JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 64.89.160.73

64.89.160.73 was found in our database!

This IP was reported 1,563 times. Confidence of Abuse is 100%: ?

100%

ISP	Ghosty Networks LLC
Usage Type	Data Center/Web Hosting/Transit
ASN	AS205759
Domain Name	ghostynetworks.com
Country	🇱🇺 Luxembourg
City	Luxembourg, Luxembourg

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 64.89.160.73

Whois 64.89.160.73

IP Abuse Reports for 64.89.160.73:

This IP address has been reported a total of 1,563 times from 112 distinct sources. 64.89.160.73 was first reported on July 5th 2026, and the most recent report was 4 minutes ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇫🇮 NoaQT	2026-09-16 11:05:44 (4 minutes ago)	2026-09-16T11:05:44.015890+00:00 ingress-1 haproxy[16887]: 64.89.160.73:11476 [16/Sep/2026:11:05:44. ... show more 2026-09-16T11:05:44.015890+00:00 ingress-1 haproxy[16887]: 64.89.160.73:11476 [16/Sep/2026:11:05:44.015] https_in https_in/<NOSRV> 0/-1/-1/-1/0 429 225 - - PR-- 229/218/0/0/0 0/0 "GET /.env.backup HTTP/1.1" 2026-09-16T11:05:44.103696+00:00 ingress-1 haproxy[16887]: 64.89.160.73:11480 [16/Sep/2026:11:05:44.102] https_in https_in/<NOSRV> 0/-1/-1/-1/0 429 225 - - PR-- 229/218/0/0/0 0/0 "GET /.env.backup HTTP/1.1" 2026-09-16T11:05:44.192531+00:00 ingress-1 haproxy[16887]: 64.89.160.73:11492 [16/Sep/2026:11:05:44.192] https_in https_in/<NOSRV> 0/-1/-1/-1/0 429 225 - - PR-- 229/218/0/0/0 0/0 "GET /.env.backup HTTP/1.1" 2026-09-16T11:05:44.293030+00:00 ingress-1 haproxy[16887]: 64.89.160.73:11494 [16/Sep/2026:11:05:44.292] https_in https_in/<NOSRV> 0/-1/-1/-1/0 429 225 - - PR-- 229/218/0/0/0 0/0 "GET /.env.backup HTTP/1.1" 2026-09-16T11:05:44.422488+00:00 ingress-1 haproxy[16887]: 64.89.160.73:43998 [16/Sep/2026:11:05:44.421] https_in~ https_in/<NOSRV> 0/-1/-1/-1/0 429 225 - - PR-- 229/218/0/ ... show less	DDoS Attack
🇫🇷 raid3n09	2026-09-16 10:43:50 (26 minutes ago)	Automated malicious scan and unauthorized access attempt blocked.	Brute-Force Bad Web Bot Web App Attack
🇵🇱 Bonn333	2026-09-16 07:05:44 (4 hours ago)	CrowdSec: probing for exposed secrets and config files. Scenario=crowdsecurity/http-sensitive-files; ... show more CrowdSec: probing for exposed secrets and config files. Scenario=crowdsecurity/http-sensitive-files; events=5; window=2026-09-16T07:05:41.534792798Z .. 2026-09-16T07:05:43.113298265Z. Tried: GET /.env \| GET /.env.local \| GET /.env.prod \| GET /.env.staging \| GET /.env.backup. Automated report, no manual review. show less	Web App Attack Bad Web Bot
🇺🇸 HamSammich	2026-09-16 05:41:09 (5 hours ago)	Automated sensor: 1 HTTP connection/probe attempts over the last 24h (latest 2026-09-16T05:41Z).	Brute-Force Web App Attack
