JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

159.203.106.183

Neutral Activity

Abuse confidence score ?

0% Low Risk

91 reports

59 reporters · latest 11 months ago

ISP	DigitalOcean, LLC
Usage Type	Data Center/Web Hosting/Transit
ASN	AS14061
Domain Name	digitalocean.com
Country	🇺🇸 United States of America
City	Clifton, New Jersey

ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report Whois

No reports in the last 60 days

159.203.106.183 has been reported 91 times. The most recent report is from 11 months ago.

The full history is preserved below and remains searchable. A 0% score reflects the absence of recent activity, but this is not a guarantee that earlier reports were invalid. Abuse confidence score decays, naturally, over time, when the abusive activity stops.

IP Abuse Reports for 159.203.106.183

Export CSV

This IP address has been reported a total of 91 times from 59 distinct sources. 159.203.106.183 was first reported on February 13th 2024, and the most recent report was 11 months ago.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇧🇪 sid3windr	2025-10-17 20:06:34 (11 months ago)	GET /.env (Tarpitted for 1d15h8m29s, wasted 8.06MB)	Web App Attack
🇺🇸 chronos	2025-10-17 19:39:35 (11 months ago)	[AUTORAVALT][[17/10/2025 - 16:39:35 -03:00 UTC] Attack from [DigitalOcean, LLC] [159.203.106.183] Ac ... show more [AUTORAVALT][[17/10/2025 - 16:39:35 -03:00 UTC] Attack from [DigitalOcean, LLC] [159.203.106.183] Action: BLocKed Hacking... Unauthorized attempts to access the server. Web App Attack -> Attempts to probe for or exploit installed web applications such as a CMS like WordPress/Drupal, e-commerce solutions, forum software, phpMyAdmin and various other software pl] ... show less	Hacking Web App Attack
🇺🇸 chronos	2025-10-17 19:14:34 (11 months ago)	[AUTORAVALT][[17/10/2025 - 16:14:33 -03:00 UTC] Attack from [DigitalOcean, LLC] [159.203.106.183] Ac ... show more [AUTORAVALT][[17/10/2025 - 16:14:33 -03:00 UTC] Attack from [DigitalOcean, LLC] [159.203.106.183] Action: BLocKed DDoS Attack -> Participating in distributed denial-of-service. Phishing -> Phishing websites and/or email. Web Spam -> Comment/forum spam, HTTP referer spam, or other CMS spam. Blog Spam -> CMS blog comment spam. Web App Attack -> Attempts to probe] ... show less	DDoS Attack Phishing Web Spam Blog Spam Web App Attack
🇧🇾 lns.bz	2025-10-16 16:59:01 (11 months ago)	Web app attack	Exploited Host Web App Attack
🇵🇱 dzpk	2025-10-16 15:32:33 (11 months ago)	159.203.106.183 - - [16/Oct/2025:17:32:33 +0200] "GET /.env HTTP/1.1" 400 248 "-" "Mozilla/5.0; Keyd ... show more 159.203.106.183 - - [16/Oct/2025:17:32:33 +0200] "GET /.env HTTP/1.1" 400 248 "-" "Mozilla/5.0; Keydrop.io/1.0(onlyscans.com/about);" show less	Web App Attack
Anonymous	2025-10-16 14:18:41 (11 months ago)	Bot / scanning and/or hacking attempts: GET /.git/config HTTP/1.1, GET /.env HTTP/1.1, GET / HTTP/1. ... show more Bot / scanning and/or hacking attempts: GET /.git/config HTTP/1.1, GET /.env HTTP/1.1, GET / HTTP/1.0 show less	Hacking Web App Attack
🇳🇱 bontekoe.technology	2025-10-16 14:12:46 (11 months ago)	159.203.106.183 banned on rtr - Threshold reached: 5 failures	Web App Attack
🇩🇰 castipo	2025-10-16 14:03:49 (11 months ago)	nginx-botsearch :: 159.203.106.183 - - [16/Oct/2025:13:24:13 +0700] "GET /.env HTTP/1.1" 301 162 "-" ... show more nginx-botsearch :: 159.203.106.183 - - [16/Oct/2025:13:24:13 +0700] "GET /.env HTTP/1.1" 301 162 "-" "Mozilla/5.0; Keydrop.io/1.0(onlyscans.com/about);" 159.203.106.183 - [ip] "GET /.env HTTP/1.1" 301 162 "-" "Mozilla/5.0; Keydrop.io/1.0(onlyscans.com/about);" cfip=- cfray=- 159.203.106.183 - - [16/Oct/2025:13:24:13 +0700] "GET /.git/config HTTP/1.1" 301 162 "-" "Mozilla/5.0; Keydrop.io/1.0(onlyscans.com/about);" 159.203.106.183 - [ip] "GET /.git/config HTTP/1.1" 301 162 "-" "Mozilla/5.0; Keydrop.io/1.0(onlyscans.com/about);" cfip=- cfray=- 159.203.106.183 - - [16/Oct/2025:21:03:35 +0700] "GET /.env HTTP/1.1" 403 118 "-" "Mozilla/5.0; Keydrop.io/1.0(onlyscans.com/about);" show less	Port Scan Hacking Web App Attack
