JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 89.251.0.131

89.251.0.131 was found in our database!

This IP was reported 173 times. Confidence of Abuse is 57%: ?

57%

ISP	VPN Consumer Toronto, Canada
Usage Type	Data Center/Web Hosting/Transit
ASN	AS41564
Domain Name	vpnconsumer.com
Country	🇨🇦 Canada
City	Toronto, Ontario

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 89.251.0.131

Whois 89.251.0.131

IP Abuse Reports for 89.251.0.131:

This IP address has been reported a total of 173 times from 64 distinct sources. 89.251.0.131 was first reported on February 14th 2025, and the most recent report was 3 days ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇮🇹 [email protected]	2026-06-07 13:58:03 (3 days ago)	[Sun Jun 07 15:58:03.781167 2026] [proxy_fcgi:error] [pid 1066084:tid 1066109] [remote 89.251.0.131: ... show more [Sun Jun 07 15:58:03.781167 2026] [proxy_fcgi:error] [pid 1066084:tid 1066109] [remote 89.251.0.131:21485] AH01071: Got error "Primary script unknown", referer: http://blog.diegoweb.it/menu.php show less	Web App Attack
🇫🇷 Hippoline	2026-06-04 11:40:25 (6 days ago)	[Thu Jun 04 13:40:21.802075 2026] [authz_core:error] [pid 3108] [client 89.251.0.131:59125] AH01630: ... show more [Thu Jun 04 13:40:21.802075 2026] [authz_core:error] [pid 3108] [client 89.251.0.131:59125] AH01630: client denied by server configuration: /var/www/championat.lu/web/alfa.php, referer: http://championat.lu/alfa.php [Thu Jun 04 13:40:22.468886 2026] [authz_core:error] [pid 3108] [client 89.251.0.131:59125] AH01630: client denied by server configuration: /var/www/championat.lu/web/file.php, referer: http://championat.lu/file.php [Thu Jun 04 13:40:23.134102 2026] [authz_core:error] [pid 3108] [client 89.251.0.131:59125] AH01630: client denied by server configuration: /var/www/championat.lu/web/mini.php, referer: http://championat.lu/mini.php [Thu Jun 04 13:40:23.963313 2026] [authz_core:error] [pid 3108] [client 89.251.0.131:59125] AH01630: client denied by server configuration: /var/www/championat.lu/web/info.php, referer: http://championat.lu/info.php [Thu Jun 04 13:40:24.628840 2026] [authz_core:error] [pid 3108] [client 89.251.0.131:59125] AH01630: client denied by server configurati ... show less	Brute-Force Web App Attack
🇫🇮 [email protected]	2026-06-03 15:56:05 (1 week ago)	Attack attempt against Interwebbi servers; (WPNINJA) Ninja Firewall attack on ideaviihde.net (WP vul ... show more Attack attempt against Interwebbi servers; (WPNINJA) Ninja Firewall attack on ideaviihde.net (WP vulnerability) 89.251.0.131 (CA/Canada/-): 1 in the last 3600 secs (CF_ENABLE); IP: 89.251.0.131; Ports: *; Direction: 0; Trigger: LF_CUSTOMTRIGGER; show less	Web App Attack
🇳🇱 Site.eu	2026-05-25 08:47:41 (2 weeks ago)	Excessive multi-domain requests	Brute-Force
🇫🇮 [email protected]	2026-05-22 11:13:34 (2 weeks ago)	Attack attempt against Interwebbi servers; (WPNINJA) Ninja Firewall attack on ideaviihde.net (WP vul ... show more Attack attempt against Interwebbi servers; (WPNINJA) Ninja Firewall attack on ideaviihde.net (WP vulnerability) 89.251.0.131 (CA/Canada/-): 1 in the last 3600 secs (CF_ENABLE); IP: 89.251.0.131; Ports: *; Direction: 0; Trigger: LF_CUSTOMTRIGGER; show less	Web App Attack
