JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 159.203.42.98

159.203.42.98 was found in our database!

This IP was reported 43 times. Confidence of Abuse is 100%: ?

100%

ISP	DigitalOcean, LLC
Usage Type	Data Center/Web Hosting/Transit
ASN	AS14061
Domain Name	digitalocean.com
Country	🇨🇦 Canada
City	Toronto, Ontario

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 159.203.42.98

Whois 159.203.42.98

IP Abuse Reports for 159.203.42.98:

This IP address has been reported a total of 43 times from 32 distinct sources. 159.203.42.98 was first reported on April 14th 2026, and the most recent report was 1 hour ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇩🇪 mravb	2026-08-22 09:41:22 (1 hour ago)	159.203.42.98 - - [22/Aug/2026:12:41:21 +0300] "GET //xmlrpc.php?rsd HTTP/1.1" 404 150 "-" "Mozilla/ ... show more 159.203.42.98 - - [22/Aug/2026:12:41:21 +0300] "GET //xmlrpc.php?rsd HTTP/1.1" 404 150 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.149 Safari/537.36" ... show less	Web App Attack Hacking
🇩🇪 ger-stg-sifi1	2026-08-22 08:36:30 (2 hours ago)	(wordpress) Failed wordpress login using wp-login.php or xmlrpc.php	Web App Attack
Anonymous	2026-08-22 03:57:04 (6 hours ago)	Bot / scanning and/or hacking attempts: POST //xmlrpc.php HTTP/1.1, GET //wp-json/wp/v2/users/ HTTP/ ... show more Bot / scanning and/or hacking attempts: POST //xmlrpc.php HTTP/1.1, GET //wp-json/wp/v2/users/ HTTP/1.1, GET //wp-includes/wlwmanifest.xml HTTP/1.1, GET //xmlrpc.php?rsd HTTP/1.1 show less	Hacking Web App Attack
🇩🇪 maxpower	2026-08-22 03:50:34 (7 hours ago)	(PERMBLOCK) 159.203.42.98 (CA/Canada/-) has had more than 4 temp blocks in the last 86400 secs; Port ... show more (PERMBLOCK) 159.203.42.98 (CA/Canada/-) has had more than 4 temp blocks in the last 86400 secs; Ports: *; Direction: inout; Trigger: LF_PERMBLOCK_COUNT; Logs: show less	Port Scan
🇩🇪 psauxit	2026-08-22 03:20:39 (7 hours ago)	Fail2Ban - NGINX 403 forcing to access a restricted resource	Hacking
🇩🇪 Interceptor_HQ	2026-08-22 02:54:15 (7 hours ago)	request_uri: /wp-includes/wlwmanifest.xml -- automatic report --	Brute-Force Hacking
🇩🇪 big-cloud.nl	2026-08-22 02:26:17 (8 hours ago)	Try to access /xmlrpc.php?rsd	Web App Attack
🇩🇪 4server	2026-08-22 02:07:37 (8 hours ago)	[2026-08-2203:59:15 0200]info[webmaild]35.185.44.197--\"GET/application.ymlHTTP/1.1\"FAILEDLOGINwebm ... show more [2026-08-2203:59:15 0200]info[webmaild]35.185.44.197--\"GET/application.ymlHTTP/1.1\"FAILEDLOGINwebmaild:loginattemptwithoutusername[2026-08-2203:59:15 0200]info[webmaild]35.185.44.197--\"GET/keys/service-account.jsonHTTP/1.1\"FAILEDLOGINwebmaild:loginattemptwithoutusername[2026-08-2203:59:15 0200]info[webmaild]35.185.44.197--\"GET/firebase-config.jsonHTTP/1.1\"FAILEDLOGINwebmaild:loginattemptwithoutusername[2026-08-2203:59:15 0200]info[webmaild]35.185.44.197--\"GET/env.jsHTTP/1.1\"FAILEDLOGINwebmaild:loginattemptwithoutusername[2026-08-2203:59:15 0200]info[webmaild]35.185.44.197--\"GET/key.pemHTTP/1.1\"FAILEDLOGINwebmaild:loginattemptwithoutusername[2026-08-2204:07:32 0200]info[cpaneld]159.203.42.98--\"GET/wp-includes/wlwmanifest.xmlHTTP/1.1\"FAILEDLOGINcpaneld:loginattemptwithoutusernameIPAddressesBlocked:35.185.44.197\(US/UnitedStates/197.44.185.35.bc.googleusercontent.com\) show less	Port Scan Brute-Force Web App Attack
Anonymous	2026-08-22 02:07:02 (8 hours ago)	Automated web scanner. Requested suspicious paths: //wp-includes/wlwmanifest.xml. UTC: 2026-08-22 01 ... show more Automated web scanner. Requested suspicious paths: //wp-includes/wlwmanifest.xml. UTC: 2026-08-22 01:14:46. show less	Web App Attack
