JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 89.248.163.136

89.248.163.136 was found in our database!

This IP was reported 622 times. Confidence of Abuse is 0%: ?

ISP	RECYBER PROJECT NETBLOCK
Usage Type	Data Center/Web Hosting/Transit
ASN	AS202425
Hostname(s)	recyber.net
Domain Name	recyber.net
Country	🇳🇱 Netherlands
City	Amsterdam, North Holland

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 89.248.163.136

Whois 89.248.163.136

IP Abuse Reports for 89.248.163.136:

This IP address has been reported a total of 622 times from 112 distinct sources. 89.248.163.136 was first reported on December 20th 2021, and the most recent report was 7 months ago.

Old Reports: The most recent abuse report for this IP address is from 7 months ago . It is possible that this IP is no longer involved in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇺🇸 TPI-Abuse	2026-01-10 05:15:24 (7 months ago)	(mod_security) mod_security (id:218420) triggered by 89.248.163.136 (recyber.net): 1 in the last 300 ... show more (mod_security) mod_security (id:218420) triggered by 89.248.163.136 (recyber.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Jan 10 00:15:19.870380 2026] [security2:error] [pid 9973:tid 9973] [client 89.248.163.136:47778] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i)php://(std(in\|out\|err)\|(in\|out)put\|fd\|memory\|temp\|filter)" at ARGS_NAMES:-d allow_url_include=on -d auto_prepend_file=php://input. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/21_PHP_PHPGen.conf"] [line "22"] [id "218420"] [rev "2"] [msg "COMODO WAF: PHP Injection Attack: I/O Stream Found\|\|mail.regal.com.tr\|F\|2"] [data "Matched Data: php://input found within ARGS_NAMES:-d allow_url_include=on -d auto_prepend_file=php://input: -d allow_url_include=on -d auto_prepend_file=php://input"] [severity "CRITICAL"] [tag "CWAF"] [tag "PHPGen"] [hostname "mail.regal.com.tr"] [uri "/index.php"] [unique_id "aWHgZ_22ao7YOeIfaRQQgwAAAAg"] show less	Brute-Force Bad Web Bot Web App Attack
Anonymous	2026-01-06 10:31:00 (7 months ago)	event_name:Illegal Resource Access event_result:REQ_BLOCKED_SECURITY source_ip:89.248.163.136	Brute-Force
🇺🇸 oralunal	2026-01-03 08:58:53 (7 months ago)	IP banned by Fail2Ban in jail ente-suss ente.com-ssl_log mvfnds ...	Bad Web Bot Web App Attack
🇹🇷 hostopya.com	2025-12-29 12:45:40 (8 months ago)	AUTOMATED REPORT: Odd Request, trying to access some sort of form: /GponForm/diag_Form?images/	Hacking
🇺🇸 TPI-Abuse	2025-12-21 00:26:14 (8 months ago)	(mod_security) mod_security (id:221260) triggered by 89.248.163.136 (recyber.net): 1 in the last 300 ... show more (mod_security) mod_security (id:221260) triggered by 89.248.163.136 (recyber.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Dec 20 19:25:41.352142 2025] [security2:error] [pid 24910:tid 24910] [client 89.248.163.136:32800] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^(?:\\\\'\\\\w+?=)?\\\$\\\$\\\\s{" at MATCHED_VAR. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "77"] [id "221260"] [rev "3"] [msg "COMODO WAF: Shellshock Command Injection Vulnerabilities in GNU Bash through 4.3 bash43-026 (CVE-2014-7187, CVE-2014-7186, CVE-2014-7169, CVE-2014-6278, CVE-2014-6277, CVE-2014-6271)\|\|www.blog.istanbulartlist.com.pist.org.tr\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.blog.istanbulartlist.com.pist.org.tr"] [uri "/cgi-bin/test-cgi"] [unique_id "aUc-hWqC_mNA7mu9dwOF7QAAAAs"], referer: () { ignored; }; echo Content-Type: text/html; echo ; /bin/cat /etc/passwd show less	Brute-Force Bad Web Bot Web App Attack
🇧🇪 cmbplf	2025-11-20 07:30:05 (9 months ago)	4327 limiting connections by zone (1yr10mos3w)	DDoS Attack
