JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 89.163.152.203

89.163.152.203 was found in our database!

This IP was reported 89 times. Confidence of Abuse is 100%: ?

100%

ISP	WIIT AG
Usage Type	Data Center/Web Hosting/Transit
ASN	AS24961
Hostname(s)	vps2647517.fastwebserver.de
Domain Name	wiit.cloud
Country	🇩🇪 Germany
City	Essen, North Rhine-Westphalia

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 89.163.152.203

Whois 89.163.152.203

IP Abuse Reports for 89.163.152.203:

This IP address has been reported a total of 89 times from 64 distinct sources. 89.163.152.203 was first reported on April 30th 2026, and the most recent report was 4 hours ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇩🇪 Mr-Money	2026-07-10 19:16:35 (4 hours ago)	89.163.152.203 - - [10/Jul/2026:21:16:34 +0200] "GET /.env HTTP/1.1" 404 381 "-" "Mozilla/5.0 (Windo ... show more 89.163.152.203 - - [10/Jul/2026:21:16:34 +0200] "GET /.env HTTP/1.1" 404 381 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, Gecko) Chrome/120.0.0.0 Safari/537.36" ... show less	Hacking SQL Injection Bad Web Bot Exploited Host Web App Attack
🇩🇪 Tsumugi Kotobuki	2026-07-10 19:05:56 (4 hours ago)	Port Scan on Honeypot \| Ports: 80/HTTP(2x), 8080/HTTP-proxy \| Proto: TCP(3) \| Flags: all SYN \| TTL: ... show more Port Scan on Honeypot \| Ports: 80/HTTP(2x), 8080/HTTP-proxy \| Proto: TCP(3) \| Flags: all SYN \| TTL: 53 \| Len: 60B(3x) \| Win: 64240(3) \| rDNS: vps2647517.fastwebserver.de \| F2B/ufw-honeypot@2026-07-10T19:05:56Z show less	Port Scan Hacking
🇹🇷 Threat.live	2026-07-10 18:45:03 (5 hours ago)	Suspicious Connection Attempts	Brute-Force
🇺🇸 hyena	2026-07-10 18:35:36 (5 hours ago)	Repeated mod_security events.	Web App Attack
🇺🇸 xmission.com	2026-07-10 17:36:19 (6 hours ago)	Blocked by UFW (TCP on 8080) Source port: 45611 TTL: 235 Packet length: 40 TOS: 0x00 This report (f ... show more Blocked by UFW (TCP on 8080) Source port: 45611 TTL: 235 Packet length: 40 TOS: 0x00 This report (for 89.163.152.203) was generated by: https://github.com/sefinek/UFW-AbuseIPDB-Reporter show less	Port Scan Web App Attack
🇩🇪 XICTRON	2026-07-10 17:20:03 (6 hours ago)	ModSecurity rule violation detected by Fail2Ban	Web App Attack
🇬🇧 blik2108	2026-07-10 16:51:31 (7 hours ago)	89.163.152.203 - - [10/Jul/2026:16:51:29 +0000] "GET /.env HTTP/1.1" 301 169 "-" "Mozilla/5.0 (X11; ... show more 89.163.152.203 - - [10/Jul/2026:16:51:29 +0000] "GET /.env HTTP/1.1" 301 169 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, Gecko) Chrome/119.0.0.0 Safari/537.36" "-" 89.163.152.203 - - [10/Jul/2026:16:51:29 +0000] "GET /.env HTTP/1.1" 404 8896 "http://139.59.189.208/.env" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, Gecko) Chrome/119.0.0.0 Safari/537.36" "-" 89.163.152.203 - - [10/Jul/2026:16:51:30 +0000] "GET /.env.local HTTP/1.1" 404 8902 "http://139.59.189.208/.env.local" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, Gecko) Chrome/120.0.0.0 Safari/537.36" "-" 89.163.152.203 - - [10/Jul/2026:16:51:30 +0000] "GET /.env.prod HTTP/1.1" 404 8901 "http://139.59.189.208/.env.prod" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, Gecko) Chrome/120.0.0.0 Safari/537.36" "-" 89.163.152.203 - - [10/Jul/2026:16:51:30 +0000] "GET /.env.production HTTP/1.1" 404 8907 "http://139.59.189.208/.env.production" "Mozilla/5.0 (W ... show less	Web App Attack
