AbuseIPDB » 159.65.155.57

159.65.155.57 was found in our database!

This IP was reported 346 times. Confidence of Abuse is 65%: ?

65%

ISP	DigitalOcean LLC
Usage Type	Data Center/Web Hosting/Transit
Hostname(s)	501314.cloudwaysapps.com
Domain Name	digitalocean.com
Country	India
City	Bengaluru, Karnataka

IP info including ISP, Usage Type, and Location provided by IP2Location. Updated monthly.

Report 159.65.155.57

Whois 159.65.155.57

IP Abuse Reports for 159.65.155.57:

This IP address has been reported a total of 346 times from 73 distinct sources. 159.65.155.57 was first reported on March 15th 2021, and the most recent report was 5 days ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp in UTC	Comment	Categories
Anonymous	2023-12-15 18:10:40 (9 months ago)	(wordpress-user-enum) Failed wordpress-user-enum trigger from 159.65.155.57 (IN/India/501314.cloudwa ... show more(wordpress-user-enum) Failed wordpress-user-enum trigger from 159.65.155.57 (IN/India/501314.cloudwaysapps.com) show less	Brute-Force
paulshipley.com.au	2023-12-15 17:53:23 (9 months ago)	levellapromotions.com.au:443 159.65.155.57 - - [16/Dec/2023:04:52:56 +1100] "GET /?author=21 HTTP/1. ... show morelevellapromotions.com.au:443 159.65.155.57 - - [16/Dec/2023:04:52:56 +1100] "GET /?author=21 HTTP/1.1" 404 109143 "-" "Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:25.0) Gecko/20100101 Firefox/29.0" levellapromotions.com.au:443 159.65.155.57 - - [16/Dec/2023:04:52:59 +1100] "GET /?author=21 HTTP/1.1" 404 109143 "-" "Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:25.0) Gecko/20100101 Firefox/29.0" levellapromotions.com.au:443 159.65.155.57 - - [16/Dec/2023:04:53:02 +1100] "GET /?author=22 HTTP/1.1" 404 109143 "-" "Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:25.0) Gecko/20100101 Firefox/29.0" levellapromotions.com.au:443 159.65.155.57 - - [16/Dec/2023:04:53:05 +1100] "GET /?author=22 HTTP/1.1" 404 109143 "-" "Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:25.0) Gecko/20100101 Firefox/29.0" levellapromotions.com.au:443 159.65.155.57 - - [16/Dec/2023:04:53:09 +1100] "GET /?author=24 HTTP/1.1" 404 112039 "-" "Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:25.0) Gecko/20100101 Firefox/29.0" levellapro ... show less	Web App Attack
TPI-Abuse	2023-12-15 15:20:45 (9 months ago)	(mod_security) mod_security (id:240335) triggered by 159.65.155.57 (501314.cloudwaysapps.com): 1 in ... show more(mod_security) mod_security (id:240335) triggered by 159.65.155.57 (501314.cloudwaysapps.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Dec 15 10:20:41.035259 2023] [security2:error] [pid 5477] [client 159.65.155.57:36544] [client 159.65.155.57] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 159.65.155.57 (+1 hits since last alert)\|www.taekwondoit.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "www.taekwondoit.com"] [uri "/about-us/wp/xmlrpc.php"] [unique_id "ZXxuyQy-C-1oaITY5IVmJwAAAAM"] show less	Brute-Force Bad Web Bot Web App Attack
TPI-Abuse	2023-12-15 14:15:00 (9 months ago)	(mod_security) mod_security (id:240335) triggered by 159.65.155.57 (501314.cloudwaysapps.com): 1 in ... show more(mod_security) mod_security (id:240335) triggered by 159.65.155.57 (501314.cloudwaysapps.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Dec 15 09:14:56.149624 2023] [security2:error] [pid 26300] [client 159.65.155.57:14648] [client 159.65.155.57] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 159.65.155.57 (+1 hits since last alert)\|basse.me\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "basse.me"] [uri "/site/wp/xmlrpc.php"] [unique_id "ZXxfYCqr0aPD1h3RHKAAYgAAAA0"] show less	Brute-Force Bad Web Bot Web App Attack
