JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

92.117.89.115

Activity Trending Down

Abuse Confidence Score

34% Elevated

22 reports

21 reporters · latest 1 month ago

ISP: 1&1 Telecom GmbH
Usage Type: Fixed Line ISP
ASN: AS8881
Hostname(s): i5c755973.versanet.de
Domain Name: mein-1und1-domain.de
Country: 🇩🇪 Germany
City: Ludenscheid, North Rhine-Westphalia

ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report Whois

Example preview

Account required for the enhanced features Log in Sign up

Abuse Reports

Export reports CSV

Total reports

22 from 21 distinct reporters

First reported

September 26th 2026

Most recent report

1 month ago

Last 60 days

Top reporter locations 🇩🇪 Germany 5 🇺🇸 United States of America 5 🇫🇷 France 4

Most common categories Brute-Force 11 Port Scan 8 SSH 8 Web App Attack 7 Hacking 4

Old reports The most recent abuse report for this IP address is from 1 month ago. It is possible that this IP is no longer involved in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇫🇷 ACE-INFORMATIQUE.NC	2026-09-27 19:00:25 UTC · (1 month ago)	Brute-Force + SSH (honeypot) blocked by Fail2ban	Brute-Force SSH
🇩🇪 zupan	2026-09-26 23:54:59 UTC · (1 month ago)	Blocked by UFW on vps [23/tcp] \| SPT: 63449 \| TTL: 55 \| LEN: 44 \| TOS: 0x00 • Reported by: github.com/sefinek/UFW-AbuseIPDB-Reporter	Port Scan IoT Targeted
🇺🇸 Silly Development	2026-09-26 23:36:52 UTC · (1 month ago)	2026-09-26T23:35:56.614123+00:00 kansas1 sshd[3518365]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=92.117.89.115 2026-09-26T23:35:58.290968+00:00 kansas1 sshd[3518365]: Failed password for invalid user adm ... show more 2026-09-26T23:35:56.614123+00:00 kansas1 sshd[3518365]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=92.117.89.115 2026-09-26T23:35:58.290968+00:00 kansas1 sshd[3518365]: Failed password for invalid user admin from 92.117.89.115 port 36678 ssh2 2026-09-26T23:36:51.839913+00:00 kansas1 sshd[3518368]: Invalid user user from 92.117.89.115 port 53616 ... show less	Brute-Force SSH
Anonymous	2026-09-26 22:21:34 UTC · (1 month ago)	[ssd5.kdns.gr] httpd-suspicious-path: logs=/var/log/httpd/access_log; samples=/cgi-bin/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/bin/sh \| /cgi-bin/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32% ... show more [ssd5.kdns.gr] httpd-suspicious-path: logs=/var/log/httpd/access_log; samples=/cgi-bin/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/bin/sh \| /cgi-bin/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/bin/sh show less	Hacking Web App Attack
🇺🇸 OceanTreasure	2026-09-26 20:50:49 UTC · (1 month ago)	tcp/22; Unsolicited SYN to a port that has never been offered on this address (closed, no service ever) @ 2026-09-26T20:47:42Z	Port Scan
🇮🇪 AutosOnShow	2026-09-26 20:50:07 UTC · (1 month ago)	blocked for webapp attack \| path requested: /index.php \| seen at 2026-09-26 20:49:29.973 \|	Web App Attack
Anonymous	2026-09-26 17:49:59 UTC · (1 month ago)	Scanner hitting /cgi-bin/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/bin/sh on 176.31.46.240 (ONEANDONE-ACCESS) — aaguard	Brute-Force Port Scan
🇳🇱 paradoxnetworks	2026-09-26 16:56:26 UTC · (1 month ago)	2026-09-26T16:55:28.610848+00:00 netbox sshd-session[2241786]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=92.117.89.115 2026-09-26T16:55:30.265159+00:00 netbox sshd-session[2241786]: Failed password for in ... show more 2026-09-26T16:55:28.610848+00:00 netbox sshd-session[2241786]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=92.117.89.115 2026-09-26T16:55:30.265159+00:00 netbox sshd-session[2241786]: Failed password for invalid user admin from 92.117.89.115 port 60760 ssh2 2026-09-26T16:56:26.065579+00:00 netbox sshd-session[2241986]: Invalid user user from 92.117.89.115 port 41672 ... show less	Brute-Force SSH
