AbuseIPDB » 128.199.158.142

128.199.158.142 was found in our database!

This IP was reported 43 times. Confidence of Abuse is 59%: ?

59%

ISP	DigitalOcean LLC
Usage Type	Data Center/Web Hosting/Transit
Domain Name	digitalocean.com
Country	Singapore
City	Singapore, Singapore

IP info including ISP, Usage Type, and Location provided by IP2Location. Updated monthly.

Report 128.199.158.142

Whois 128.199.158.142

IP Abuse Reports for 128.199.158.142:

This IP address has been reported a total of 43 times from 23 distinct sources. 128.199.158.142 was first reported on August 28th 2024, and the most recent report was 1 week ago.

Old Reports: The most recent abuse report for this IP address is from 1 week ago. It is possible that this IP is no longer involved in abusive activities.

Reporter	IoA Timestamp in UTC	Comment	Categories
TPI-Abuse	2024-09-25 14:50:42 (1 week ago)	(mod_security) mod_security (id:225170) triggered by 128.199.158.142 (-): 1 in the last 300 secs; Po ... show more(mod_security) mod_security (id:225170) triggered by 128.199.158.142 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Sep 25 10:50:35.603250 2024] [security2:error] [pid 23016:tid 23041] [client 128.199.158.142:56425] [client 128.199.158.142] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)\|\|www.illianaphotobooth.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "www.illianaphotobooth.com"] [uri "/wp-json/wp/v2/users/"] [unique_id "ZvQjO511ydy_2JT_SNAeSwAAANc"] show less	Brute-Force Bad Web Bot Web App Attack
Anonymous	2024-09-17 00:42:06 (2 weeks ago)	Ports: 80,443; Direction: 0; Trigger: LF_CUSTOMTRIGGER	Brute-Force SSH
Anonymous	2024-09-14 02:55:54 (3 weeks ago)	wordpress-trap	Web App Attack
mnsf	2024-09-12 13:07:30 (3 weeks ago)	Login Too Frequent (7)	Brute-Force Web App Attack
Mendip_Defender	2024-09-12 12:48:39 (3 weeks ago)	128.199.158.142 - - [12/Sep/2024:13:48:41 +0100] "GET //wp-includes/wlwmanifest.xml HTTP/1.0" 404 17 ... show more128.199.158.142 - - [12/Sep/2024:13:48:41 +0100] "GET //wp-includes/wlwmanifest.xml HTTP/1.0" 404 1737 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4240.193 Safari/537.36" 128.199.158.142 - - [12/Sep/2024:13:48:45 +0100] "GET //blog/wp-includes/wlwmanifest.xml HTTP/1.0" 404 1737 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4240.193 Safari/537.36" ... show less	Hacking Web App Attack
hermawan	2024-09-11 12:36:24 (3 weeks ago)	[Wed Sep 11 19:32:29.721022 2024] [security2:error] [pid 5431:tid 131331409315520] [client 128.199.1 ... show more[Wed Sep 11 19:32:29.721022 2024] [security2:error] [pid 5431:tid 131331409315520] [client 128.199.158.142:57587] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "uploads" at REQUEST_URI. [file "/etc/modsecurity/coreruleset-4.5.0/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "193"] [id "440235"] [msg "Coba hack Wordpress "] [data "Matched Data: uploads found within REQUEST_URI: /uploads/ALFA_DATA/alfacgiapi/py.alfa request_line = POST /uploads/ALFA_DATA/alfacgiapi/py.alfa HTTP/1.1"] [severity "NOTICE"] [hostname "staklim-jatim.bmkg.go.id"] [uri "/uploads/ALFA_DATA/alfacgiapi/py.alfa"] [unique_id "ZuGN3bxgDDfI9EsakIKlOwAAAMs"] [staklim-jatim.bmkg.go.id] [staklim-jatim.bmkg.go.id] top=[5489] [smv0LldCTCc] [ZuGN3bxgDDfI9EsakIKlOwAAAMs] keep_alive=[0] [2024-09-11 19:32:29.721027] [R:ZuGN3bxgDDfI9EsakIKlOwAAAMs] UA:'Mozilla/5.0 (Linux; Android 11; Redmi Note 9 Pro Build/RKQ1.200826.002; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/90.0.4430.210 Mobi ... show less	Hacking Web App Attack
niceshops.com	2024-09-10 14:44:43 (3 weeks ago)	Web Attack (Sep 24 16:44:43 ScriptKiddie: request for /wp-admin/js/about.php7 )	SQL Injection Brute-Force Bad Web Bot Web App Attack
Rizzy	2024-09-10 12:49:28 (3 weeks ago)	Multiple WAF Violations	Brute-Force Web App Attack
Burayot	2024-09-09 20:35:37 (3 weeks ago)	LF_APACHE_403: 128.199.158.142 (SG/Singapore/-), more than 30 Apache 403 hits in the last 3600 secs	Web App Attack
niceshops.com	2024-09-09 04:50:20 (3 weeks ago)	Web Attack (Sep 24 06:50:20 ScriptKiddie: request for /wp-content/alfacgiapi/perl.alfa )	SQL Injection Brute-Force Bad Web Bot Web App Attack
niceshops.com	2024-09-08 14:03:17 (4 weeks ago)	Web Attack (Sep 24 16:03:16 ScriptKiddie: request for /wp-content/alfacgiapi/perl.alfa )	SQL Injection Brute-Force Bad Web Bot Web App Attack
el-brujo	2024-09-08 00:29:42 (4 weeks ago)	Cloudflare WAF: Request Path: /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php Request Query: Ho ... show moreCloudflare WAF: Request Path: /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php Request Query: Host: elhacker.net userAgent: python-requests/2.32.3 Action: block Source: firewallManaged ASN Description: DIGITALOCEAN-ASN Country: SG Method: GET Timestamp: 2024-09-08T00:29:42Z ruleId: db1f213645904ab9b16b227b4a6a7b3a. Report generated by Cloudflare-WAF-to-AbuseIPDB (https://github.com/MHG-LAB/Cloudflare-WAF-to-AbuseIPDB). show less	Hacking SQL Injection Web App Attack
ardexter	2024-09-07 04:38:33 (4 weeks ago)	Wordpress attack and DDOS	DDoS Attack Web App Attack
Anonymous	2024-09-06 06:10:35 (1 month ago)	Ports: 80,443; Direction: 0; Trigger: LF_CUSTOMTRIGGER	Brute-Force SSH
Burayot	2024-09-06 05:31:36 (1 month ago)	LF_APACHE_403: 128.199.158.142 (SG/Singapore/-), more than 30 Apache 403 hits in the last 3600 secs	Web App Attack