Anonymous	2026-08-22 01:53:22 (8 hours ago)	Ports: 2077,2078,2082,2083,2086,2087,2095,2096; Direction: 0; Trigger: LF_CPANEL	Brute-Force SSH
🇩🇪 4server	2026-08-22 01:51:26 (8 hours ago)	[2026-08-2203:51:18 0200]info[cpaneld]159.203.42.98--\"GET/wp-includes/wlwmanifest.xmlHTTP/1.1\"FAIL ... show more [2026-08-2203:51:18 0200]info[cpaneld]159.203.42.98--\"GET/wp-includes/wlwmanifest.xmlHTTP/1.1\"FAILEDLOGINcpaneld:loginattemptwithoutusername[2026-08-2203:51:18 0200]info[cpaneld]159.203.42.98--\"GET/blog/wp-includes/wlwmanifest.xmlHTTP/1.1\"FAILEDLOGINcpaneld:loginattemptwithoutusername[2026-08-2203:51:18 0200]info[cpaneld]159.203.42.98--\"GET/wordpress/wp-includes/wlwmanifest.xmlHTTP/1.1\"FAILEDLOGINcpaneld:loginattemptwithoutusername[2026-08-2203:51:19 0200]info[cpaneld]159.203.42.98--\"GET/wp/wp-includes/wlwmanifest.xmlHTTP/1.1\"FAILEDLOGINcpaneld:loginattemptwithoutusername[2026-08-2203:51:19 0200]info[cpaneld]159.203.42.98--\"GET/2018/wp-includes/wlwmanifest.xmlHTTP/1.1\"FAILEDLOGINcpaneld:loginattemptwithoutusername show less	Port Scan Brute-Force Web App Attack
🇧🇪 taivas.nl	2026-08-22 01:02:24 (9 hours ago)	Bad_requests	Bad Web Bot
🇫🇮 pixiekat	2026-08-22 00:50:53 (9 hours ago)	[Sat Aug 22 01:50:52.861077 2026] [authz_core:error] [pid 748759:tid 748869] [client 159.203.42.98:5 ... show more [Sat Aug 22 01:50:52.861077 2026] [authz_core:error] [pid 748759:tid 748869] [client 159.203.42.98:55762] AH01630: client denied by server configuration: /mnt/HC_Volume_105148208/vhosts/baikal/html/ [Sat Aug 22 01:50:52.988590 2026] [authz_core:error] [pid 748759:tid 748861] [client 159.203.42.98:55762] AH01630: client denied by server configuration: /mnt/HC_Volume_105148208/vhosts/baikal/html/wp-includes [Sat Aug 22 01:50:53.116324 2026] [authz_core:error] [pid 748759:tid 748862] [client 159.203.42.98:55762] AH01630: client denied by server configuration: /mnt/HC_Volume_105148208/vhosts/baikal/html/xmlrpc.php [Sat Aug 22 01:50:53.244070 2026] [authz_core:error] [pid 748759:tid 748876] [client 159.203.42.98:55762] AH01630: client denied by server configuration: /mnt/HC_Volume_105148208/vhosts/baikal/html/ [Sat Aug 22 01:50:53.371718 2026] [authz_core:error] [pid 748759:tid 748866] [client 159.203.42.98:55762] AH01630: client denied by server configuration: /mnt/HC_Volume_105148208/vhos ... show less	Brute-Force
🇵🇱 mscode.pl	2026-08-21 23:28:25 (11 hours ago)	Triggered Cloudflare WAF (firewallCustom) from CA. Action taken: CHALLENGE ASN: 14061 (DigitalOcean, ... show more Triggered Cloudflare WAF (firewallCustom) from CA. Action taken: CHALLENGE ASN: 14061 (DigitalOcean, LLC) Protocol: HTTP/1.1 (GET method) Zone: cp.mscode.pl Endpoint: //media/wp-includes/wlwmanifest.xml UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.149 Safari/537.36 show less	Bad Web Bot
🇦🇺 screwlooseit.com.au	2026-08-21 22:58:44 (11 hours ago)	Blocked by CSF 13 firewall - Rule: XMLRPC CA/Canada/-	Web App Attack

Showing 1 to 15 of 43 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇩🇪 194.187.176.53

🇰🇷 175.212.144.221

🇺🇸 172.253.251.116

🇺🇸 172.182.200.96

🇫🇷 169.58.197.254

🇺🇸 162.216.150.65

🇧🇷 148.227.123.78

🇵🇰 125.209.97.230

🇲🇲 103.138.253.15

🇮🇩 103.90.27.83

🇱🇾 102.38.3.104

🇸🇪 94.255.255.26

🇳🇱 91.92.40.151

🇷🇺 88.84.209.146

🇵🇹 87.103.126.54

🇫🇮 62.238.49.99

🇫🇷 2001:41d0:303:869a::1

🇰🇷 222.116.11.230

🇷🇺 213.234.9.218

🇺🇸 166.62.41.13