JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 195.63.1.159

195.63.1.159 was found in our database!

This IP was reported 12 times. Confidence of Abuse is 15%: ?

15%

ISP	3xK Tech GmbH
Usage Type	Data Center/Web Hosting/Transit
ASN	AS200373
Domain Name	3xktech.cloud
Country	🇺🇸 United States of America
City	Ashburn, Virginia

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 195.63.1.159

Whois 195.63.1.159

IP Abuse Reports for 195.63.1.159:

This IP address has been reported a total of 12 times from 4 distinct sources. 195.63.1.159 was first reported on March 2nd 2026, and the most recent report was 1 day ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇮🇪 AutosOnShow	2026-10-16 16:25:15 (1 day ago)	blocked for webapp attack \| path requested: /.env \| seen at 2026-10-16 16:24:55.386 \|	Web App Attack
🇮🇪 AutosOnShow	2026-10-16 15:12:13 (1 day ago)	blocked for webapp attack \| path requested: /.env \| seen at 2026-10-16 15:11:43.685 \|	Web App Attack
🇮🇪 AutosOnShow	2026-10-15 10:33:13 (2 days ago)	blocked for webapp attack \| path requested: /.env \| seen at 2026-10-15 10:32:34.850 \|	Web App Attack
🇺🇸 xmission.com	2026-10-14 06:44:17 (3 days ago)	Blocked by UFW (TCP on 80) Source port: 50412 TTL: 50 Packet length: 60 TOS: 0x00 This report (for ... show more Blocked by UFW (TCP on 80) Source port: 50412 TTL: 50 Packet length: 60 TOS: 0x00 This report (for 195.63.1.159) was generated by: https://github.com/sefinek/UFW-AbuseIPDB-Reporter show less	Port Scan Web App Attack
🇮🇪 AutosOnShow	2026-10-10 07:33:04 (1 week ago)	blocked for webapp attack \| path requested: /.env \| seen at 2026-10-10 07:32:07.916 \|	Web App Attack
🇮🇪 AutosOnShow	2026-10-09 12:57:05 (1 week ago)	blocked for webapp attack \| path requested: /.env \| seen at 2026-10-09 12:56:52.049 \|	Web App Attack
🇮🇪 AutosOnShow	2026-10-09 09:44:05 (1 week ago)	blocked for webapp attack \| path requested: /.env \| seen at 2026-10-09 09:43:48.379 \|	Web App Attack
🇮🇪 AutosOnShow	2026-10-08 21:14:06 (1 week ago)	blocked for webapp attack \| path requested: /.env \| seen at 2026-10-08 21:13:34.870 \|	Web App Attack
🇨🇭 backslash	2026-04-23 01:57:00 (5 months ago)	block ruleset bad bot: wordpress scans 82C095539D4FDAF84E2E2FD6B6FC0664645851A8	Bad Web Bot
🇺🇸 TPI-Abuse	2026-03-14 15:37:54 (7 months ago)	(mod_security) mod_security (id:210350) triggered by 195.63.1.159 (-): 1 in the last 300 secs; Ports ... show more (mod_security) mod_security (id:210350) triggered by 195.63.1.159 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Mar 14 11:37:47.528129 2026] [security2:error] [pid 723:tid 723] [client 195.63.1.159:59676] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close\|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close\|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found\|\|www.maffiniandbearce.com\|F\|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.maffiniandbearce.com"] [uri "/wp-login.php"] [unique_id "abWAy-Eey2J6tXSbrVNFHAAAABI"], referer: https://www.maffiniandbearce.com/wp-login.php show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-03-11 12:14:40 (7 months ago)	(mod_security) mod_security (id:225170) triggered by 195.63.1.159 (-): 1 in the last 300 secs; Ports ... show more (mod_security) mod_security (id:225170) triggered by 195.63.1.159 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Mar 11 08:14:34.499583 2026] [security2:error] [pid 763:tid 763] [client 195.63.1.159:32150] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)\|\|gotdt.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "gotdt.com"] [uri "/wp-json/wp/v2/users"] [unique_id "abFcqilWt62JEA2IGBNEPQAAAAc"], referer: https://www.google.com show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-03-02 16:49:29 (7 months ago)	(mod_security) mod_security (id:210350) triggered by 195.63.1.159 (-): 1 in the last 300 secs; Ports ... show more (mod_security) mod_security (id:210350) triggered by 195.63.1.159 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Mar 02 11:49:09.763787 2026] [security2:error] [pid 24427:tid 24443] [client 195.63.1.159:56358] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close\|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close\|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found\|\|kettlehill.com\|F\|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "kettlehill.com"] [uri "/wp-login.php"] [unique_id "aaW_hXC3zCeP-4tfSXSU1QAAAUg"], referer: https://kettlehill.com/wp-login.php show less	Brute-Force Bad Web Bot Web App Attack

Showing 1 to 12 of 12 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇧🇷 200.153.86.250

🇬🇧 200.138.46.71

🇭🇰 152.32.134.89

🇨🇳 111.22.163.209

🇨🇳 60.27.227.174

🇺🇸 20.80.86.196

🇺🇸 20.29.43.119

🇷🇴 2.57.122.74

🇰🇷 211.46.177.174

🇧🇷 205.210.31.175

🇮🇳 152.58.187.181

🇨🇳 122.97.136.64

🇫🇷 62.171.182.102

🇺🇸 20.46.254.118

🇺🇸 216.73.216.223

🇧🇷 167.250.160.139

🇺🇸 138.91.108.245

🇺🇸 185.191.171.6

🇸🇦 167.100.184.182

🇮🇳 122.168.197.138