JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 89.163.154.149

89.163.154.149 was found in our database!

This IP was reported 41 times. Confidence of Abuse is 100%: ?

100%

ISP	WIIT AG
Usage Type	Data Center/Web Hosting/Transit
ASN	AS24961
Hostname(s)	srv20934.dus7.dedicated.server-hosting.expert
Domain Name	wiit.cloud
Country	🇩🇪 Germany
City	Koln, North Rhine-Westphalia

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 89.163.154.149

Whois 89.163.154.149

IP Abuse Reports for 89.163.154.149:

This IP address has been reported a total of 41 times from 36 distinct sources. 89.163.154.149 was first reported on February 3rd 2025, and the most recent report was 14 hours ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇭🇺 miszterx.hu	2026-09-16 08:47:26 (14 hours ago)	XORP (mailcow netfilter): 3x fail2ban matched-rule bans in 24h. Automated report from log_check_ipta ... show more XORP (mailcow netfilter): 3x fail2ban matched-rule bans in 24h. Automated report from log_check_iptables_generator.sh (xorp.hu) show less	Brute-Force SSH
🇳🇱 wlt-blocker	2026-09-16 07:18:50 (15 hours ago)	Attempts to login to mail server with wrong username and/or password	Brute-Force
🇨🇿 interconnect.cz	2026-09-16 07:16:28 (15 hours ago)	[16/Sep/2026 09:16:28] Connection attempt to service IMAP from IP address 89.163.154.149 rejected: a ... show more [16/Sep/2026 09:16:28] Connection attempt to service IMAP from IP address 89.163.154.149 rejected: access from this IP address is not allowed ... show less	Brute-Force Email Spam
🇩🇪 kreativstrecke	2026-09-16 07:04:57 (16 hours ago)	2026-09-16T09:04:55.622708+02:00 srv03 postfix/submission/smtpd[2616283]: lost connection after CONN ... show more 2026-09-16T09:04:55.622708+02:00 srv03 postfix/submission/smtpd[2616283]: lost connection after CONNECT from unknown[89.163.154.149] 2026-09-16T09:04:55.658608+02:00 srv03 postfix/submission/smtpd[2616283]: lost connection after CONNECT from unknown[89.163.154.149] 2026-09-16T09:04:55.747855+02:00 srv03 postfix/smtps/smtpd[2616204]: lost connection after CONNECT from unknown[89.163.154.149] ... show less	Brute-Force
Anonymous	2026-09-16 06:58:53 (16 hours ago)	...	Web App Attack
🇸🇬 pusathosting.com	2026-09-16 06:50:08 (16 hours ago)	imap1 failed login	Brute-Force
🇭🇺 Lacika555	2026-09-16 06:48:47 (16 hours ago)	RdpGuard detected brute-force attempt on SMTP	Brute-Force
🇧🇬 sanitariu	2026-09-16 06:34:28 (16 hours ago)	Sep 16 09:34:27 dri postfix/smtpd[1005707]: warning: unknown[89.163.154.149]: SASL PLAIN authenticat ... show more Sep 16 09:34:27 dri postfix/smtpd[1005707]: warning: unknown[89.163.154.149]: SASL PLAIN authentication failed: (reason unavailable), sasl_username=nasko ... show less	Brute-Force
🇩🇪 celltek	2026-09-16 06:30:02 (16 hours ago)	POP or IMAP failed login attempts detected	Brute-Force
🇨🇿 Countryman	2026-09-16 06:29:12 (16 hours ago)	2026-09-16T08:22:03.380979 orbis.img.cas.cz dovecot[3910999]: imap-login: Disconnected: Connection c ... show more 2026-09-16T08:22:03.380979 orbis.img.cas.cz dovecot[3910999]: imap-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<macurek>, method=PLAIN, rip=89.163.154.149, lip=147.231.150.3, TLS: Connection closed, session=<8nZur5NbDGxZo5qV> 2026-09-16T08:24:21.492860 orbis.img.cas.cz dovecot[3910999]: imap-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<marie.radova>, method=PLAIN, rip=89.163.154.149, lip=147.231.150.3, TLS: Connection closed, session=<NO2pt5NbruFZo5qV> 2026-09-16T08:24:21.492860 orbis.img.cas.cz dovecot[3910999]: imap-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<marie.radova>, method=PLAIN, rip=89.163.154.149, lip=147.231.150.3, TLS: Connection closed, session=<NO2pt5NbruFZo5qV> 2026-09-16T08:29:11.261177 orbis.img.cas.cz dovecot[3910999]: imap-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<michal.svestka>, method=PLAIN, rip=89.163.154.149, l ... show less	Brute-Force