🇩🇪 ghostwarriors	2026-09-26 16:20:16 UTC · (1 month ago)	Unauthorized connection attempt detected, SSH Brute-Force	Brute-Force Port Scan SSH
🇺🇸 mutebot.net	2026-09-26 12:12:49 UTC · (1 month ago)	Invalid user admin from 92.117.89.115 port 60462 Connection closed by invalid user admin 92.117.89.115 port 60462 [preauth] Invalid user user from 92.117.89.115 port 48008 Connection closed by invalid user user 92.117.89.115 port 48008 [preauth] Conn ... show more Invalid user admin from 92.117.89.115 port 60462 Connection closed by invalid user admin 92.117.89.115 port 60462 [preauth] Invalid user user from 92.117.89.115 port 48008 Connection closed by invalid user user 92.117.89.115 port 48008 [preauth] Connection closed by authenticating user root 92.117.89.115 port 52678 [preauth] show less	Brute-Force SSH
🇺🇸 TPI-Abuse	2026-09-26 11:21:29 UTC · (1 month ago)	(mod_security) mod_security (id:218420) triggered by 92.117.89.115 (i5C755973.versanet.de): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Sep 26 07:21:20.251339 2026] [security2:error] [pid 7488:tid 7488] [client 92.1 ... show more (mod_security) mod_security (id:218420) triggered by 92.117.89.115 (i5C755973.versanet.de): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Sep 26 07:21:20.251339 2026] [security2:error] [pid 7488:tid 7488] [client 92.117.89.115:54770] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i)php://(std(in\|out\|err)\|(in\|out)put\|fd\|memory\|temp\|filter)" at ARGS_NAMES:\\xadd allow_url_include=1 \\xadd auto_prepend_file=php://input. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/21_PHP_PHPGen.conf"] [line "22"] [id "218420"] [rev "2"] [msg "COMODO WAF: PHP Injection Attack: I/O Stream Found\|\|192.64.150.30:80\|F\|2"] [data "Matched Data: php://input found within ARGS_NAMES:\\x5cxadd allow_url_include=1 \\x5cxadd auto_prepend_file=php://input: \\xadd allow_url_include=1 \\xadd auto_prepend_file=php://input"] [severity "CRITICAL"] [tag "CWAF"] [tag "PHPGen"] [hostname "192.64.150.30"] [uri "/hello.world"] [unique_id "areqsM0l2wcehWR4Jkyj3wAAAAA"] show less	Brute-Force Bad Web Bot Web App Attack
🇨🇴 juan_mesa	2026-09-26 09:36:14 UTC · (1 month ago)	Unauthorized connection attempts to SSH TCP/2222 on 1 MikroTik router(s) (blocked by firewall).	Port Scan SSH
🇦🇹 dimejo	2026-09-26 08:50:47 UTC · (1 month ago)	SSH login failed multiple times	Brute-Force SSH
🇵🇱 mkey	2026-09-26 08:20:05 UTC · (1 month ago)	Verified scan activity detected by local IDS/firewall correlation. SCAN: HIGHRISK_SINGLEPORT \| PORTS=23 \| HITS=2 \| IPSET=ADD \| FIRST=2026-09-26 10:14:11 \| LAST=2026-09-26 10:14:11. Last seen 2026-09-26 10:14:11.	Port Scan
🇫🇷 dynamix	2026-09-26 08:10:10 UTC · (1 month ago)	Multiple WAF Violations	Web App Attack

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown

Recently Reported IPs:

🇳🇱 213.209.159.236

🇲🇾 183.171.49.135

🇨🇳 117.148.167.134

🇸🇦 37.243.229.12

🇺🇸 35.232.227.58

🇧🇷 186.227.44.109

🇰🇷 183.78.201.108

🇧🇼 168.167.39.10

🇺🇸 108.41.83.224

🇬🇧 45.133.173.7

🇹🇷 5.25.174.176

🇺🇸 3.208.156.9

🇨🇳 180.76.114.151

🇰🇭 167.179.14.69

🇺🇬 102.209.109.149

🇳🇱 45.148.10.151

🇺🇸 216.73.160.191

🇺🇸 216.73.160.187

🇺🇸 216.73.160.23

🇳🇱 195.178.110.152