159.89.113.99

Classification: Malicious

159.89.113.99 is a malicious IP address in Toronto, CA. 6,512 sightings from 9 threat sources (Port Scanner, SSH Attacker), last seen 2026-11-03.

Current activity

  • Known attacker — Seen launching attacks over the Internet.
  • Known scanner — Seen scanning hosts over the Internet.
  • VPN node — Provides anonymization that can hide an attacker.

Blacklist sightings

Description Source First seen Last seen Labels MITRE ATT&CK
Unauthorized scanning of hosts Blocklist.net.ua 2026-09-16 16:04:27 2026-11-03 16:50:14 attacker malicious-activity reconnaissance
VPN IPWhois.io 2026-06-02 03:38:52 2026-10-29 17:19:37 anonymization vpn
Hacking AbuseIPDB 2026-01-16 08:51:02 2026-10-26 08:35:08 attacker malicious-activity
SSH Attacker AbuseIPDB 2026-01-16 07:27:37 2026-10-26 08:35:08 attacker malicious-activity
Bruteforce AbuseIPDB 2026-01-16 07:27:37 2026-10-26 08:35:08 attacker malicious-activity
HTTP Attacker AbuseIPDB 2026-01-17 05:54:54 2026-10-22 21:00:00 attacker malicious-activity
Known Attacker AbuseIPDB 2026-01-16 08:51:02 2026-10-19 00:23:08 attacker malicious-activity
DDoS Attacker AbuseIPDB 2026-01-16 08:51:02 2026-10-19 00:23:08 attacker malicious-activity
Port Scanner AbuseIPDB 2026-01-16 08:51:02 2026-10-19 00:23:08 attacker malicious-activity reconnaissance
ET CINS Active Threat Intelligence Poor Reputation IP UDP Emerging Threats 2026-02-11 02:41:21 2026-10-15 11:14:01 attacker malicious-activity
Mail Spammer AbuseIPDB 2026-03-23 05:26:53 2026-10-13 14:11:42 attacker malicious-activity
Malicious Host CIArmy 2026-02-10 15:19:54 2026-10-05 20:04:37 attacker malicious-activity
HTTP Scrapper AbuseIPDB 2026-03-15 02:14:31 2026-09-26 22:26:03 attacker malicious-activity
ET CINS Active Threat Intelligence Poor Reputation IP TCP Emerging Threats 2026-02-11 02:41:14 2026-09-24 09:14:12 attacker malicious-activity
SSH Attacker Blocklist.de 2026-01-17 03:11:13 2026-09-22 14:00:28 attacker malicious-activity
Malicious Host AbuseIPDB 2026-01-17 08:34:39 2026-09-06 11:35:07 attacker compromised malicious-activity
ET COMPROMISED Known Compromised or Hostile Host Traffic UDP Emerging Threats 2026-06-16 12:01:17 2026-07-13 12:01:10 attacker malicious-activity
ET COMPROMISED Known Compromised or Hostile Host Traffic TCP Emerging Threats 2026-06-16 12:01:16 2026-07-13 12:01:09 attacker malicious-activity
Malicious Host HoneyDB 2026-02-11 00:00:00 2026-04-04 00:00:00 attacker malicious-activity
FTP Attacker AbuseIPDB 2026-02-12 05:41:43 2026-03-31 04:41:57 attacker malicious-activity
SIP Attacker Blocklist.de 2026-03-30 09:00:38 2026-03-30 09:00:38 attacker malicious-activity
SQL Injection AbuseIPDB 2026-03-23 13:09:01 2026-03-23 13:09:01 malicious-activity
Anonymizer Maltiverse Research Team 2020-11-22 00:50:50 2021-05-23 14:07:39 anonymizer
Anonymizer Maltiverse 2019-09-26 08:20:56 2019-09-26 08:20:56

Tags

anonymizer ssh bruteforce bot sip attacker abuse

Whois information

AS name
AS14061 DigitalOcean, LLC
AS registry
arin
AS date
2017-07-07 00:00:00
AS CIDR
159.89.112.0/20
CIDR
159.89.0.0/16
Registrant
DigitalOcean, LLC
Address
101 Ave of the Americas 10th Floor
City
Toronto
State
NY
Postal code
M4R
Country
CA — Canada 🇨🇦
Contact email
[email protected], [email protected]
First indexed
2019-09-26 08:20:56
Last updated
2026-11-03 16:50:14

Malicious IPs in the same CIDR

159.89.116.219 159.89.125.248 159.89.116.189 159.89.126.159 159.89.124.112 159.89.124.118 159.89.123.203 159.89.125.145 159.89.117.21 159.89.114.95 159.89.117.170 159.89.118.173 159.89.119.139 159.89.121.75 159.89.118.21 159.89.117.122 159.89.116.42 159.89.116.120 159.89.117.68 159.89.127.165 159.89.115.143 159.89.113.99 159.89.120.168 159.89.118.214 159.89.125.44