JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 89.37.63.237

89.37.63.237 was found in our database!

This IP was reported 23 times. Confidence of Abuse is 11%: ?

11%

ISP	Mullvad VPN AB
Usage Type	Data Center/Web Hosting/Transit
ASN	AS212238
Domain Name	mullvad.net
Country	🇸🇪 Sweden
City	Stockholm, Stockholm

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 89.37.63.237

Whois 89.37.63.237

IP Abuse Reports for 89.37.63.237:

This IP address has been reported a total of 23 times from 10 distinct sources. 89.37.63.237 was first reported on March 28th 2025, and the most recent report was 13 hours ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇫🇷 matthieul.dev	2026-08-01 10:50:21 (13 hours ago)	Blocked by os-abuseipdb; 9 hits, proto=tcp, ports=34742	Port Scan Brute-Force
🇫🇷 matthieul.dev	2026-07-27 12:05:16 (5 days ago)	Blocked by os-abuseipdb; 8 hits, proto=tcp, ports=34742	Port Scan Brute-Force
🇩🇪 Admins@FBN	2026-06-10 18:49:12 (1 month ago)	VPN Logon Failed: AAA user authentication Rejected user = <fuerbuss>	Brute-Force Exploited Host
🇺🇸 xmission.com	2026-06-01 07:44:22 (2 months ago)	Blocked by UFW (TCP on 55555) Source port: 36025 TTL: 44 Packet length: 60 TOS: 0x08 This report (f ... show more Blocked by UFW (TCP on 55555) Source port: 36025 TTL: 44 Packet length: 60 TOS: 0x08 This report (for 89.37.63.237) was generated by: https://github.com/sefinek/UFW-AbuseIPDB-Reporter show less	Port Scan
🇩🇪 FeG Deutschland	2026-05-25 11:44:45 (2 months ago)	Looking for CMS/PHP/SQL vulnerablilities/excessive crawling - 28	Exploited Host Web App Attack
🇱🇻 garmtech.com	2026-05-22 22:54:28 (2 months ago)	IM360 WAF: SQLi vulnerability in aWeb Cart Watching System for Virtuemart v1.0.7 for Joomla! (CVE-20 ... show more IM360 WAF: SQLi vulnerability in aWeb Cart Watching System for Virtuemart v1.0.7 for Joomla! (CVE-2016-10114) MV:com_content' show less	SQL Injection
🇺🇸 TPI-Abuse	2026-05-17 11:09:04 (2 months ago)	(mod_security) mod_security (id:210492) triggered by 89.37.63.237 (-): 1 in the last 300 secs; Ports ... show more (mod_security) mod_security (id:210492) triggered by 89.37.63.237 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun May 17 07:09:00.015417 2026] [security2:error] [pid 12263:tid 12274] [client 89.37.63.237:40132] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "yucef.com"] [uri "/.git/index"] [unique_id "agmhzJitGiTVQVFs3SEVrgAAAMY"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-05-17 10:39:52 (2 months ago)	(mod_security) mod_security (id:210492) triggered by 89.37.63.237 (-): 1 in the last 300 secs; Ports ... show more (mod_security) mod_security (id:210492) triggered by 89.37.63.237 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun May 17 06:39:48.726524 2026] [security2:error] [pid 5292:tid 5292] [client 89.37.63.237:38176] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "yarbroughfamily.org"] [uri "/.git/index"] [unique_id "agma9JdqabQAGif_eFVYXwAAAAo"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-05-17 09:24:35 (2 months ago)	(mod_security) mod_security (id:210492) triggered by 89.37.63.237 (-): 1 in the last 300 secs; Ports ... show more (mod_security) mod_security (id:210492) triggered by 89.37.63.237 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun May 17 05:24:31.425574 2026] [security2:error] [pid 3405:tid 3405] [client 89.37.63.237:46470] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "writebetweenthelines.com"] [uri "/.git/index"] [unique_id "agmJT38eq-fNki4XKmm0AwAAABU"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-05-17 08:57:39 (2 months ago)	(mod_security) mod_security (id:210492) triggered by 89.37.63.237 (-): 1 in the last 300 secs; Ports ... show more (mod_security) mod_security (id:210492) triggered by 89.37.63.237 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun May 17 04:57:31.406316 2026] [security2:error] [pid 32033:tid 32033] [client 89.37.63.237:33296] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "wmionline.org"] [uri "/.git/index"] [unique_id "agmC-8w7McsZzSSL-HjZIQAAAA4"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-05-17 08:38:47 (2 months ago)	(mod_security) mod_security (id:210492) triggered by 89.37.63.237 (-): 1 in the last 300 secs; Ports ... show more (mod_security) mod_security (id:210492) triggered by 89.37.63.237 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun May 17 04:38:43.770628 2026] [security2:error] [pid 6624:tid 6624] [client 89.37.63.237:33858] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "williamfitzsimmons.com"] [uri "/.git/index"] [unique_id "agl-k2_1vXuiGQDMpTWRLAAAAAs"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-05-17 08:15:20 (2 months ago)	(mod_security) mod_security (id:210492) triggered by 89.37.63.237 (-): 1 in the last 300 secs; Ports ... show more (mod_security) mod_security (id:210492) triggered by 89.37.63.237 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun May 17 04:15:13.295252 2026] [security2:error] [pid 25211:tid 25211] [client 89.37.63.237:47910] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "wgs.cc"] [uri "/.git/index"] [unique_id "agl5Eeb-5355efqFV--lDwAAAC0"] show less	Brute-Force Bad Web Bot Web App Attack
🇩🇪 filstal.org	2026-05-17 08:02:29 (2 months ago)	Web exploit or injection attempt blocked by ModSecurity WAF (Fail2Ban)	SQL Injection Web App Attack
🇺🇸 TPI-Abuse	2026-05-17 07:56:09 (2 months ago)	(mod_security) mod_security (id:210492) triggered by 89.37.63.237 (-): 1 in the last 300 secs; Ports ... show more (mod_security) mod_security (id:210492) triggered by 89.37.63.237 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun May 17 03:56:03.686511 2026] [security2:error] [pid 27655:tid 27655] [client 89.37.63.237:59422] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "wedemandavote.com"] [uri "/.git/index"] [unique_id "agl0kw30Oen03iJkiZyGKgAAAAM"] show less	Brute-Force Bad Web Bot Web App Attack
Anonymous	2026-05-12 06:50:04 (2 months ago)	\| Multiple SQL injection attempts from same source ip.(multiple servers)	Web App Attack Hacking SQL Injection

Showing 1 to 15 of 23 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇬🇧 209.97.139.137

🇸🇬 162.128.160.29

🇺🇸 147.182.219.126

🇹🇼 125.227.240.31

🇨🇳 124.78.20.1

🇨🇳 121.227.152.171

🇰🇷 119.200.229.33

🇭🇰 118.193.47.155

🇱🇰 112.134.35.247

🇬🇪 95.181.236.52

🇺🇸 52.180.145.88

🇬🇧 35.203.211.73

🇬🇧 35.203.210.87

🇺🇸 18.208.185.45

🇺🇸 18.97.5.109

🇺🇸 2607:f8b0:4023:100d::129

🇺🇸 205.210.31.49

🇮🇩 202.145.0.61

🇳🇱 185.107.80.93

🇪🇨 157.100.142.203