MAGIC	2023-11-12 22:30:38 (10 months ago)	VM1 Bad user agents ignoring web crawling rules. Draing bandwidth	DDoS Attack Bad Web Bot
Swiptly	2023-11-12 18:53:17 (10 months ago)	WordPress xmlrpc spam or enumeration ...	Web Spam Bad Web Bot Web App Attack
octageeks.com	2023-11-12 06:10:57 (10 months ago)	Wordpress malicious attack:[octaxmlrpc]	Web App Attack
Jim Keir	2023-11-11 12:34:30 (10 months ago)	2023-11-11 12:34:29 159.65.155.57 File scanning, blocking 159.65.155.57 for 5 minutes	Web App Attack
Anonymous	2023-11-11 12:25:33 (10 months ago)	Bot / scanning and/or hacking attempts: POST /xmlrpc.php HTTP/1.1	Hacking Web App Attack
Ba-Yu	2023-11-02 21:51:29 (10 months ago)	WP-xmlrpc exploit	Web Spam Blog Spam Hacking Exploited Host Web App Attack
mawan	2023-11-02 08:14:10 (10 months ago)	Suspected of having performed illicit activity on LAX server.	Web App Attack
dbip	2023-11-02 06:51:19 (10 months ago)	159.65.155.57 - - [02/Nov/2023:07:49:54 +0100] "POST /wp-login.php HTTP/1.1" 200 10379 "https://lice ... show more159.65.155.57 - - [02/Nov/2023:07:49:54 +0100] "POST /wp-login.php HTTP/1.1" 200 10379 "https://licence-marketing-digital.univ-lyon3.fr/wp-login.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:79.0) Gecko/20100101 Firefox/79.0" 159.65.155.57 - - [02/Nov/2023:07:50:55 +0100] "GET /wp-login.php HTTP/1.1" 200 9967 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.131 Safari/537.36" 159.65.155.57 - - [02/Nov/2023:07:50:57 +0100] "POST /wp-login.php HTTP/1.1" 200 10379 "https://licence-marketing-digital.univ-lyon3.fr/wp-login.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.131 Safari/537.36" 159.65.155.57 - - [02/Nov/2023:07:51:17 +0100] "GET /wp-login.php HTTP/1.1" 200 9967 "-" "Mozilla/5.0 (iPhone; CPU iPhone OS 14_6 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/91.0.4472.80 Mobile/15E148 Safari/604.1" 159.65.155.57 - - [02/Nov/2023:07:51:19 +0100] "POST /wp-logi ... show less	Brute-Force Web App Attack
plzenskypruvodce.cz	2023-10-10 06:19:59 (11 months ago)	[Tue Oct 10 08:19:54.339070 2023] [access_compat:error] [pid 3990465:tid 140148725438208] [client 15 ... show more[Tue Oct 10 08:19:54.339070 2023] [access_compat:error] [pid 3990465:tid 140148725438208] [client 159.65.155.57:45600] AH01797: client denied by server configuration: /var/www/buchtic.net/blog/xmlrpc.php [Tue Oct 10 08:19:57.756411 2023] [access_compat:error] [pid 3990465:tid 140148834543360] [client 159.65.155.57:45616] AH01797: client denied by server configuration: /var/www/buchtic.net/blog/xmlrpc.php ... show less	Web App Attack
bittiguru.fi	2023-10-10 05:03:50 (11 months ago)	159.65.155.57 - - \[10/Oct/2023:08:03:45 +0300\] "POST /wordpress/xmlrpc.php HTTP/1.1" 200 428 "-" " ... show more159.65.155.57 - - \[10/Oct/2023:08:03:45 +0300\] "POST /wordpress/xmlrpc.php HTTP/1.1" 200 428 "-" "Mozilla/5.0 \(Windows NT 10.0\) AppleWebKit/537.36 \(KHTML, like Gecko\) Chrome/91.0.4472.114 Safari/537.36" "-" 159.65.155.57 - - \[10/Oct/2023:08:03:48 +0300\] "POST /wordpress/xmlrpc.php HTTP/1.1" 200 428 "-" "Mozilla/5.0 \(Windows NT 10.0\) AppleWebKit/537.36 \(KHTML, like Gecko\) Chrome/91.0.4472.114 Safari/537.36" "-" ... show less	Hacking Brute-Force Web App Attack
Jim Keir	2023-10-10 01:20:24 (11 months ago)	2023-10-10 01:20:23 159.65.155.57 File scanning, blocking 159.65.155.57 for 5 minutes	Web App Attack