Log in to view charts and search reports for this IP.
Log In
No reports in the last 60 days
89.252.162.208 has been reported 26
times. The most recent report is from
.
The full history is preserved below and remains searchable. A
0% score reflects the absence of recent activity, but
this is not a guarantee that earlier reports were invalid. Abuse confidence score decays,
naturally, over time, when the abusive activity stops.
IP Abuse Reports for 89.252.162.208:
This IP address has been reported a total of
26
times from
6 distinct
sources.
89.252.162.208 was first reported on
, and the most recent report was
.
From: Cloud Capacity Alert <[email protected]> (We've_blocked your account! 🚫 Your photo ...
show moreFrom: Cloud Capacity Alert <[email protected]> (We've_blocked your account! 🚫 Your photos and videos will be deleted on 03-15-2026 ⚠️ Renew your subscription for free_now!)
show less
Open Proxy
Email Spam
Spoofing
Exploited Host
Phishing
Anonymous
Received: from calm.com (www.thhs.qc.cuny.edu. [89.252.162.208])
Email Spam
Spoofing
Phishing
Anonymous
Received: from hindawi.com (www.thhs.qc.cuny.edu. [89.252.162.208])
Authentication-Results: mx.goog ...
show moreReceived: from hindawi.com (www.thhs.qc.cuny.edu. [89.252.162.208])
Authentication-Results: mx.google.com;
spf=pass (google.com: domain of [email protected] designates 89.252.162.208 as permitted sender)
show less
Email Spam
Spoofing
Phishing
Anonymous
Spoofing:
Received: from segment.com (www.thhs.qc.cuny.edu. [89.252.162.208])
Received: from willi ...
show moreSpoofing:
Received: from segment.com (www.thhs.qc.cuny.edu. [89.252.162.208])
Received: from williams-sonoma.com (dickensonlab.chem.usu.edu. [89.252.162.208])
Remarks:
It seems a third party working for several US universities used this IP space and left DNS dangling for exploitation.
show less
Email Spam
Spoofing
Phishing
Anonymous
Received: from rebrandly.com (ioc.ucdavis.edu. [89.252.162.208])
Received: from qantas.com (dickensonlab.chem.usu.edu. [89.252.162.208])
Subject: Give Your Home a R ...
show moreReceived: from qantas.com (dickensonlab.chem.usu.edu. [89.252.162.208])
Subject: Give Your Home a Robotic Best Friend Today
From: RoboPaw_Robot_Puppy <[email protected]>
show less
Email Spam
Anonymous
Phishing/Spam/Fraud.
Source IP: 89.252.162.208 (Confirmed in Received headers and X-Originating-IP) ...
show morePhishing/Spam/Fraud.
Source IP: 89.252.162.208 (Confirmed in Received headers and X-Originating-IP).
Campaign ID: "X-Destination-ID: 462-9330" (Linked to a phishing cluster actively using servers of Netinternet, Turkey).
Payload: Fake "Matsato Knives" discount lure redirecting to storage.googleapis.com to evade filters.
Spoofing:
1. Injected fake "X-Google-Sender-Delegation" and "X-Original-Sender" headers to impersonate the recipient.
2. Spoofed Return-Path domain "traxel.datacrest.biz".
3. Extensive hash-busting (scraped news text) appended to body to bypass Bayesian filters.
Email header extract:
Received: from sketchup.com (virl-dev-innovate.cisco.com. [89.252.162.208])
show less
Phishing
Email Spam
Spoofing
Anonymous
Received: from cio.com (virl-dev-innovate.cisco.com. [89.252.162.208])
by mx.google.com wit ...
show moreReceived: from cio.com (virl-dev-innovate.cisco.com. [89.252.162.208])
by mx.google.com with ESMTPS id ffacd0b85a97d-43569920694si21530168f8f.112.2026.01.20.05.59.01
(version=TLS1 cipher=ECDHE-ECDSA-AES128-SHA bits=128/128);
Tue, 20 Jan 2026 05:59:01 -0800 (PST)
Received-SPF: pass (google.com: domain of [email protected] designates 89.252.162.208 as permitted sender) client-ip=89.252.162.208;
show less
Phishing
Email Spam
Spoofing
Anonymous
Received: from weforum.org (virl-dev-innovate.cisco.com. [89.252.162.208])
by mx.google.com ...
show moreReceived: from weforum.org (virl-dev-innovate.cisco.com. [89.252.162.208])
by mx.google.com with ESMTPS id 4fb4d7f45d1cf-6507b8cf655si8558429a12.84.2026.01.08.05.53.42
(version=TLS1 cipher=ECDHE-ECDSA-AES128-SHA bits=128/128);
Thu, 08 Jan 2026 05:53:43 -0800 (PST)
Received-SPF: pass (google.com: domain of [email protected] designates 89.252.162.208 as permitted sender) client-ip=89.252.162.208;
show less
From: Cloud_Storage_Final_Notice <[email protected]> (FINAL WARNING: Your Cloud Files Wi ...
show moreFrom: Cloud_Storage_Final_Notice <[email protected]> (FINAL WARNING: Your Cloud Files Will Be Removed TODAY***12-25-2025***– Immediate Upgrade Required_________14445)
show less
Phishing
Open Proxy
Email Spam
Spoofing
Exploited Host