JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 89.155.199.81

89.155.199.81 was found in our database!

This IP was reported 22 times. Confidence of Abuse is 75%: ?

75%

ISP	NOS COMUNICACOES S.A.
Usage Type	Mobile ISP
ASN	AS2860
Hostname(s)	a89-155-199-81.cpe.netcabo.pt
Domain Name	nos.pt
Country	🇵🇹 Portugal
City	Guimaraes, Braga

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 89.155.199.81

Whois 89.155.199.81

IP Abuse Reports for 89.155.199.81:

This IP address has been reported a total of 22 times from 20 distinct sources. 89.155.199.81 was first reported on June 12th 2026, and the most recent report was 1 hour ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇩🇪 pltcldvlpr	2026-07-23 16:43:57 (1 hour ago)	CMS/framework probe: 89.155.199.81 - - [23/Jul/2026:18:43:57 +0200] "POST /xmlrpc.php HTTP/1.1" 404 ... show more CMS/framework probe: 89.155.199.81 - - [23/Jul/2026:18:43:57 +0200] "POST /xmlrpc.php HTTP/1.1" 404 162 "-" "Mozilla/5.0 (Linux; Android 10; arm64) AppleWebKit/537.36 (KHTML, like Gecko) Edge/81.0.0.0 Safari/537.36" asn=2860 org="NOS COMUNICACOES, S.A." country=PT ... show less	Web App Attack
🇺🇸 IndigoRidge	2026-07-23 11:11:49 (7 hours ago)	89.155.199.81 - - [23/Jul/2026:07:10:26 -0400] "POST /xmlrpc.php HTTP/1.0" 200 5229 "-" "Mozilla/5.0 ... show more 89.155.199.81 - - [23/Jul/2026:07:10:26 -0400] "POST /xmlrpc.php HTTP/1.0" 200 5229 "-" "Mozilla/5.0 (Linux; Android 10; x86) AppleWebKit/537.36 (KHTML, like Gecko) Opera/69.0.0.0 Safari/537.36" 89.155.199.81 - - [23/Jul/2026:07:10:46 -0400] "POST /xmlrpc.php HTTP/1.0" 200 5213 "-" "Mozilla/5.0 (Windows NT 6.3; arm64) AppleWebKit/537.36 (KHTML, like Gecko) Opera/63.0.0.0 Safari/537.36" 89.155.199.81 - - [23/Jul/2026:07:11:06 -0400] "POST /xmlrpc.php HTTP/1.0" 200 5213 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; arm64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.0.0 Safari/537.36" 89.155.199.81 - - [23/Jul/2026:07:11:28 -0400] "POST /xmlrpc.php HTTP/1.0" 200 5245 "-" "Mozilla/5.0 (Windows NT 6.3; x86) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.0.0 Safari/537.36" 89.155.199.81 - - [23/Jul/2026:07:11:48 -0400] "POST /xmlrpc.php HTTP/1.0" 200 5229 "-" "Mozilla/5.0 (Windows NT 6.2; arm64) AppleWebKit/537.36 (KHTML, like Gecko) Opera/80.0.0.0 Safari/537.36" ... show less	Web App Attack
🇳🇴 jad-abuse	2026-07-22 14:16:27 (1 day ago)	ActiveDefense automated detection: malicious HTTP scanning / exploit attempts. Signatures: xmlrpc. O ... show more ActiveDefense automated detection: malicious HTTP scanning / exploit attempts. Signatures: xmlrpc. Observed by 1 sensor(s); 1 hits. show less	Brute-Force Web App Attack
🇮🇹 ciccio diddo	2026-07-21 06:41:20 (2 days ago)	CMS/WP Exploit xmlrpc port:Tcp/80,443	Brute-Force Web App Attack
🇳🇱 MM-bot	2026-07-20 23:28:52 (2 days ago)	URL-probe: HTTP/1.1 POST request on /xmlrpc.php (2026-07-21 01:28:52 UTC+2)	Web App Attack Hacking
