JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 173.239.196.159

173.239.196.159 was found in our database!

This IP was reported 63 times. Confidence of Abuse is 2%: ?

ISP	Avast Software
Usage Type	Data Center/Web Hosting/Transit
ASN	AS206092
Domain Name	avast.com
Country	🇸🇬 Singapore
City	Singapore

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 173.239.196.159

Whois 173.239.196.159

IP Abuse Reports for 173.239.196.159:

This IP address has been reported a total of 63 times from 35 distinct sources. 173.239.196.159 was first reported on November 5th 2022, and the most recent report was 1 week ago.

Old Reports: The most recent abuse report for this IP address is from 1 week ago . It is possible that this IP is no longer involved in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇯🇵 demonsword	2026-05-29 10:16:15 (1 week ago)	Detected by SentinelX honeypot: sent HTTP CONNECT request probing for an open proxy. Connection was ... show more Detected by SentinelX honeypot: sent HTTP CONNECT request probing for an open proxy. Connection was hijacked and held in a tarpit to slow down the scan. Probed target: api.cyberghostvpn.com:443 show less	Open Proxy Port Scan
Anonymous	2026-02-23 07:08:51 (3 months ago)	[redacted] 173.239.196.159 - - [23/Feb/2026:08:08:46 +0100] "GET /admin/controller/extension/extensi ... show more [redacted] 173.239.196.159 - - [23/Feb/2026:08:08:46 +0100] "GET /admin/controller/extension/extension/ HTTP/1.1" 404 236 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.129 Safari/537.36" [redacted] 173.239.196.159 - - [23/Feb/2026:08:08:46 +0100] "GET /admin/editor/ HTTP/1.1" 404 236 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/84.0.4147.105 Safari/537.36" [redacted] 173.239.196.159 - - [23/Feb/2026:08:08:46 +0100] "GET /admin/images/slider/ HTTP/1.1" 404 236 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/84.0.4147.105 Safari/537.36 OPR/70.0.3728.95" [redacted] 173.239.196.159 - - [23/Feb/2026:08:08:46 +0100] "GET /admin/tmp/ HTTP/1.1" 404 236 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/84.0.4147.105 Safari/537.36" [redacted] 173.239.196.159 - - [23/Feb/2026:08:08:46 +0 ... show less	Hacking Web App Attack
🇬🇧 consul.to	2026-02-23 07:06:53 (3 months ago)	Web attack/malicious scanning detected	Web App Attack
Anonymous	2026-02-23 01:05:21 (3 months ago)	[redacted] 173.239.196.159 - - [23/Feb/2026:02:05:15 +0100] "GET /wp-admin/css/colors/ HTTP/1.1" 404 ... show more [redacted] 173.239.196.159 - - [23/Feb/2026:02:05:15 +0100] "GET /wp-admin/css/colors/ HTTP/1.1" 404 196 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36" [redacted] 173.239.196.159 - - [23/Feb/2026:02:05:17 +0100] "GET /wp-admin/images/ HTTP/1.1" 404 196 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:79.0) Gecko/20100101 Firefox/79.0" [redacted] 173.239.196.159 - - [23/Feb/2026:02:05:17 +0100] "GET /wp-admin/maint/ HTTP/1.1" 404 196 "-" "Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.149 Safari/537.36" [redacted] 173.239.196.159 - - [23/Feb/2026:02:05:17 +0100] "GET /wp-admin/meta/ HTTP/1.1" 404 196 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.3" [redacted] 173.239.196.159 - - [23/Feb/2026:02:05:17 +0100] "GET /wp-admin/user/ HTTP/1.1" 404 196 "-" "Mozilla/5 ... show less	Hacking Web App Attack
🇺🇸 TPI-Abuse	2026-02-23 00:51:28 (3 months ago)	(mod_security) mod_security (id:240000) triggered by 173.239.196.159 (-): 1 in the last 300 secs; Po ... show more (mod_security) mod_security (id:240000) triggered by 173.239.196.159 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Feb 22 19:51:22.814506 2026] [security2:error] [pid 11710:tid 11710] [client 173.239.196.159:56545] ModSecurity: Access denied with code 403 (phase 2). String match ".php" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/24_Apps_Joomla.conf"] [line "74"] [id "240000"] [rev "1"] [msg "COMODO WAF: Protecting Joomla folder\|\|aslproud.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "Joomla"] [hostname "aslproud.com"] [uri "/images/stories/themes.php"] [unique_id "aZukiq3IslBjBpxaRom0fgAAAAU"] show less	Brute-Force Bad Web Bot Web App Attack
