Report for IP: 64.89.163.153

Threat LevelHIGH63/1002 rule types across 2 attack categories
35 incidents · 2 rule types · confirmed on global blocklist · persistent 79-day campaign · last seen 4d ago
PTR N/A
Org / ASN 10GIG.host
Country 🇩🇪 Germany
City Frankfurt am Main, Hesse
Timezone Europe/Berlin

Attack Analysis

IDS: Blocklist — Spamhaus DROP
This IP is on the Spamhaus DROP list — a dataset of netblocks hijacked or leased by professional spam and cybercrime operations with no legitimate users. Traffic from DROP-listed ranges is considered hostile by design. Blocking is unconditional.
IDS: Database Port Scan
Suricata detected this IP scanning database ports (MySQL, PostgreSQL, Redis, MongoDB). This is reconnaissance to find exposed database services for direct exploitation or credential brute-force. Database ports should never be reachable from the internet.

Reports (35)

Date Severity Description
26 Sep 2026 - 03:54 high IDS: Blocklist — Spamhaus DROP listed IP — ET DROP Spamhaus DROP Listed Traffic Inbound group 10
26 Sep 2026 - 03:54 high IDS: Database port scan — ET SCAN Suspicious inbound to mySQL port 3306
16 Sep 2026 - 15:47 high IDS: Blocklist — Spamhaus DROP listed IP — ET DROP Spamhaus DROP Listed Traffic Inbound group 9
16 Sep 2026 - 15:47 high IDS: Database port scan — ET SCAN Suspicious inbound to mySQL port 3306
12 Sep 2026 - 18:37 high IDS: Blocklist — Spamhaus DROP listed IP — ET DROP Spamhaus DROP Listed Traffic Inbound group 9
12 Sep 2026 - 18:37 high IDS: Database port scan — ET SCAN Suspicious inbound to mySQL port 3306
11 Sep 2026 - 05:45 high IDS: Database port scan — ET SCAN Suspicious inbound to mySQL port 3306
11 Sep 2026 - 05:45 high IDS: Blocklist — Spamhaus DROP listed IP — ET DROP Spamhaus DROP Listed Traffic Inbound group 9
10 Sep 2026 - 08:10 high IDS: Blocklist — Spamhaus DROP listed IP — ET DROP Spamhaus DROP Listed Traffic Inbound group 9
10 Sep 2026 - 08:10 high IDS: Database port scan — ET SCAN Suspicious inbound to mySQL port 3306
29 Aug 2026 - 19:33 high IDS: Blocklist — Spamhaus DROP listed IP — ET DROP Spamhaus DROP Listed Traffic Inbound group 9
29 Aug 2026 - 19:33 high IDS: Database port scan — ET SCAN Suspicious inbound to mySQL port 3306
23 Aug 2026 - 17:34 high IDS: Blocklist — Spamhaus DROP listed IP — ET DROP Spamhaus DROP Listed Traffic Inbound group 9
23 Aug 2026 - 17:34 high IDS: Database port scan — ET SCAN Suspicious inbound to mySQL port 3306
22 Aug 2026 - 10:27 high IDS: Blocklist — Spamhaus DROP listed IP — ET DROP Spamhaus DROP Listed Traffic Inbound group 9
22 Aug 2026 - 10:27 high IDS: Database port scan — ET SCAN Suspicious inbound to mySQL port 3306
20 Aug 2026 - 08:43 high IDS: Blocklist — Spamhaus DROP listed IP — ET DROP Spamhaus DROP Listed Traffic Inbound group 9
20 Aug 2026 - 08:43 high IDS: Database port scan — ET SCAN Suspicious inbound to mySQL port 3306
16 Aug 2026 - 10:17 high IDS: Blocklist — Spamhaus DROP listed IP — ET DROP Spamhaus DROP Listed Traffic Inbound group 9
16 Aug 2026 - 10:17 high IDS: Database port scan — ET SCAN Suspicious inbound to mySQL port 3306

Related IPs — Same /24 Block (64.89.163.0/24)

64.89.163.247HIGH53 reports64.89.163.235HIGH81 reports64.89.163.130HIGH36 reports64.89.163.132HIGH55 reports64.89.163.85HIGH40 reports64.89.163.86HIGH61 reports64.89.163.168HIGH40 reports64.89.163.169HIGH39 reports
Part of EagleEye Intelligence