🇺🇸 kuj	2025-10-16 12:32:47 (11 months ago)	2025-10-16T06:32:46.715375-06:00 derp derper[549]: 2025/10/16 06:32:46 http: TLS handshake error fro ... show more 2025-10-16T06:32:46.715375-06:00 derp derper[549]: 2025/10/16 06:32:46 http: TLS handshake error from 159.203.106.183:48502: acme/autocert: missing server name 2025-10-16T06:32:46.852379-06:00 derp derper[549]: 2025/10/16 06:32:46 http: TLS handshake error from 159.203.106.183:48508: client sent an HTTP request to an HTTPS server 2025-10-16T06:32:46.986168-06:00 derp derper[549]: 2025/10/16 06:32:46 http: TLS handshake error from 159.203.106.183:48516: acme/autocert: missing server name ... show less	Port Scan Brute-Force
Anonymous	2025-10-16 12:18:17 (11 months ago)	Fuzzing/Looking for credentials files.	Brute-Force Web App Attack
🇳🇱 Study Bitcoin 🤗	2025-10-16 12:02:57 (11 months ago)	Port probe to tcp/443 (https) [srv126]	Port Scan Brute-Force Bad Web Bot Web App Attack
🇩🇪 oh.mg	2025-10-16 11:05:22 (11 months ago)	[Thu Oct 16 13:05:21.387673 2025] [security2:error] [pid 590228:tid 590250] [client 159.203.106.183: ... show more [Thu Oct 16 13:05:21.387673 2025] [security2:error] [pid 590228:tid 590250] [client 159.203.106.183:41900] [client 159.203.106.183] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:blocking_inbound_anomaly_score. [file "/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "233"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 8)"] [ver "OWASP_CRS/4.10.0-dev"] [tag "anomaly-evaluation"] [tag "OWASP_CRS"] [hostname "95.216.72.247"] [uri "/.env"] [unique_id "aPDRce-sBgXuahS_gmR1RAAAAA0"] ... show less	Bad Web Bot Web App Attack
🇺🇸 www.winos.me	2025-10-16 10:57:35 (11 months ago)	stream fail	Web App Attack
🇺🇸 kuj	2025-10-16 09:25:15 (11 months ago)	2025-10-16T03:25:14.259085-06:00 derpamp-oci derper[3407]: 2025/10/16 03:25:14 http: TLS handshake e ... show more 2025-10-16T03:25:14.259085-06:00 derpamp-oci derper[3407]: 2025/10/16 03:25:14 http: TLS handshake error from 159.203.106.183:46404: acme/autocert: missing server name 2025-10-16T03:25:14.398540-06:00 derpamp-oci derper[3407]: 2025/10/16 03:25:14 http: TLS handshake error from 159.203.106.183:46406: client sent an HTTP request to an HTTPS server 2025-10-16T03:25:14.589764-06:00 derpamp-oci derper[3407]: 2025/10/16 03:25:14 http: TLS handshake error from 159.203.106.183:46422: acme/autocert: missing server name ... show less	Port Scan Brute-Force
🇳🇱 jaapeldoorn	2025-10-16 09:08:58 (11 months ago)	[Thu Oct 16 06:28:14.768925 2025] [authz_core:error] [pid 587278:tid 587323] [client 159.203.106.183 ... show more [Thu Oct 16 06:28:14.768925 2025] [authz_core:error] [pid 587278:tid 587323] [client 159.203.106.183:53894] AH01630: client denied by server configuration: /var/www [Thu Oct 16 06:28:14.951525 2025] [authz_core:error] [pid 587277:tid 587297] [client 159.203.106.183:53908] AH01630: client denied by server configuration: /var/www [Thu Oct 16 11:08:56.956850 2025] [authz_core:error] [pid 587278:tid 587327] [client 159.203.106.183:45522] AH01630: client denied by server configuration: /var/www ... show less	Brute-Force

Showing 1 to 15 of 91 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇧🇷 137.131.208.99

🇧🇷 186.215.245.175

🇧🇴 181.115.151.221

🇲🇦 160.177.21.7

🇺🇸 129.146.116.242

🇳🇱 109.160.32.116

🇳🇱 109.160.32.36

🇲🇲 103.121.226.55

🇩🇪 94.26.106.143

🇧🇬 78.128.112.30

🇺🇸 74.125.229.167

🇸🇬 43.173.179.112

🇸🇬 43.173.173.90

🇳🇱 192.42.116.118

🇧🇷 186.207.158.137

🇧🇷 177.91.119.59

🇺🇸 162.216.150.61

🇰🇷 121.133.167.123

🇺🇸 104.248.115.131

🇩🇪 94.183.174.99