JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 159.223.76.42

159.223.76.42 was found in our database!

This IP was reported 16 times. Confidence of Abuse is 0%: ?

ISP	DigitalOcean, LLC
Usage Type	Data Center/Web Hosting/Transit
ASN	AS14061
Domain Name	digitalocean.com
Country	🇸🇬 Singapore
City	Singapore

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 159.223.76.42

Whois 159.223.76.42

IP Abuse Reports for 159.223.76.42:

This IP address has been reported a total of 16 times from 11 distinct sources. 159.223.76.42 was first reported on April 27th 2025, and the most recent report was 6 months ago.

Old Reports: The most recent abuse report for this IP address is from 6 months ago . It is possible that this IP is no longer involved in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇧🇪 taivas.nl	2026-01-13 20:02:11 (6 months ago)	Site scraper	Web App Attack
🇮🇹 VHosting	2026-01-13 07:45:04 (6 months ago)	Detected WordPress attack from 4 different servers	Brute-Force Web App Attack
Anonymous	2026-01-13 03:46:41 (6 months ago)	wordpress-trap	Web App Attack
🇱🇻 garmtech.com	2026-01-13 01:02:15 (6 months ago)	IM360 WAF: Interaction with fake plugin MV:/wp-content/plugins/pwnd/pwnd.php	Web App Attack
🇺🇸 TPI-Abuse	2025-04-28 23:43:43 (1 year ago)	(mod_security) mod_security (id:210492) triggered by 159.223.76.42 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:210492) triggered by 159.223.76.42 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Apr 28 19:43:37.785780 2025] [security2:error] [pid 2064069:tid 2064069] [client 159.223.76.42:58780] [client 159.223.76.42] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "sys.integratic.com.co"] [uri "/wp-config.php_"] [unique_id "aBASqRazt0fXgSn2m4zvKAAAAAY"] show less	Brute-Force Bad Web Bot Web App Attack
🇮🇹 IRT@Unisi	2025-04-28 19:29:14 (1 year ago)	Apache: Attempt to access forbidden file or directory.	Web App Attack
🇨🇿 ddw	2025-04-28 12:54:38 (1 year ago)	WordPress Configuration File Access.	Hacking Web App Attack
🇺🇦 URAN Publishing Service	2025-04-28 08:46:09 (1 year ago)	159.223.76.42 - - [28/Apr/2025:11:46:05 +0300] "GET /wp-config.php_ HTTP/1.1" 404 276 "-" "Mozilla/5 ... show more 159.223.76.42 - - [28/Apr/2025:11:46:05 +0300] "GET /wp-config.php_ HTTP/1.1" 404 276 "-" "Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; MAARJS; rv:11.0) like Gecko" ... show less	Web App Attack
🇺🇦 URAN Publishing Service	2025-04-28 07:41:07 (1 year ago)	159.223.76.42 - - [28/Apr/2025:10:41:04 +0300] "GET /wordpress/wp-config.php~ HTTP/1.1" 404 251 "-" ... show more 159.223.76.42 - - [28/Apr/2025:10:41:04 +0300] "GET /wordpress/wp-config.php~ HTTP/1.1" 404 251 "-" "Mozilla/5.0 (Windows NT 6.3; WOW64; Trident/7.0; MASAJS; rv:11.0) like Gecko" ... show less	Web App Attack
🇪🇹 Bete	2025-04-28 06:06:00 (1 year ago)	159.223.76.42 - - [27/Apr/2025:14:38:21 +0000] "GET /wp-config.php.php-bak HTTP/1.1" 404 197 "-" "Mo ... show more 159.223.76.42 - - [27/Apr/2025:14:38:21 +0000] "GET /wp-config.php.php-bak HTTP/1.1" 404 197 "-" "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)" A systematic WordPress configuration harvesting attempt from IP 159.223.76.42, where the attacker employed multiple spoofed user agents (including iPhone, Android, Windows, and Mac browsers) to probe for backup copies of WordPress configuration files (wp-config.php~, wp-config.php_bk, wp-config.php.old,...) show less	Brute-Force Web App Attack
🇺🇦 URAN Publishing Service	2025-04-28 02:30:20 (1 year ago)	159.223.76.42 - - [28/Apr/2025:05:30:19 +0300] "GET /wp-config.php_ HTTP/1.1" 404 277 "-" "Mozilla/5 ... show more 159.223.76.42 - - [28/Apr/2025:05:30:19 +0300] "GET /wp-config.php_ HTTP/1.1" 404 277 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.135 Safari/537.36" ... show less	Web App Attack
🇺🇦 URAN Publishing Service	2025-04-27 21:49:09 (1 year ago)	159.223.76.42 - - [28/Apr/2025:00:49:03 +0300] "GET /wordpress/wp-config.php~ HTTP/1.1" 404 251 "-" ... show more 159.223.76.42 - - [28/Apr/2025:00:49:03 +0300] "GET /wordpress/wp-config.php~ HTTP/1.1" 404 251 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:40.0) Gecko/20100101 Firefox/40.0" ... show less	Web App Attack
Anonymous	2025-04-27 18:05:34 (1 year ago)	Ports: 80,443; Direction: 0; Trigger: LF_MODSEC	Brute-Force SSH
🇺🇦 URAN Publishing Service	2025-04-27 13:21:19 (1 year ago)	159.223.76.42 - - [27/Apr/2025:16:21:18 +0300] "GET /wp-config.php_ HTTP/1.1" 404 272 "-" "Mozilla/5 ... show more 159.223.76.42 - - [27/Apr/2025:16:21:18 +0300] "GET /wp-config.php_ HTTP/1.1" 404 272 "-" "Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0; MDDRJS)" 159.223.76.42 - - [27/Apr/2025:16:21:19 +0300] "GET /wp-config.php HTTP/1.1" 404 272 "-" "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; Tablet PC 2.0)" ... show less	Web App Attack
🇺🇦 URAN Publishing Service	2025-04-27 11:13:25 (1 year ago)	159.223.76.42 - - [27/Apr/2025:14:13:01 +0300] "GET /wordpress/wp-config.php~ HTTP/1.1" 404 251 "-" ... show more 159.223.76.42 - - [27/Apr/2025:14:13:01 +0300] "GET /wordpress/wp-config.php~ HTTP/1.1" 404 251 "-" "Mozilla/5.0 (Windows NT 6.2; WOW64; rv:38.0) Gecko/20100101 Firefox/38.0" 159.223.76.42 - - [27/Apr/2025:14:13:16 +0300] "GET /wordpress/wp-config.php.old HTTP/1.1" 404 251 "-" "Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; Touch; MDDCJS; rv:11.0) like Gecko" ... show less	Web App Attack

Showing 1 to 15 of 16 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇨🇳 116.179.32.217

🇩🇪 109.91.4.177

🇺🇸 66.132.186.137

🇮🇪 52.31.99.165

🇬🇧 35.203.211.199

🇺🇸 3.223.45.5

🇺🇸 205.210.31.107

🇲🇽 177.226.164.30

🇸🇬 172.253.236.210

🇺🇸 162.216.150.241

🇩🇪 152.53.185.81

🇮🇹 151.30.188.74

🇺🇸 147.185.132.185

🇳🇱 85.11.167.16

🇺🇸 66.132.186.133

🇱🇹 62.60.130.234

🇵🇱 57.128.214.238

🇨🇳 39.183.162.243

🇧🇷 189.50.195.18

🇫🇮 147.185.133.37