JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 159.89.202.254

159.89.202.254 was found in our database!

This IP was reported 49 times. Confidence of Abuse is 0%: ?

ISP	DigitalOcean, LLC
Usage Type	Data Center/Web Hosting/Transit
ASN	AS14061
Domain Name	digitalocean.com
Country	🇸🇬 Singapore
City	Singapore

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 159.89.202.254

Whois 159.89.202.254

IP Abuse Reports for 159.89.202.254:

This IP address has been reported a total of 49 times from 18 distinct sources. 159.89.202.254 was first reported on March 7th 2025, and the most recent report was 1 year ago.

Old Reports: The most recent abuse report for this IP address is from 1 year ago . It is possible that this IP is no longer involved in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇺🇸 Rayulcifer	2025-04-23 10:28:49 (1 year ago)	159.89.202.254 - - [23/Apr/2025:05:27:38 -0500] "CONNECT countbot.lol:443:443 HTTP/1.1" 400 492 "-" ... show more 159.89.202.254 - - [23/Apr/2025:05:27:38 -0500] "CONNECT countbot.lol:443:443 HTTP/1.1" 400 492 "-" "-" 159.89.202.254 - - [23/Apr/2025:05:28:49 -0500] "CONNECT countbot.lol:443:443 HTTP/1.1" 400 492 "-" "-" ... show less	Open Proxy Port Scan Hacking Web App Attack SSH
🇺🇸 Rayulcifer	2025-04-22 09:31:00 (1 year ago)	159.89.202.254 - - [22/Apr/2025:04:30:48 -0500] "CONNECT low-cloudflare.dstatbot.org:443:443 HTTP/1. ... show more 159.89.202.254 - - [22/Apr/2025:04:30:48 -0500] "CONNECT low-cloudflare.dstatbot.org:443:443 HTTP/1.1" 400 492 "-" "-" 159.89.202.254 - - [22/Apr/2025:04:30:59 -0500] "CONNECT low-cloudflare.dstatbot.org:443:443 HTTP/1.1" 400 492 "-" "-" ... show less	Open Proxy Port Scan Hacking Web App Attack SSH
🇧🇷 diego	2025-04-21 10:01:24 (1 year ago)	Events: TCP SYN Discovery or Flooding, Seen 3 times in the last 10800 seconds	DDoS Attack
🇺🇸 Rayulcifer	2025-04-21 06:47:09 (1 year ago)	159.89.202.254 - - [21/Apr/2025:01:47:08 -0500] "CONNECT medium-cloudflare.dstatbot.org:443 HTTP/1.1 ... show more 159.89.202.254 - - [21/Apr/2025:01:47:08 -0500] "CONNECT medium-cloudflare.dstatbot.org:443 HTTP/1.1" 502 601 "-" "-" 159.89.202.254 - - [21/Apr/2025:01:47:08 -0500] "\x16\x03\x01\x02" 400 491 "-" "-" ... show less	Open Proxy Port Scan Hacking Web App Attack SSH
🇺🇸 Rayulcifer	2025-04-20 05:42:32 (1 year ago)	159.89.202.254 - - [20/Apr/2025:00:42:27 -0500] "CONNECT bulat.co.id:443:443 HTTP/1.1" 400 492 "-" " ... show more 159.89.202.254 - - [20/Apr/2025:00:42:27 -0500] "CONNECT bulat.co.id:443:443 HTTP/1.1" 400 492 "-" "-" 159.89.202.254 - - [20/Apr/2025:00:42:32 -0500] "CONNECT www.lensaone.id:443:443 HTTP/1.1" 400 492 "-" "-" ... show less	Open Proxy Port Scan Hacking Web App Attack SSH
🇺🇸 Rayulcifer	2025-04-19 05:42:05 (1 year ago)	159.89.202.254 - - [19/Apr/2025:00:41:31 -0500] "CONNECT ug234ok.com:443:443 HTTP/1.1" 400 492 "-" " ... show more 159.89.202.254 - - [19/Apr/2025:00:41:31 -0500] "CONNECT ug234ok.com:443:443 HTTP/1.1" 400 492 "-" "-" 159.89.202.254 - - [19/Apr/2025:00:42:05 -0500] "CONNECT ug234ok.com:443:443 HTTP/1.1" 400 492 "-" "-" ... show less	Open Proxy Port Scan Hacking Web App Attack SSH
🇺🇸 Rayulcifer	2025-04-18 05:40:50 (1 year ago)	159.89.202.254 - - [18/Apr/2025:00:38:30 -0500] "CONNECT medium-cloudflare.dstatbot.org:443:443 HTTP ... show more 159.89.202.254 - - [18/Apr/2025:00:38:30 -0500] "CONNECT medium-cloudflare.dstatbot.org:443:443 HTTP/1.1" 400 492 "-" "-" 159.89.202.254 - - [18/Apr/2025:00:40:49 -0500] "CONNECT medium-cloudflare.dstatbot.org:443:443 HTTP/1.1" 400 492 "-" "-" ... show less	Open Proxy Port Scan Hacking Web App Attack SSH