🇬🇧 consul.to	2026-02-20 13:27:56 (3 months ago)	Web attack/malicious scanning detected	Web App Attack
🇳🇱 ConsulHosting	2026-02-20 12:37:49 (3 months ago)	Excessive failed CAPTCHA attempts (CAPTCHA DoS)	Web App Attack
🇫🇷 dynamix	2026-02-20 12:13:36 (3 months ago)	Multiple WAF Violations	Web App Attack
🇺🇸 TPI-Abuse	2026-02-20 09:52:29 (3 months ago)	(mod_security) mod_security (id:240000) triggered by 173.239.196.159 (-): 1 in the last 300 secs; Po ... show more (mod_security) mod_security (id:240000) triggered by 173.239.196.159 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Feb 20 04:52:14.329803 2026] [security2:error] [pid 591:tid 591] [client 173.239.196.159:20729] ModSecurity: Access denied with code 403 (phase 2). String match ".php" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/24_Apps_Joomla.conf"] [line "74"] [id "240000"] [rev "1"] [msg "COMODO WAF: Protecting Joomla folder\|\|cheaptrafficschool247.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "Joomla"] [hostname "cheaptrafficschool247.com"] [uri "/images/stories/themes.php"] [unique_id "aZguzvXPOeFJ6cYmDLB3UgAAAAU"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-02-19 12:36:44 (3 months ago)	(mod_security) mod_security (id:240000) triggered by 173.239.196.159 (-): 1 in the last 300 secs; Po ... show more (mod_security) mod_security (id:240000) triggered by 173.239.196.159 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Feb 19 07:36:40.368912 2026] [security2:error] [pid 13430:tid 13443] [client 173.239.196.159:41605] ModSecurity: Access denied with code 403 (phase 2). String match ".php" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/24_Apps_Joomla.conf"] [line "74"] [id "240000"] [rev "1"] [msg "COMODO WAF: Protecting Joomla folder\|\|boatservicesgroup.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "Joomla"] [hostname "boatservicesgroup.com"] [uri "/images/stories/themes.php"] [unique_id "aZcD2Ka25xN74Ccu9Sd7ZAAAAUs"] show less	Brute-Force Bad Web Bot Web App Attack
🇬🇧 consul.to	2026-02-19 06:49:35 (3 months ago)	Web attack/malicious scanning detected	Web App Attack
🇺🇦 URAN Publishing Service	2026-02-18 05:11:24 (3 months ago)	173.239.196.159 - - [18/Feb/2026:07:11:23 +0200] "GET /wp-content/upgrade/item.php HTTP/1.1" 404 278 ... show more 173.239.196.159 - - [18/Feb/2026:07:11:23 +0200] "GET /wp-content/upgrade/item.php HTTP/1.1" 404 278 "-" "Mozilla/5.0 (X11; Linux i686; rv:79.0) Gecko/20100101 Firefox/79.0" 173.239.196.159 - - [18/Feb/2026:07:11:23 +0200] "GET /wp-content/languages/wp-conflg.php HTTP/1.1" 404 278 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:75.0) Gecko/20100101 Firefox/75.0" ... show less	Web App Attack
🇬🇧 consul.to	2026-02-18 00:47:43 (3 months ago)	Web attack/malicious scanning detected	Web App Attack
Anonymous	2026-02-16 22:32:05 (3 months ago)	wordpress-trap	Web App Attack
🇬🇧 Apache	2026-02-10 14:10:04 (3 months ago)	(mod_security) mod_security (id:20000010) triggered by 173.239.196.159 (NP/Nepal/-): 5 in the last 3 ... show more (mod_security) mod_security (id:20000010) triggered by 173.239.196.159 (NP/Nepal/-): 5 in the last 300 secs show less	Brute-Force Web App Attack

Showing 1 to 15 of 63 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇰🇷 210.90.155.178

🇷🇺 188.0.179.206

🇳🇱 176.65.139.222

🇨🇳 117.13.169.198

🇻🇳 103.238.235.141

🇫🇷 51.75.236.151

🇨🇳 203.189.195.8

🇿🇦 197.215.170.220

🇺🇸 161.35.111.220

🇫🇮 147.185.133.196

🇳🇱 91.92.42.64

🇳🇱 87.208.110.31

🇺🇸 50.187.155.130

🇫🇷 45.157.112.56

🇺🇸 216.25.89.130

🇩🇪 213.209.159.56

🇮🇩 210.87.90.218

🇭🇰 199.45.154.180

🇧🇪 198.235.24.208

🇮🇳 182.95.191.186