🇬🇧 sandra361	2026-09-16 04:16:32 (6 hours ago)	Port scan detected: 6 attempts across 2 ports (80, 443). \| Evidence: REAPER_TARPIT: IN=enp1s0f0 SRC= ... show more Port scan detected: 6 attempts across 2 ports (80, 443). \| Evidence: REAPER_TARPIT: IN=enp1s0f0 SRC=64.89.160.73 LEN=40 TOS=0x00 PREC=0x00 TTL=51 ID=60746 DF PROTO=TCP SPT=50280 DPT=80 WINDOW=64620 RES=0x00 ACK FIN URGP=0 show less	Port Scan
🇫🇷 maxxsense	2026-09-16 03:35:48 (7 hours ago)	(CT) IP 64.89.160.73 (US/United States/-) found to have 506 connections	DDoS Attack
🇫🇷 Zundapper	2026-09-16 03:29:28 (7 hours ago)	64.89.160.73 - - [16/Sep/2026:05:29:14 +0200] "GET /config/.env HTTP/1.1" 404 548 "-" "Mozilla/5.0 ( ... show more 64.89.160.73 - - [16/Sep/2026:05:29:14 +0200] "GET /config/.env HTTP/1.1" 404 548 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Chrome/124.0 Safari/537.36" 64.89.160.73 - - [16/Sep/2026:05:29:14 +0200] "GET /config/.env.local HTTP/1.1" 404 548 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Chrome/124.0 Safari/537.36" 64.89.160.73 - - [16/Sep/2026:05:29:14 +0200] "GET /config/.env.production HTTP/1.1" 404 548 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Chrome/124.0 Safari/537.36" 64.89.160.73 - - [16/Sep/2026:05:29:26 +0200] "GET /config/settings.ini HTTP/1.1" 404 548 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Chrome/124.0 Safari/537.36" 64.89.160.73 - - [16/Sep/2026:05:29:27 +0200] "GET /config/settings.env HTTP/1.1" 404 548 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Chrome/124.0 Safari/537.36" ... show less	Web App Attack Port Scan
🇩🇪 sdos.es	2026-09-16 02:24:48 (8 hours ago)	"Restricted File Access Attempt - Matched Data: /.env found within REQUEST_FILENAME: /.env"	Web App Attack
🇫🇷 COMAITE	2026-09-16 02:16:40 (8 hours ago)	Suspicious URL access.	Web App Attack
🇩🇪 macrob	2026-09-16 02:05:17 (9 hours ago)	2026/09/16 02:05:15 [error] 2447292#2447292: 3036040 access forbidden by rule, client: 64.89.160.73 ... show more 2026/09/16 02:05:15 [error] 2447292#2447292: 3036040 access forbidden by rule, client: 64.89.160.73, server: fn.binixo.es, request: "GET /.env HTTP/1.1", host: "li1822-160.members.linode.com" 2026/09/16 02:05:15 [error] 2447292#2447292: 3036042 access forbidden by rule, client: 64.89.160.73, server: fn.binixo.es, request: "GET /.env HTTP/1.1", host: "li1822-160.members.linode.com" 2026/09/16 02:05:15 [error] 2447292#2447292: 3036043 access forbidden by rule, client: 64.89.160.73, server: fn.binixo.es, request: "GET /.env HTTP/1.1", host: "172.104.245.160" ... show less	Web App Attack
🇫🇷 SpaceHost-Server	2026-09-15 22:21:06 (12 hours ago)		Brute-Force Web App Attack
🇺🇸 sandra361	2026-09-15 20:52:49 (14 hours ago)	Port scan detected: 6 attempts across 2 ports (80, 443). \| Evidence: REAPER_TARPIT: IN=enp1s0 SRC=64 ... show more Port scan detected: 6 attempts across 2 ports (80, 443). \| Evidence: REAPER_TARPIT: IN=enp1s0 SRC=64.89.160.73 LEN=40 TOS=0x00 PREC=0x00 TTL=48 ID=7827 DF PROTO=TCP SPT=27112 DPT=443 WINDOW=64620 RES=0x00 ACK FIN URGP=0 show less	Port Scan