🇫🇮 Daniel Baer	2026-07-10 16:35:03 (7 hours ago)	CrowdSec local HTTP alert scenario: crowdsecurity/http-sensitive-files alert_id: 797 events: 5 creat ... show more CrowdSec local HTTP alert scenario: crowdsecurity/http-sensitive-files alert_id: 797 events: 5 created_at: 2026-07-10T16:33:11Z message: Ip 89.163.152.203 performed 'crowdsecurity/http-sensitive-files' (5 events over 536.249727ms) at 2026-07-10 16:33:10.689541488 +0000 UTC target_uri: ["/.env","/.env.local","/.env.prod","/.env.dev","/.env.development"] method: ["GET"] status: ["404","301"] user_agent: ["Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, Gecko) Chrome/119.0.0.0 Safari/537.36","Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, Gecko) Chrome/120.0.0.0 Safari/537.36","Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, Gecko) Versio show less	Bad Web Bot Web App Attack
🇫🇷 Lunix	2026-07-10 15:28:28 (8 hours ago)		Brute-Force Web App Attack
🇨🇭 pingusurmars	2026-07-10 15:18:25 (8 hours ago)	Blocked by UFW on ampereone [8443/tcp] Source port: 45611 TTL: 244 Packet length: 40 TOS: 0x00 This ... show more Blocked by UFW on ampereone [8443/tcp] Source port: 45611 TTL: 244 Packet length: 40 TOS: 0x00 This report was generated by: https://github.com/sefinek/UFW-AbuseIPDB-Reporter show less	Port Scan
Anonymous	2026-07-10 15:08:16 (8 hours ago)	[10/Jul/2026:18:08:16 +0300] 178369609692.620036 89.163.152.203 58414 148.251.76.218 80 [10/Jul/2026 ... show more [10/Jul/2026:18:08:16 +0300] 178369609692.620036 89.163.152.203 58414 148.251.76.218 80 [10/Jul/2026:18:08:16 +0300] 178369609660.757227 89.163.152.203 59072 148.251.76.218 443 show less	Web App Attack
🇬🇧 Andrew	2026-07-10 15:03:52 (8 hours ago)	Blocked by UFW (TCP on port 443). Source port: 45611 TTL: 244 Packet length: 40 TOS: 0x00 This repo ... show more Blocked by UFW (TCP on port 443). Source port: 45611 TTL: 244 Packet length: 40 TOS: 0x00 This report (for 89.163.152.203) was generated by: https://github.com/sefinek/UFW-AbuseIPDB-Reporter show less	Port Scan Web App Attack
🇩🇪 edena	2026-07-10 15:02:32 (8 hours ago)	89.163.152.203 - - [10/Jul/2026:17:02:32 +0200] "GET /.env HTTP/1.1" 403 303 "-" "Mozilla/5.0 (Macin ... show more 89.163.152.203 - - [10/Jul/2026:17:02:32 +0200] "GET /.env HTTP/1.1" 403 303 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, Gecko) Version/17.1 Safari/605.1.15" 89.163.152.203 - - [10/Jul/2026:17:02:32 +0200] "GET /.env.local HTTP/1.1" 403 303 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, Gecko) Version/17.1 Safari/605.1.15" 89.163.152.203 - - [10/Jul/2026:17:02:32 +0200] "GET /.env.prod HTTP/1.1" 403 303 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, Gecko) Chrome/119.0.0.0 Safari/537.36" ... show less	Web App Attack Bad Web Bot
🇩🇪 SCHAPPY	2026-07-10 14:49:04 (9 hours ago)	Malicious activity from IP detected: crowdsecurity/http-sensitive-files.	Web App Attack Hacking
🇫🇷 masterguru	2026-07-10 14:08:04 (9 hours ago)	Host header is a numeric IP address. Pattern match "^ (920350-143)	Hacking Bad Web Bot

Showing 1 to 15 of 89 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇬🇧 2a09:bac1:28a0:840::319:a8

🇰🇷 210.183.21.53

🇮🇳 171.61.18.197

🇩🇪 162.19.246.208

🇫🇮 147.185.133.176

🇪🇸 62.93.179.131

🇺🇸 20.65.194.29

🇧🇷 200.66.126.11

🇳🇱 176.65.149.180

🇨🇳 123.159.47.144

🇺🇸 107.151.202.116

🇷🇴 92.118.39.171

🇬🇧 35.203.211.152

🇮🇹 213.215.209.101

🇺🇸 172.104.11.4

🇺🇸 162.216.149.9

🇷🇺 109.61.216.96

🇧🇬 78.128.113.46

🇺🇸 35.243.229.214

🇬🇧 35.203.211.241