JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

159.223.48.48

Recent Activity

Abuse Confidence Score

100% Critical

61 reports

52 reporters · latest 1 hour ago

ISP: DigitalOcean, LLC
Usage Type: Data Center/Web Hosting/Transit
ASN: AS14061
Domain Name: digitalocean.com
Country: 🇸🇬 Singapore
City: Singapore

ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report Whois

Example preview

Account required for the enhanced features Log in Sign up

Abuse Reports

Export reports CSV

Total reports

61 from 52 distinct reporters

First reported

November 13th 2026

Most recent report

1 hour ago

Last 60 days

Top reporter locations 🇺🇸 United States of America 12 🇩🇪 Germany 11 🇫🇷 France 10

Most common categories Web App Attack 43 Bad Web Bot 31 Hacking 11 Brute-Force 8 SSH 1

Recent reports We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇺🇸 FreeMyIP	2026-11-14 16:02:22 UTC · (1 hour ago)	Automated fail2ban report: web application attack / scanning for exploitable paths.	Bad Web Bot Web App Attack
🇻🇮 Axel	2026-11-14 15:23:01 UTC · (1 hour ago)	WAF/ModSecurity blocked 12 malicious request(s) (HTTP 403) from this IP. Activity: request_uri: Images folder - prevent PHP files from executing x7; Malware x3; request_uri: prevent PHP files from executing x1; request_uri: ModX - prevent PHP files f ... show more WAF/ModSecurity blocked 12 malicious request(s) (HTTP 403) from this IP. Activity: request_uri: Images folder - prevent PHP files from executing x7; Malware x3; request_uri: prevent PHP files from executing x1; request_uri: ModX - prevent PHP files from executing x1. Latest: 2026-11-14T15:23:01Z. show less	Hacking Web App Attack
🇬🇧 thetomtaylor.co.uk	2026-11-14 14:07:59 UTC · (3 hours ago)	Fail2Ban - [WEB]Custom exploit pattern detected on customexploits ... [ice01,ice02,wa01,wa02]	Hacking Brute-Force Bad Web Bot Web App Attack
🇬🇧 pinguin	2026-11-14 14:06:34 UTC · (3 hours ago)	Triggered Cloudflare WAF (firewallManaged) from SG. Action taken: BLOCK Protocol: HTTP/1.1 (GET method) Endpoint: //cache/cache/cache.php UA: Mozlila/5.0 (Linux; Android 7.0; SM-G892A Bulid/NRD90M; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4 ... show more Triggered Cloudflare WAF (firewallManaged) from SG. Action taken: BLOCK Protocol: HTTP/1.1 (GET method) Endpoint: //cache/cache/cache.php UA: Mozlila/5.0 (Linux; Android 7.0; SM-G892A Bulid/NRD90M; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/60.0.3112.107 Moblie Safari/537.36 This report was generated by: https://github.com/sefinek/Cloudflare-WAF-To-AbuseIPDB show less	Bad Web Bot
🇺🇸 dot.mg	2026-11-14 14:06:06 UTC · (3 hours ago)	Scan of vulnerable files	Web App Attack
🇺🇸 Rocky Mountain Bioengineering Symposium	2026-11-14 14:04:57 UTC · (3 hours ago)	[Sat Nov 14 07:04:46.549070 2026] [authz_core:error] [pid 65931:tid 140557292660288] [client 159.223.48.48:56022] AH01630: client denied by server configuration: /var/www/public_html/journal/images, referer: www.google.com [Sat Nov 14 07:04:46.554285 ... show more [Sat Nov 14 07:04:46.549070 2026] [authz_core:error] [pid 65931:tid 140557292660288] [client 159.223.48.48:56022] AH01630: client denied by server configuration: /var/www/public_html/journal/images, referer: www.google.com [Sat Nov 14 07:04:46.554285 2026] [authz_core:error] [pid 65931:tid 140557292660288] [client 159.223.48.48:56022] AH01630: client denied by server configuration: /var/www/public_rsrc/assets/RMBS-Server-Error.html, referer: www.google.com [Sat Nov 14 07:04:57.030203 2026] [authz_core:error] [pid 65931:tid 140555673654848] [client 159.223.48.48:56310] AH01630: client denied by server configuration: /usr/lib/cgi-bin/cgi-bin, referer: www.google.com ... show less	Bad Web Bot