🇫🇷 masterguru	2026-05-22 02:49:00 (2 weeks ago)	Too much 404 requests in 1 minute. Operator GE matched 10 at IP:block_script. (46020-193)	Hacking
🇺🇸 nyt	2026-05-20 12:26:20 (3 weeks ago)	404 flood (16/60s), 404 flood (17/60s)	Bad Web Bot Web App Attack
🇺🇦 URAN Publishing Service	2026-05-19 22:43:35 (3 weeks ago)	89.251.0.131 - - [20/May/2026:01:43:34 +0300] "GET /wp-content/plugins/core/core.php HTTP/1.1" 404 7 ... show more 89.251.0.131 - - [20/May/2026:01:43:34 +0300] "GET /wp-content/plugins/core/core.php HTTP/1.1" 404 715 "-" "Go-http-client/1.1" 89.251.0.131 - - [20/May/2026:01:43:35 +0300] "GET /wp-content/themes/news-portal/sitebar.php HTTP/1.1" 404 715 "-" "Go-http-client/1.1" ... show less	Web App Attack
🇫🇷 masterguru	2026-05-11 03:04:57 (4 weeks ago)	(modsec_5080) ModSec 5080: Infrastructure subdomain probe from 89.251.0.131 (CA/Canada/-): 1 in the ... show more (modsec_5080) ModSec 5080: Infrastructure subdomain probe from 89.251.0.131 (CA/Canada/-): 1 in the last 3600 secs (0-195) show less	Hacking
🇩🇪 Ba-Yu	2026-05-09 16:29:52 (1 month ago)	General hacking/exploits/scanning	Web Spam Hacking Brute-Force Exploited Host Web App Attack
🇳🇱 Site.eu	2026-05-09 10:29:08 (1 month ago)	Excessive multi-domain requests	Brute-Force
🇺🇸 TPI-Abuse	2026-05-09 06:08:01 (1 month ago)	(mod_security) mod_security (id:234930) triggered by 89.251.0.131 (-): 1 in the last 300 secs; Ports ... show more (mod_security) mod_security (id:234930) triggered by 89.251.0.131 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat May 09 02:07:54.292679 2026] [security2:error] [pid 18954:tid 18954] [client 89.251.0.131:32471] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\/lib\\\\/php\\\\/connector\\\\.minimal\\\\.php$" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/27_Apps_WPPlugin.conf"] [line "6787"] [id "234930"] [rev "2"] [msg "COMODO WAF: File upload vulnerability in the file manager plugin before 6.9 for WordPress (CVE-2020-25213)\|\|www.homebuilt.org\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WPPlugin"] [hostname "www.homebuilt.org"] [uri "/wp-content/plugins/wp-file-manager/lib/php/connector.minimal.php"] [unique_id "af7POoUBm513a-fDW7ffNwAAAAI"] show less	Brute-Force Bad Web Bot Web App Attack
🇩🇪 raph	2026-05-08 23:36:21 (1 month ago)	[Wordpress] crawler /wp-admin/, /wp-content/, etc.	Bad Web Bot Web App Attack
🇫🇷 Octopuce	2026-05-06 03:22:42 (1 month ago)	Aggressive web search of vulnerable pages: /wp-includes/IXR/admin.php /wp-includes/js/jquery/jquery. ... show more Aggressive web search of vulnerable pages: /wp-includes/IXR/admin.php /wp-includes/js/jquery/jquery.php /function.php /wp-includes/block-suppor ... show less	Web App Attack
🇺🇸 kosada.com	2026-05-05 17:08:35 (1 month ago)	Web vulnerability probing: /wp-includes/db.php	Web App Attack

Showing 1 to 15 of 173 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇬🇧 194.50.235.143

🇸🇬 194.5.82.118

🇰🇷 175.198.62.180

🇳🇱 160.119.76.51

🇨🇳 113.200.100.18

🇳🇱 77.83.39.176

🇬🇧 35.203.211.147

🇺🇸 2602:fb54:1400::2f

🇨🇳 220.181.108.169

🇦🇪 217.165.39.226

🇩🇪 213.209.159.231

🇬🇧 213.166.84.41

🇩🇪 212.132.127.66

🇭🇰 199.45.154.148

🇺🇸 193.19.109.150

🇨🇳 183.53.28.210

🇺🇸 162.217.164.196

🇺🇸 157.245.222.108

🇧🇪 136.143.250.5

🇨🇳 118.123.1.38