JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 89.37.63.111

89.37.63.111 was found in our database!

This IP was reported 28 times. Confidence of Abuse is 28%: ?

28%

ISP	Mullvad VPN AB
Usage Type	Data Center/Web Hosting/Transit
ASN	AS212238
Domain Name	mullvad.net
Country	🇸🇪 Sweden
City	Stockholm, Stockholm

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 89.37.63.111

Whois 89.37.63.111

IP Abuse Reports for 89.37.63.111:

This IP address has been reported a total of 28 times from 16 distinct sources. 89.37.63.111 was first reported on August 4th 2025, and the most recent report was 9 hours ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇪🇸 librebit	2026-07-25 09:31:23 (9 hours ago)	Brute force	Brute-Force
🇩🇪 CELOS-SOC	2026-07-24 00:31:31 (1 day ago)	Multiple Unauthorized SSLVPN Login Attempts	Hacking Brute-Force
🇺🇸 TPI-Abuse	2026-06-03 11:38:30 (1 month ago)	(mod_security) mod_security (id:210492) triggered by 89.37.63.111 (-): 1 in the last 300 secs; Ports ... show more (mod_security) mod_security (id:210492) triggered by 89.37.63.111 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jun 03 07:38:27.095276 2026] [security2:error] [pid 697:tid 697] [client 89.37.63.111:58678] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cmcnow.com"] [uri "/.git/index"] [unique_id "aiASMzStZdXHVkeqXo828AAAAAw"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-06-03 11:17:39 (1 month ago)	(mod_security) mod_security (id:210492) triggered by 89.37.63.111 (-): 1 in the last 300 secs; Ports ... show more (mod_security) mod_security (id:210492) triggered by 89.37.63.111 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jun 03 07:17:31.877457 2026] [security2:error] [pid 19478:tid 19478] [client 89.37.63.111:56488] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "clayrivers.com"] [uri "/.git/index"] [unique_id "aiANS8TO-eIPw8cE78IUhAAAABk"] show less	Brute-Force Bad Web Bot Web App Attack
🇬🇧 AvonleaConsulting	2026-06-03 11:14:34 (1 month ago)	Scanning unused Default website or suspicious access to valid sites from IP marked as abusive	Bad Web Bot Web App Attack
Anonymous	2026-06-03 11:10:02 (1 month ago)	suspicious request in access.log	Web App Attack
🇺🇸 TPI-Abuse	2026-06-03 10:57:07 (1 month ago)	(mod_security) mod_security (id:210492) triggered by 89.37.63.111 (-): 1 in the last 300 secs; Ports ... show more (mod_security) mod_security (id:210492) triggered by 89.37.63.111 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jun 03 06:57:00.992481 2026] [security2:error] [pid 11924:tid 11924] [client 89.37.63.111:41406] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "circulodesonido.org"] [uri "/.git/index"] [unique_id "aiAIfNo0Zz9A5KMUaTcHyAAAADA"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-06-03 10:41:48 (1 month ago)	(mod_security) mod_security (id:949110) triggered by 89.37.63.111 (-): 1 in the last 300 secs; Ports ... show more (mod_security) mod_security (id:949110) triggered by 89.37.63.111 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jun 03 06:41:44.036593 2026] [security2:error] [pid 2726:tid 2726] [client 89.37.63.111:54538] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "chuckwagon.org"] [uri "/.git/index"] [unique_id "aiAE6CAHLQoAlheSYMxQ4AAAAAs"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-06-03 10:09:21 (1 month ago)	(mod_security) mod_security (id:210492) triggered by 89.37.63.111 (-): 1 in the last 300 secs; Ports ... show more (mod_security) mod_security (id:210492) triggered by 89.37.63.111 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jun 03 06:09:16.153636 2026] [security2:error] [pid 9162:tid 9162] [client 89.37.63.111:58102] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cherith-bible-inst.org"] [uri "/.git/index"] [unique_id "ah_9TK_kBdZqjjgkrNXiBgAAAAY"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-06-03 09:30:52 (1 month ago)	(mod_security) mod_security (id:210492) triggered by 89.37.63.111 (-): 1 in the last 300 secs; Ports ... show more (mod_security) mod_security (id:210492) triggered by 89.37.63.111 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jun 03 05:30:44.416461 2026] [security2:error] [pid 20056:tid 20056] [client 89.37.63.111:36386] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "centreguephel.org"] [uri "/.git/index"] [unique_id "ah_0RJa-Dku9zl_wq_GJkwAAAAI"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 mnsf	2026-06-03 09:06:52 (1 month ago)	Abuse Detected (3)	Brute-Force Web App Attack
🇺🇸 TPI-Abuse	2026-06-03 08:39:22 (1 month ago)	(mod_security) mod_security (id:210492) triggered by 89.37.63.111 (-): 1 in the last 300 secs; Ports ... show more (mod_security) mod_security (id:210492) triggered by 89.37.63.111 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jun 03 04:39:14.956724 2026] [security2:error] [pid 20368:tid 20393] [client 89.37.63.111:51818] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "8mm-stockfootage.com"] [uri "/.git/index"] [unique_id "ah_oMhMYOxV-ytdNErBqiAAAANY"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-06-03 08:10:52 (1 month ago)	(mod_security) mod_security (id:210492) triggered by 89.37.63.111 (-): 1 in the last 300 secs; Ports ... show more (mod_security) mod_security (id:210492) triggered by 89.37.63.111 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jun 03 04:10:45.868030 2026] [security2:error] [pid 660:tid 660] [client 89.37.63.111:58950] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "34thprs.org"] [uri "/.git/index"] [unique_id "ah_hhVM9_dxE7iCVLelO6gAAAAs"] show less	Brute-Force Bad Web Bot Web App Attack
🇮🇹 [email protected]	2026-05-27 22:38:49 (1 month ago)	89.37.63.111 - - [28/May/2026:00:38:35 +0200] "GET /index.php?PHPSESSID=6c57fefd56346021df6569506b74 ... show more 89.37.63.111 - - [28/May/2026:00:38:35 +0200] "GET /index.php?PHPSESSID=6c57fefd56346021df6569506b74149d&action=login%27 HTTP/1.1" 404 3504 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36" show less	Web App Attack
🇧🇾 lns.bz	2026-04-28 00:01:15 (2 months ago)	.env scanning [BY]	Web App Attack

Showing 1 to 15 of 28 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇷🇺 176.120.22.16

🇺🇸 172.239.51.96

🇪🇸 158.158.32.229

🇳🇱 45.148.10.141

🇿🇦 41.181.156.205

🇸🇬 203.116.129.55

🇪🇸 185.114.66.94

🇧🇷 179.176.210.17

🇺🇸 170.106.105.73

🇺🇸 163.47.43.10

🇸🇬 152.42.164.200

🇺🇸 147.185.132.153

🇨🇳 120.52.18.195

🇺🇸 104.28.166.177

🇪🇸 91.142.223.216

🇱🇹 77.90.185.230

🇺🇸 50.116.72.209

🇵🇾 45.191.91.81

🇺🇸 45.79.98.252

🇺🇸 20.169.49.41