JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 89.149.52.94

89.149.52.94 was found in our database!

This IP was reported 61 times. Confidence of Abuse is 0%: ?

ISP	Binbox Global Services
Usage Type	Fixed Line ISP
ASN	AS3257
Domain Name	binbox.com
Country	🇨🇦 Canada
City	Vancouver, British Columbia

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 89.149.52.94

Whois 89.149.52.94

IP Abuse Reports for 89.149.52.94:

This IP address has been reported a total of 61 times from 49 distinct sources. 89.149.52.94 was first reported on October 16th 2025, and the most recent report was 1 month ago.

Old Reports: The most recent abuse report for this IP address is from 1 month ago . It is possible that this IP is no longer involved in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇧🇷 chronos	2026-05-03 00:05:26 (1 month ago)	Generic malicious activity: Tentativa de varredura de porta TCP... \| Port: 59601 \| Proto: TCP \| Loca ... show more Generic malicious activity: Tentativa de varredura de porta TCP... \| Port: 59601 \| Proto: TCP \| Location: Canada, Vancouver show less	Port Scan Hacking
🇳🇱 homeshowdomain.nl	2025-10-18 21:59:10 (8 months ago)	Auto-ban: single probe for restricted files (.env / backups / admin endpoints). Likely mass-scan on ... show more Auto-ban: single probe for restricted files (.env / backups / admin endpoints). Likely mass-scan on 2025-10-17. show less	Hacking Web App Attack SSH
🇳🇱 BlueWire Hosting	2025-10-18 04:10:16 (8 months ago)	Probing for application vulnerabilities	Brute-Force Web App Attack
🇺🇸 mnsf	2025-10-18 03:05:32 (8 months ago)	Too many Status 40X (41)	Brute-Force Web App Attack
Anonymous	2025-10-18 02:55:11 (8 months ago)	SuspiciousC2 Activity detected by FMBAD System 2025-10-18 05:55:11	Hacking Bad Web Bot Web App Attack
🇺🇸 S.O.B.A. Dev.	2025-10-18 02:40:27 (8 months ago)	Threat Blocked by BeeHive from (ASN:3257) (Network:GTT-BACKBONE GTT) (Host:soba.dev) (Method:GET) (P ... show more Threat Blocked by BeeHive from (ASN:3257) (Network:GTT-BACKBONE GTT) (Host:soba.dev) (Method:GET) (Protocol:HTTP/1.1) (Timestamp:2025-10-18T02:40:27Z) show less	Web Spam Brute-Force Web App Attack
🇧🇪 taivas.nl	2025-10-18 02:02:12 (8 months ago)	Site scraper	Web App Attack
🇺🇸 TPI-Abuse	2025-10-18 01:53:20 (8 months ago)	(mod_security) mod_security (id:210492) triggered by 89.149.52.94 (-): 1 in the last 300 secs; Ports ... show more (mod_security) mod_security (id:210492) triggered by 89.149.52.94 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 17 21:53:12.515220 2025] [security2:error] [pid 3148:tid 3148] [client 89.149.52.94:0] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "hvacs-aircon.com"] [uri "/.env"] [unique_id "aPLzCIzYI6h3PSnHK21y_gAAAA0"] show less	Brute-Force Bad Web Bot Web App Attack
🇬🇧 [email protected]	2025-10-18 01:06:56 (8 months ago)	...	Brute-Force SSH
🇺🇸 TPI-Abuse	2025-10-18 01:01:40 (8 months ago)	(mod_security) mod_security (id:210492) triggered by 89.149.52.94 (-): 1 in the last 300 secs; Ports ... show more (mod_security) mod_security (id:210492) triggered by 89.149.52.94 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 17 21:01:33.747499 2025] [security2:error] [pid 8034:tid 8034] [client 89.149.52.94:0] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "ard.global"] [uri "/.env"] [unique_id "aPLm7Rf7Npwk9LAMIQR8OAAAABM"] show less	Brute-Force Bad Web Bot Web App Attack
🇨🇭 backslash	2025-10-18 00:10:52 (8 months ago)	block ruleset WAF detection and high score on abuseIPDB 149EB1B42C242111FADBBC2EF8F90219570691E1	Bad Web Bot
🇩🇪 updown.io	2025-10-17 23:24:46 (8 months ago)	{"level":"info","ts":1760740320.4553447,"logger":"http.log.access.log1","msg":"handled request","req ... show more {"level":"info","ts":1760740320.4553447,"logger":"http.log.access.log1","msg":"handled request","request":{"remote_ip":"89.149.52.94","remote_port":"49054","client_ip":"89.149.52.94","proto":"HTTP/1.1","method":"GET","host":"status.nerdpol.ch","uri":"/.env","headers":{"Accept-Encoding":["gzip, deflate"],"Accept":["/"],"Connection":["keep-alive"],"User-Agent":["Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:77.0) Gecko/20100101 Firefox/77.0"]}},"bytes_read":0,"user_id":"","duration":0.000100219,"size":0,"status":308,"resp_headers":{"Server":["Caddy"],"Connection":["close"],"Location":["https://status.nerdpol.ch/.env"],"Content-Type":[]}} {"level":"info","ts":1760740355.9893656,"logger":"http.log.access.log1","msg":"handled request","request":{"remote_ip":"89.149.52.94","remote_port":"54680","client_ip":"89.149.52.94","proto":"HTTP/1.1","method":"GET","host":"status.tildeverse.net","uri":"/.env","headers":{"Connection":["keep-alive"],"User-Agent":["Mozilla/5.0 (Macintosh; Intel Mac O ... show less	DDoS Attack Web App Attack
🇱🇻 garmtech.com	2025-10-17 23:05:14 (8 months ago)	Attempted access to sensitive endpoint (/.env) detected. Automated scan or unauthorized probing.	Web App Attack
🇺🇸 TPI-Abuse	2025-10-17 22:52:00 (8 months ago)	(mod_security) mod_security (id:210492) triggered by 89.149.52.94 (-): 1 in the last 300 secs; Ports ... show more (mod_security) mod_security (id:210492) triggered by 89.149.52.94 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 17 18:51:51.413499 2025] [security2:error] [pid 6432:tid 6432] [client 89.149.52.94:0] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "upskirtcrazy.com"] [uri "/.env"] [unique_id "aPLIh1wt2C7p8rfrX1C4AAAAAAc"] show less	Brute-Force Bad Web Bot Web App Attack
🇳🇱 enpepet	2025-10-17 22:34:45 (8 months ago)	GENERAL: parametres: [url:env=] UA:Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:77.0) Gecko/2010 ... show more GENERAL: parametres: [url:env=] UA:Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:77.0) Gecko/20100101 Firefox/77.0 URL:/.env show less	Port Scan Hacking Brute-Force Bad Web Bot

Showing 1 to 15 of 61 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇩🇪 2a01:4f8:271:2ad1::2

252.167.110.142

🇦🇺 170.64.130.197

🇭🇰 165.154.40.205

🇷🇴 141.98.83.240

🇺🇸 137.27.32.70

🇳🇱 34.13.201.9

🇮🇳 14.102.66.195

🇩🇪 195.63.31.22

🇺🇸 162.216.150.177

🇺🇸 74.125.224.104

🇬🇧 35.203.211.144

🇳🇱 176.65.139.105

🇺🇸 162.216.150.107

🇺🇸 162.216.149.124

🇺🇸 162.216.149.24

🇨🇳 112.53.123.118

🇹🇼 110.25.112.151

🇧🇬 79.124.40.110

🇱🇹 62.60.130.219