Anonymous	2025-11-01 07:15:43 (10 months ago)	[redacted] 89.248.163.136 - - [01/Nov/2025:08:15:38 +0100] "GET /admin/?n=language&c=language_genera ... show more [redacted] 89.248.163.136 - - [01/Nov/2025:08:15:38 +0100] "GET /admin/?n=language&c=language_general&a=doExportPack HTTP/1.1" 404 196 "http://arbodomo.de/admin/?n=language&c=language_general&a=doExportPack" "Mozilla/5.0 (Debian; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36" [redacted] 89.248.163.136 - - [01/Nov/2025:08:15:38 +0100] "GET /adminer/index.php HTTP/1.1" 404 196 "http://arbodomo.de/adminer/index.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:137.0) Gecko/20100101 Firefox/137.0" [redacted] 89.248.163.136 - - [01/Nov/2025:08:15:38 +0100] "GET /adminer/adminer.php HTTP/1.1" 404 196 "http://arbodomo.de/adminer/adminer.php" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36" [redacted] 89.248.163.136 - - [01/Nov/2025:08:15:39 +0100] "GET /admin/ajax.php?action=login HTTP/1.1" 404 196 "http://arbodomo.de/admin/ajax.php?action=login" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_ ... show less	Hacking Web App Attack
🇩🇪 Bigbear3	2025-10-31 20:05:14 (10 months ago)	Report-by-bigbear3	Brute-Force SSH
🇩🇪 Marc	2025-10-31 10:36:23 (10 months ago)		FTP Brute-Force Brute-Force
Anonymous	2025-10-30 23:33:58 (10 months ago)	Fail2Ban - FTP server attack ...	FTP Brute-Force Hacking Brute-Force
🇩🇪 triple-web.net	2025-10-30 11:57:54 (10 months ago)	$f2bV_matches	Brute-Force
Anonymous	2025-10-30 11:54:08 (10 months ago)	[redacted] 89.248.163.136 - - [30/Oct/2025:12:54:04 +0100] "GET /admin/?n=language&c=language_genera ... show more [redacted] 89.248.163.136 - - [30/Oct/2025:12:54:04 +0100] "GET /admin/?n=language&c=language_general&a=doExportPack HTTP/1.1" 404 196 "http://[redacted]/admin/?n=language&c=language_general&a=doExportPack" "Mozilla/5.0 (Debian; Linux i686; rv:131.0) Gecko/20100101 Firefox/131.0" [redacted] 89.248.163.136 - - [30/Oct/2025:12:54:05 +0100] "GET /adminer/index.php HTTP/1.1" 404 196 "http://[redacted]/adminer/index.php" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_0) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.0 Safari/605.1.15" [redacted] 89.248.163.136 - - [30/Oct/2025:12:54:05 +0100] "GET /adminer/adminer.php HTTP/1.1" 404 196 "http://[redacted]/adminer/adminer.php" "Mozilla/5.0 (Knoppix; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" [redacted] 89.248.163.136 - - [30/Oct/2025:12:54:05 +0100] "GET /admin/ajax.php?action=login HTTP/1.1" 404 196 "http://[redacted]/admin/ajax.php?action=login" "Mozilla/5 ... show less	Hacking Web App Attack
🇳🇱 maxxsense	2025-10-29 23:28:35 (10 months ago)	(ftpd) Failed FTP login from 89.248.163.136 (NL/The Netherlands/recyber.net)	FTP Brute-Force Brute-Force
Anonymous	2025-10-29 03:51:53 (10 months ago)	[redacted] 89.248.163.136 - - [29/Oct/2025:04:51:52 +0100] "POST /wp-admin/admin-ajax.php HTTP/1.1" ... show more [redacted] 89.248.163.136 - - [29/Oct/2025:04:51:52 +0100] "POST /wp-admin/admin-ajax.php HTTP/1.1" 404 196 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_6) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/13.1.2 Safari/605.1.15" [redacted] 89.248.163.136 - - [29/Oct/2025:04:51:52 +0100] "GET /wp-admin/admin-ajax.php?action=f1c14ba93ba4b24aa53bfd4777b0f1f3 HTTP/1.1" 404 196 "-" "Mozilla/5.0 (Mac OS X 13_2) AppleWebKit/537.36 (KHTML, like Gecko) Edge/101.0 Safari/537.36" [redacted] 89.248.163.136 - - [29/Oct/2025:04:51:51 +0100] "POST /wp-admin/admin-ajax.php HTTP/1.1" 404 196 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_5) AppleWebKit/601.4.4 (KHTML, like Gecko) Version/9.0.3 Safari/537.86.4" [redacted] 89.248.163.136 - - [29/Oct/2025:04:51:52 +0100] "POST /lucee/admin/imgProcess.cfm?file=/whatever HTTP/1.1" 404 196 "-" "Mozilla/5.0 (Debian; Linux i686; rv:120.0) Gecko/20100101 Firefox/120.0" [redacted] 89.248.163.136 - - [29/Oct/2025:04:51:52 ... show less	Hacking Web App Attack
🇹🇷 rtbh.com.tr	2025-10-28 20:09:37 (10 months ago)	list.rtbh.com.tr report: tcp/0	Brute-Force

Showing 1 to 15 of 622 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇺🇸 174.68.48.77

🇨🇳 112.91.139.223

🇺🇸 205.210.31.39

🇩🇪 152.233.51.73

🇨🇳 111.42.60.82

🇮🇳 103.160.26.219

🇺🇸 23.230.234.220

🇮🇷 2.180.7.125

🇸🇪 213.66.197.199

🇺🇸 204.152.192.51

🇮🇹 151.84.165.175

🇺🇸 144.225.6.161

🇨🇳 111.35.7.46

🇧🇩 103.60.205.60

🇷🇺 95.213.237.87

🇳🇱 94.154.43.118

🇨🇳 59.60.100.158

🇺🇸 45.194.67.45

🇩🇪 45.135.193.204

🇬🇧 45.133.173.186