JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 89.249.86.28

89.249.86.28 was found in our database!

This IP was reported 61 times. Confidence of Abuse is 100%: ?

100%

ISP	Sigitas Balsevicius home provider
Usage Type	Data Center/Web Hosting/Transit
ASN	AS15440
Domain Name	balt.net
Country	🇱🇹 Lithuania
City	Vilnius, Vilnius

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 89.249.86.28

Whois 89.249.86.28

IP Abuse Reports for 89.249.86.28:

This IP address has been reported a total of 61 times from 45 distinct sources. 89.249.86.28 was first reported on August 28th 2026, and the most recent report was 5 hours ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇳🇱 homeshowdomain.nl	2026-08-31 22:02:57 (5 hours ago)	Auto-ban: single probe for restricted files (.env / backups / admin endpoints). Likely mass-scan on ... show more Auto-ban: single probe for restricted files (.env / backups / admin endpoints). Likely mass-scan on 2026-08-30. show less	Web App Attack SSH Hacking
🇺🇸 TPI-Abuse	2026-08-31 09:33:45 (17 hours ago)	(mod_security) mod_security (id:210492) triggered by 89.249.86.28 (-): 1 in the last 300 secs; Ports ... show more (mod_security) mod_security (id:210492) triggered by 89.249.86.28 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Aug 31 05:33:41.224132 2026] [security2:error] [pid 20339:tid 20339] [client 89.249.86.28:35102] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.wakims.com"] [uri "/.git/config"] [unique_id "apVKdduxQ3a0kOizzkCI0gAAAAE"] show less	Brute-Force Bad Web Bot Web App Attack
🇫🇮 as211431.net	2026-08-31 08:51:30 (18 hours ago)	Triggered Cloudflare WAF (firewallCustom) from LT. Action taken: BLOCK Protocol: HTTP/1.1 (GET metho ... show more Triggered Cloudflare WAF (firewallCustom) from LT. Action taken: BLOCK Protocol: HTTP/1.1 (GET method) Endpoint: /.git/config UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 This report was generated by: https://github.com/sefinek/Cloudflare-WAF-To-AbuseIPDB show less	Bad Web Bot
🇺🇸 TPI-Abuse	2026-08-31 08:39:11 (18 hours ago)	(mod_security) mod_security (id:210492) triggered by 89.249.86.28 (-): 1 in the last 300 secs; Ports ... show more (mod_security) mod_security (id:210492) triggered by 89.249.86.28 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Aug 31 04:39:04.491034 2026] [security2:error] [pid 3281:tid 3281] [client 89.249.86.28:55332] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.bacona.org"] [uri "/.git/config"] [unique_id "apU9qPPP-sATsIixYro8lgAAABY"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-08-31 08:23:18 (19 hours ago)	(mod_security) mod_security (id:210492) triggered by 89.249.86.28 (-): 1 in the last 300 secs; Ports ... show more (mod_security) mod_security (id:210492) triggered by 89.249.86.28 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Aug 31 04:23:12.476442 2026] [security2:error] [pid 3720759:tid 3720853] [client 89.249.86.28:42458] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.antidote-it.com"] [uri "/.git/config"] [unique_id "apU58Ei-3ujBU-IfRDiu_AAAAgU"] show less	Brute-Force Bad Web Bot Web App Attack
Anonymous	2026-08-31 06:51:00 (20 hours ago)		Brute-Force
🇭🇺 miszterx.hu	2026-08-31 06:42:15 (20 hours ago)	XORP (haproxy): 2x HTTP 404/403/500 or handshake failure in 24h. Automated report from log_check_ipt ... show more XORP (haproxy): 2x HTTP 404/403/500 or handshake failure in 24h. Automated report from log_check_iptables_generator.sh (xorp.hu) show less	Web App Attack
