 hours ago)	177 requests with url.path *.env	Brute-Force Bad Web Bot
🇬🇧 Aetherweb Ark	2026-06-12 20:38:12 (20 hours ago)	(mod_security) mod_security (id:949110) triggered by 89.116.72.9 (DE/Germany/-): N in the last X sec ... show more (mod_security) mod_security (id:949110) triggered by 89.116.72.9 (DE/Germany/-): N in the last X secs show less	Web App Attack
Anonymous	2026-06-12 20:36:12 (20 hours ago)	PSCSERV WPSCAN 89.116.72.9	Bad Web Bot Web App Attack
🇨🇭 Origon	2026-06-12 19:41:48 (21 hours ago)	http-sensitive-files - IP: 89.116.72.9 - time="2026-06-12T21:41:47+02:00" level=info msg="(555f66b4 ... show more http-sensitive-files - IP: 89.116.72.9 - time="2026-06-12T21:41:47+02:00" level=info msg="(555f66b4f6a74558bc11e3f93469658es8App0Mcc0TKEeje/crowdsec) crowdsecurity/http-sensitive-files by ip 89.116.72.9 (DE/46475) : 4h ban on Ip 89.116.72.9" module=db show less	Web App Attack
🇨🇭 zynex	2026-06-12 18:16:50 (22 hours ago)	URL Probing: /.env	Web App Attack

Showing 1 to 15 of 32 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇺🇸 198.46.253.100

🇸🇪 171.25.193.36

🇦🇹 152.53.3.237

🇺🇸 103.234.62.54

🇻🇳 103.1.210.25

🇧🇬 91.92.199.36

🇳🇱 86.54.31.44

🇽🇰 84.22.62.247

🇩🇪 69.5.169.178

🇮🇪 63.35.186.179

🇰🇷 59.24.133.197

🇫🇷 51.91.252.38

🇯🇵 43.167.10.243

🇩🇪 34.159.41.123

🇬🇧 193.163.125.149

🇺🇸 172.182.212.3

🇮🇳 125.23.183.18

🇩🇪 51.102.214.83

🇨🇳 14.29.196.194

🇩🇪 185.242.3.226