🇺🇸 TPI-Abuse	2026-07-20 21:28:37 (2 days ago)	(mod_security) mod_security (id:225170) triggered by 89.155.199.81 (a89-155-199-81.cpe.netcabo.pt): ... show more (mod_security) mod_security (id:225170) triggered by 89.155.199.81 (a89-155-199-81.cpe.netcabo.pt): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jul 20 17:28:33.920940 2026] [security2:error] [pid 19411:tid 19411] [client 89.155.199.81:49607] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)\|\|montidaunitour.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "montidaunitour.com"] [uri "/wp-json/wp/v2/users"] [unique_id "al6TAVToz1WKGOQEBKMIBgAAAAI"] show less	Brute-Force Bad Web Bot Web App Attack
Anonymous	2026-07-20 17:45:43 (3 days ago)	Web attack blocked by Wordfence on gedichtenlangsdegeul.nl (1 hit). Reported by CRMON.	Web App Attack
🇩🇪 stinpriza	2026-07-20 16:42:29 (3 days ago)	Web App Attack	Web App Attack
🇭🇺 bcsaba	2026-07-20 15:29:40 (3 days ago)	Repeated request on blocked xmlrpc.php. 89.155.199.81 - - [20/Jul/2026:17:29:37 +0200] "POST /xmlrpc ... show more Repeated request on blocked xmlrpc.php. 89.155.199.81 - - [20/Jul/2026:17:29:37 +0200] "POST /xmlrpc.php HTTP/1.1" 403 146 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Safari/10.0.0.0 Safari/537.36" show less	Web App Attack
🇺🇸 ipblock.com	2026-07-16 10:41:00 (1 week ago)	IPBlock protected site ID [3390-wh]. Exploit request, vulnerability scanner.	Hacking Bad Web Bot Web App Attack
🇦🇺 screwlooseit.com.au	2026-06-26 12:31:49 (3 weeks ago)	Blocked by CSF 13 firewall - Rule: XMLRPC PT/Portugal/a89-155-199-81.cpe.netcabo.pt	Web App Attack
🇩🇪 IVski	2026-06-26 11:24:40 (3 weeks ago)	IVski WAF \| WordPress scanner detected - probing wp-content, xmlrpc or wp-login	Port Scan Brute-Force Web App Attack
🇺🇸 TPI-Abuse	2026-06-26 08:56:28 (3 weeks ago)	(mod_security) mod_security (id:225170) triggered by 89.155.199.81 (a89-155-199-81.cpe.netcabo.pt): ... show more (mod_security) mod_security (id:225170) triggered by 89.155.199.81 (a89-155-199-81.cpe.netcabo.pt): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jun 26 04:56:22.470174 2026] [security2:error] [pid 13438:tid 13438] [client 89.155.199.81:52011] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)\|\|epetsure.co\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "epetsure.co"] [uri "/wp-json/wp/v2/users"] [unique_id "aj4-tiBJ0DqRWvbGumNseQAAAAA"] show less	Brute-Force Bad Web Bot Web App Attack
🇫🇮 inlink.ltd	2026-06-22 11:50:33 (1 month ago)	Known malicious PHP file or CMS probe	Web App Attack
🇳🇱 wlt-blocker	2026-06-17 12:14:43 (1 month ago)	Unauthorized access to webpage admin	Web App Attack

Showing 1 to 15 of 22 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇷🇺 185.204.0.201

🇳🇱 185.180.109.243

🇨🇳 171.8.138.123

🇧🇩 103.48.160.90

🇩🇪 43.228.157.9

🇧🇴 181.115.171.216

🇻🇳 115.78.231.175

🇫🇷 91.196.152.181

🇺🇸 40.124.175.29

🇺🇸 34.187.192.63

🇬🇧 34.105.181.124

🇺🇸 195.184.76.95

🇯🇵 156.227.232.24

🇸🇬 152.42.164.200

🇺🇿 144.124.192.49

🇧🇯 137.255.13.37

🇨🇳 122.243.177.250

🇲🇲 103.59.163.133

🇷🇺 95.165.140.133

🇫🇷 91.196.152.177