🇫🇷 Coco Bongo	2026-09-15 18:12:36 (16 hours ago)	64.89.160.73 [redacted].[redacted] (205759-Ghosty Networks LLC United States -) - - [15/Sep/2026:20: ... show more 64.89.160.73 [redacted].[redacted] (205759-Ghosty Networks LLC United States -) - - [15/Sep/2026:20:12:21 +0200] "GET /.env HTTP/1.1" 404 548 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 ... show less	Bad Web Bot Web App Attack
🇩🇪 ut-addicted.com	2026-09-15 17:08:02 (18 hours ago)	\[Tue Sep 15 19:07:59.764033 2026\] \[:error\] \[pid 18475:tid 140352702101248\] \[client 64.89.160. ... show more \[Tue Sep 15 19:07:59.764033 2026\] \[:error\] \[pid 18475:tid 140352702101248\] \[client 64.89.160.73:64192\] \[client 64.89.160.73\] ModSecurity: Access denied with code 403 \(phase 2\). Operator GE matched 5 at TX:anomaly_score. \[file "/usr/local/apache/modsecurity-owasp-latest/rules/REQUEST-949-BLOCKING-EVALUATION.conf"\] \[line "57"\] \[id "949110"\] \[msg "Inbound Anomaly Score Exceeded \(Total Score: 5\)"\] \[severity "CRITICAL"\] \[tag "application-multi"\] \[tag "language-multi"\] \[tag "platform-multi"\] \[tag "attack-generic"\] \[hostname "www.ut-addicted.com"\] \[uri "/.env"\] \[unique_id "aql7b1vpWrsilKjRhYWrJQAAAMA"\] show less	Brute-Force Web App Attack
🇬🇧 blik2108	2026-09-15 16:36:24 (18 hours ago)	64.89.160.73 - - [15/Sep/2026:16:36:18 +0000] "GET /.env HTTP/1.1" 404 3431 "-" "Mozilla/5.0 (Window ... show more 64.89.160.73 - - [15/Sep/2026:16:36:18 +0000] "GET /.env HTTP/1.1" 404 3431 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Chrome/124.0 Safari/537.36" "-" 64.89.160.73 - - [15/Sep/2026:16:36:19 +0000] "GET /.env.local HTTP/1.1" 404 3431 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Chrome/124.0 Safari/537.36" "-" 64.89.160.73 - - [15/Sep/2026:16:36:19 +0000] "GET /.env.production HTTP/1.1" 404 3431 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Chrome/124.0 Safari/537.36" "-" 64.89.160.73 - - [15/Sep/2026:16:36:20 +0000] "GET /.env.prod HTTP/1.1" 404 3431 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Chrome/124.0 Safari/537.36" "-" 64.89.160.73 - - [15/Sep/2026:16:36:20 +0000] "GET /.env.staging HTTP/1.1" 404 3431 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Chrome/124.0 Safari/537.36" "-" 64.89.160.73 - - [15/Sep/2026:16:36:21 +0000] "GET /.env.backup HTTP/1.1" 404 3431 "-" "Mozilla/5.0 ... show less	Web App Attack

Showing 1 to 15 of 1563 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇦🇷 201.177.26.201

🇺🇸 173.88.123.174

🇧🇷 45.182.206.203

🇨🇴 190.28.52.177

🇨🇱 186.10.86.130

🇨🇳 121.37.99.163

🇷🇴 92.118.39.224

🇺🇸 65.49.1.162

🇺🇸 52.248.42.176

🇳🇱 45.148.10.152

🇹🇷 31.145.131.202

🇺🇸 20.55.44.181

🇨🇳 183.232.212.207

🇮🇳 117.254.10.21

🇨🇳 106.12.221.161

🇸🇬 47.236.243.0

🇧🇷 45.225.86.226

🇻🇳 27.65.151.121

🇬🇧 2a06:4880::12

🇭🇰 223.17.1.118