🇺🇸 Rayulcifer	2025-04-17 16:42:47 (1 year ago)	159.89.202.254 - - [17/Apr/2025:11:42:45 -0500] "CONNECT 198.16.110.165:443 HTTP/1.1" 502 585 "-" "- ... show more 159.89.202.254 - - [17/Apr/2025:11:42:45 -0500] "CONNECT 198.16.110.165:443 HTTP/1.1" 502 585 "-" "-" 159.89.202.254 - - [17/Apr/2025:11:42:46 -0500] "\x16\x03\x01" 400 491 "-" "-" ... show less	Open Proxy Port Scan Hacking Web App Attack SSH
🇺🇸 TPI-Abuse	2025-04-02 10:04:49 (1 year ago)	(mod_security) mod_security (id:225170) triggered by 159.89.202.254 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:225170) triggered by 159.89.202.254 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Apr 02 06:04:42.225759 2025] [security2:error] [pid 5981:tid 5981] [client 159.89.202.254:55057] [client 159.89.202.254] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)\|\|pawlewicz.org\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "pawlewicz.org"] [uri "/wordpress/wp-json/wp/v2/users/"] [unique_id "Z-0Lum8e3By7qD6nZNoSsgAAAA0"] show less	Brute-Force Bad Web Bot Web App Attack
Anonymous	2025-04-02 06:13:26 (1 year ago)	Ports: 80,443; Direction: 0; Trigger: LF_CUSTOMTRIGGER	Brute-Force SSH
🇧🇪 cmbplf	2025-04-02 00:44:35 (1 year ago)	175 requests with url.path */wp-includes/wlwmanifest.xml	Brute-Force Bad Web Bot
Anonymous	2025-04-02 00:26:03 (1 year ago)	(wordpress) Failed wordpress login from 159.89.202.254 (SG/Singapore/-)	Brute-Force
🇬🇧 Mendip_Defender	2025-04-01 21:44:18 (1 year ago)	159.89.202.254 - - [01/Apr/2025:22:44:12 +0100] "GET /wp-includes/wlwmanifest.xml HTTP/1.0" 404 1234 ... show more 159.89.202.254 - - [01/Apr/2025:22:44:12 +0100] "GET /wp-includes/wlwmanifest.xml HTTP/1.0" 404 1234 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36" 159.89.202.254 - - [01/Apr/2025:22:44:12 +0100] "GET /blog/wp-includes/wlwmanifest.xml HTTP/1.0" 404 1234 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36" ... show less	Hacking Web App Attack
🇺🇸 Major Hostility	2025-04-01 17:22:13 (1 year ago)	"GET /wp-includes/wlwmanifest.xml HTTP/1.1" 404 "GET /xmlrpc.php?rsd HTTP/1.1" 403 "GET /blog/wp-inc ... show more "GET /wp-includes/wlwmanifest.xml HTTP/1.1" 404 "GET /xmlrpc.php?rsd HTTP/1.1" 403 "GET /blog/wp-includes/wlwmanifest.xml HTTP/1.1" 404 "GET /web/wp-includes/wlwmanifest.xml HTTP/1.1" 404 "GET /wordpress/wp-includes/wlwmanifest.xml HTTP/1.1" 404 "GET /website/wp-includes/wlwmanifest.xml HTTP/1.1" 404 "GET /wp/wp-includes/wlwmanifest.xml HTTP/1.1" 404 "GET /news/wp-includes/wlwmanifest.xml HTTP/1.1" 404 "GET /2018/wp-includes/wlwmanifest.xml HTTP/1.1" 404 "GET /2019/wp-includes/wlwmanifest.xml HTTP/1.1" 404 "GET /shop/wp-includes/wlwmanifest.xml HTTP/1.1" 404 "GET /wp1/wp-includes/wlwmanifest.xml HTTP/1.1" 404 show less	Web App Attack
🇩🇪 Vegascosmetics	2025-03-30 21:52:52 (1 year ago)	Kingcopy(AI-IDS):IP is Probing for Wordpress vulnerabilities WTF:Banned	Hacking Bad Web Bot Web App Attack

Showing 1 to 15 of 49 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇭🇰 121.203.215.187

🇨🇳 121.199.163.183

🇮🇳 111.92.83.7

🇳🇱 45.142.193.53

🇪🇨 157.100.141.100

🇺🇸 91.230.168.250

🇨🇦 85.217.149.27

🇮🇩 36.88.190.243

🇺🇸 13.219.193.6

🇺🇸 3.142.170.60

🇳🇱 192.42.116.105

🇮🇳 182.95.222.178

🇬🇧 172.68.229.208

🇵🇭 131.226.100.160

🇩🇪 118.193.59.4

🇨🇳 106.63.26.22

🇸🇬 103.187.146.90

🇸🇬 97.74.83.203

🇷🇺 82.149.146.174

🇮🇹 81.57.15.243