🇩🇪 Vegascosmetics	2026-08-31 05:48:14 (21 hours ago)	Kingcopy.org AI-IDS (Vegas Cosmetics shop): auto-blocked after sensitive config/credentials exposure ... show more Kingcopy.org AI-IDS (Vegas Cosmetics shop): auto-blocked after sensitive config/credentials exposure probe. Evidence: AttackPattern: /\.git (Match: /.git) show less	Hacking Brute-Force Web App Attack
🇺🇸 TPI-Abuse	2026-08-31 04:28:58 (23 hours ago)	(mod_security) mod_security (id:210492) triggered by 89.249.86.28 (-): 1 in the last 300 secs; Ports ... show more (mod_security) mod_security (id:210492) triggered by 89.249.86.28 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Aug 31 00:28:53.526582 2026] [security2:error] [pid 16477:tid 16477] [client 89.249.86.28:47568] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.tedharris.com"] [uri "/.git/config"] [unique_id "apUDBVB02Iz-Lle9RQmDnAAAAAU"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-08-31 03:33:04 (23 hours ago)	(mod_security) mod_security (id:210492) triggered by 89.249.86.28 (-): 1 in the last 300 secs; Ports ... show more (mod_security) mod_security (id:210492) triggered by 89.249.86.28 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Aug 30 23:32:56.782131 2026] [security2:error] [pid 7227:tid 7227] [client 89.249.86.28:37062] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.emisoni.com"] [uri "/.git/config"] [unique_id "apT16Dxo_SEHj8AkUgisrQAAABE"] show less	Brute-Force Bad Web Bot Web App Attack
🇩🇪 Jochen Pretli	2026-08-31 02:49:31 (1 day ago)	connection to honeypot	Email Spam Port Scan
🇫🇷 Baking333	2026-08-31 02:42:16 (1 day ago)	[redacted] 89.249.86.28 - - [31/Aug/2026:03:42:14 +0100] "GET /.git/config HTTP/1.1" 302 6758 0/6917 ... show more [redacted] 89.249.86.28 - - [31/Aug/2026:03:42:14 +0100] "GET /.git/config HTTP/1.1" 302 6758 0/69176 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36" [redacted] 89.249.86.28 - - [31/Aug/2026:03:42:14 +0100] "GET / HTTP/1.1" 200 13795 0/121722 "https://[redacted]/.git/config" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36" show less	Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-08-31 02:34:06 (1 day ago)	(mod_security) mod_security (id:210492) triggered by 89.249.86.28 (-): 1 in the last 300 secs; Ports ... show more (mod_security) mod_security (id:210492) triggered by 89.249.86.28 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Aug 30 22:33:58.111173 2026] [security2:error] [pid 13741:tid 13741] [client 89.249.86.28:51840] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "jsdavison.com"] [uri "/.git/config"] [unique_id "apToFhyI3ov1ix9wC3ZvqQAAAAQ"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 etu brutus	2026-08-31 02:27:41 (1 day ago)	89.249.86.28 Blocked by [Attack Vector List] ...	Hacking Brute-Force Exploited Host
Anonymous	2026-08-31 02:09:20 (1 day ago)	Web application attack detected.	Web App Attack

Showing 1 to 15 of 61 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇳🇱 195.178.110.137

🇸🇬 194.233.93.231

🇬🇧 194.50.235.136

🇺🇸 185.207.35.249

🇺🇸 172.169.235.135

🇦🇷 138.118.213.68

🇨🇳 123.175.210.173

🇷🇺 109.195.231.68

🇿🇦 102.216.73.84

🇿🇦 102.39.146.91

🇺🇸 98.93.75.222

🇺🇸 92.204.138.198

🇷🇴 92.118.39.50

🇧🇬 78.128.114.162

🇩🇪 69.5.169.91

🇸🇬 43.163.93.205

🇷🇺 37.22.182.50

🇧🇷 34.39.210.9

🇮🇳 14.140.205.174

🇫🇷 2a01:e0a:86c:72d0:3d44:2c3a:9eee:4078