🇦🇺 electronico	2026-09-16 06:27:53 (16 hours ago)	2026-09-16T17:27:48.639446+11:00 mail1 dovecot: imap-login: Disconnected: Connection closed (auth fa ... show more 2026-09-16T17:27:48.639446+11:00 mail1 dovecot: imap-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<[email protected]>, method=PLAIN, rip=89.163.154.149, lip=51.161.209.102, TLS: Connection closed, session=<2Cn2w5Nb8CBZo5qV> 2026-09-16T17:27:52.653971+11:00 mail1 dovecot: imap-login: Disconnected: Connection closed (auth failed, 1 attempts in 6 secs): user=<[email protected]>, method=PLAIN, rip=89.163.154.149, lip=51.161.209.102, TLS: Connection closed, session=<TFn2w5NbUCFZo5qV> 2026-09-16T17:27:52.654260+11:00 mail1 dovecot: imap-login: Disconnected: Connection closed (auth failed, 1 attempts in 6 secs): user=<[email protected]>, method=PLAIN, rip=89.163.154.149, lip=51.161.209.102, TLS: Connection closed, session=<1CT3w5NbziFZo5qV> ... show less	Brute-Force Email Spam
🇨🇿 lp	2026-09-16 06:20:39 (16 hours ago)	Email account brute force: 34 attempts were recorded from 89.163.154.149 2026-09-16T06:44:17+02:00 w ... show more Email account brute force: 34 attempts were recorded from 89.163.154.149 2026-09-16T06:44:17+02:00 warning: unknown[89.163.154.149]: SASL PLAIN authentication failed: authentication failure, [email protected] 2026-09-16T06:44:17+02:00 warning: unknown[89.163.154.149]: SASL LOGIN authentication failed: authentication failure, [email protected] 2026-09-16T06:47:20+02:00 warning: unknown[89.163.154.149]: SASL PLAIN authentication failed: authentication failure, [email protected] 2026-09-16T06:47:20+02:00 warning: unknown[89.163.154.149]: SASL LOGIN authentication failed: authentication failure, [email protected] 2026-09-16T06:48:24+02:00 warning: unknown[89.163.154.149]: SASL PLAIN authentication failed: authentication failure, [email protected] 2026-09-16T06:48:24+02:00 warning: unknown[89.163.154.149]: SASL LOGIN authentication failed: authe show less	Brute-Force
🇮🇩 aaKenshin	2026-09-16 06:17:35 (16 hours ago)	Suspicious activity detected from IP 89.163.154.149 based on mailserver logs. Sample logs: 2026-09-1 ... show more Suspicious activity detected from IP 89.163.154.149 based on mailserver logs. Sample logs: 2026-09-16 14:17:30,967 INFO [ImapServer-20869] [ip=172.16.0.182;oip=89.163.154.149;via=172.16.0.182(nginx/1.24.0);ua=Zimbra/24.9.7_ZEXTRAS_202410;cid=25384;] account - Error occurred during authentication: authentication failed for []. Reason: LDAP error: - unable to ldap authenticate: invalid credentials. 2026-09-16 14:17:30,967 INFO [ImapServer-20869] [ip=172.16.0.182;oip=89.163.154.149;via=172.16.0.182(nginx/1.24.0);ua=Zimbra/24.9.7_ZEXTRAS_202410;cid=25384;] imap - LOGIN elapsed=103 (NIO) 2026-09-16 14:17:31,072 INFO [ImapServer-20870] [ip=172.16.0.182;oip=89.163.154.149;via=172.16.0.182(nginx/1.24.0);ua=Zimbra/24.9.7_ZEXTRAS_202410;cid=25385;] imap - authentication failed for [] (LDAP error: - unable to ldap authenticate: invalid credentials) 2026-09-16 14:17:31,072 INFO [ImapServer-20870] [ip=172.16.0.182;oip=89.163.154.149;via=172.16.0.182(nginx/1.24.0);ua=Zimbra/24.9.7_ZEXTRAS_ show less	Brute-Force
🇩🇪 tvnl.eu	2026-09-16 06:16:45 (16 hours ago)	Banned by fail2ban on <hostname> for jail dovecot. Attempts: 5	Brute-Force
🇨🇿 interconnect.cz	2026-09-16 06:12:52 (17 hours ago)	[16/Sep/2026 08:12:51] Connection attempt to service IMAP from IP address 89.163.154.149 rejected: a ... show more [16/Sep/2026 08:12:51] Connection attempt to service IMAP from IP address 89.163.154.149 rejected: access from this IP address is not allowed [16/Sep/2026 08:12:52] Connection attempt to service IMAP from IP address 89.163.154.149 rejected: access from this IP address is not allowed ... show less	Brute-Force Email Spam

Showing 1 to 15 of 41 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇺🇸 216.87.32.78

🇰🇷 211.116.216.114

🇩🇪 167.94.146.69

🇷🇴 45.92.33.82

🇹🇼 34.80.101.149

🇳🇱 192.42.116.112

🇮🇳 182.74.3.250

🇩🇪 167.94.146.68

🇩🇪 167.94.146.67

🇳🇱 160.119.76.138

🇮🇳 118.95.33.69

🇩🇪 109.71.252.97

🇨🇩 102.223.209.43

🇵🇪 200.4.228.242

🇺🇸 198.74.58.130

🇬🇧 185.247.137.118

🇳🇱 185.223.235.37

🇩🇪 167.94.146.64

🇩🇪 167.94.146.51

🇺🇸 147.185.132.115