Anonymous	2026-11-14 13:21:49 UTC · (3 hours ago)	Web attack blocked by WAF: GET //images/images/cache.php, GET //images/images/images/images/images/images/images/images/cache.php, GET //images/images/images/images/images/images/images/cache.php (Infectors: Suspicious access attempt (webshell)!). [1 ... show more Web attack blocked by WAF: GET //images/images/cache.php, GET //images/images/images/images/images/images/images/images/cache.php, GET //images/images/images/images/images/images/images/cache.php (Infectors: Suspicious access attempt (webshell)!). [14/Nov/2026:16:20:51 +0300] "GET //images/images/cache.php HTTP/1.1" UA="Mozlila/5.0 (Linux; Android 7.0; SM-G892A Bulid/NRD90M; wv) AppleWebKit/537.36 (" -> Infectors: Suspicious access attempt (webshell)! [14/Nov/2026:16:21:20 +0300] "GET //images/images/images/images/images/images/images/images/cache.php HTTP/1.1" UA="Mozlila/5.0 (Linux; Android 7.0; SM-G892A Bulid/NRD90M; wv) AppleWebKit/537.36 (" -> Infectors: Suspicious access attempt (webshell)! [14/Nov/2026:16:21:38 +0300] "GET //images/images/images/images/images/images/images/cache.php HTTP/1.1" UA="Mozlila/5.0 (Linux; Android 7.0; SM-G892A Bulid/NRD90M; wv) AppleWebKit/537.36 (" -> Infectors: Suspicious access attempt (webshell)! show less	Web App Attack
🇦🇺 A.i.D.A.N.N	2026-11-14 13:09:47 UTC · (4 hours ago)	A.i.D.A.N.N: Anomaly Detected - Signature match Web Service - Web application attack detected	Web App Attack
🇺🇸 factor1	2026-11-14 11:39:27 UTC · (5 hours ago)	CrowdSec at sherman Reports Abuse	Web App Attack
🇮🇹 VHosting	2026-11-14 09:40:08 UTC · (7 hours ago)	Detected WordPress attack from different servers	Brute-Force Web App Attack
🇹🇭 Sawasdee	2026-11-14 08:27:13 UTC · (8 hours ago)	Unwanted checking 80 or 443 port ...	Bad Web Bot
🇩🇪 altenglaner	2026-11-14 07:27:08 UTC · (9 hours ago)	Web scanner probing for sensitive files (.env, .git, backups) or path traversal. Reported by fail2ban.	Hacking Web App Attack
🇦🇺 aranguren.org	2026-11-14 06:16:10 UTC · (11 hours ago)	159.223.48.48 - - [14/Nov/2026:17:15:59 +1100] "GET //images/images/cache.php HTTP/1.1" 404 1098 "www.google.com" "Mozlila/5.0 (Linux; Android 7.0; SM-G892A Bulid/NRD90M; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/60.0.3112.107 Mob ... show more 159.223.48.48 - - [14/Nov/2026:17:15:59 +1100] "GET //images/images/cache.php HTTP/1.1" 404 1098 "www.google.com" "Mozlila/5.0 (Linux; Android 7.0; SM-G892A Bulid/NRD90M; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/60.0.3112.107 Moblie Safari/537.36" 159.223.48.48 - - [14/Nov/2026:17:16:04 +1100] "GET //cgi-bin/cgi-bin/cgi-bin/cgi-bin/cache.php HTTP/1.1" 404 1098 "www.google.com" "Mozlila/5.0 (Linux; Android 7.0; SM-G892A Bulid/NRD90M; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/60.0.3112.107 Moblie Safari/537.36" 159.223.48.48 - - [14/Nov/2026:17:16:09 +1100] "GET //images/images/images/images/images/images/images/images/cache.php HTTP/1.1" 404 1098 "www.google.com" "Mozlila/5.0 (Linux; Android 7.0; SM-G892A Bulid/NRD90M; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/60.0.3112.107 Moblie Safari/537.36" ... show less	Bad Web Bot
Anonymous	2026-11-14 05:55:50 UTC · (11 hours ago)	159.223.48.48 - - [14/Nov/2026:05:55:50 +0000] "GET /cgi-bin/cgi-bin/cgi-bin/cgi-bin/cache.php HTTP/1.1" 404 35939 "www.google.com" "Mozlila/5.0 (Linux; Android 7.0; SM-G892A Bulid/NRD90M; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome ... show more 159.223.48.48 - - [14/Nov/2026:05:55:50 +0000] "GET /cgi-bin/cgi-bin/cgi-bin/cgi-bin/cache.php HTTP/1.1" 404 35939 "www.google.com" "Mozlila/5.0 (Linux; Android 7.0; SM-G892A Bulid/NRD90M; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/60.0.3112.107 Moblie Safari/537.36" ... show less	Bad Web Bot Web App Attack
🇺🇸 Spider	2026-11-14 05:52:49 UTC · (11 hours ago)	Automated report from Atlas Development (atlas-development.net) edge protection. Systematic path enumeration detected: 3 distinct endpoints probed within 10 minutes, cycling through common CMS install-path guesses. Sample: GET /images/images/images/i ... show more Automated report from Atlas Development (atlas-development.net) edge protection. Systematic path enumeration detected: 3 distinct endpoints probed within 10 minutes, cycling through common CMS install-path guesses. Sample: GET /images/images/images/images/images/images/images/images/cache.php (404) GET /cgi-bin/cgi-bin/cgi-bin/cgi-bin/cache.php (404) GET /images/images/cache.php (404) show less	Bad Web Bot Web App Attack

Showing 1 to 15 of 61 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown

Recently Reported IPs:

🇨🇦 148.113.130.211

🇹🇼 198.235.24.97

🇫🇷 178.77.100.92

🇺🇸 176.20.205.130

🇩🇪 167.94.146.45

🇨🇦 142.44.225.251

🇳🇱 89.21.67.185

🇨🇦 51.161.65.8

🇸🇬 47.128.61.227

🇳🇱 45.148.10.157

🇺🇸 207.244.238.14

🇨🇿 185.91.116.133

🇨🇦 148.113.130.53

🇧🇷 147.15.110.51

🇺🇸 100.51.6.16

🇺🇸 66.60.116.148

🇬🇧 57.128.181.191

🇨🇦 51.222.168.18

🇺🇸 45.156.129.174

🇻🇳 27.79.43.160