JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 201.159.155.152

201.159.155.152 was found in our database!

This IP was reported 54 times. Confidence of Abuse is 76%: ?

76%

ISP	G6 Internet
Usage Type	Fixed Line ISP
ASN	AS265911
Hostname(s)	201-159-155-152.g6internet.com.br
Domain Name	g6internet.com.br
Country	🇧🇷 Brazil
City	Itajuba, Minas Gerais

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 201.159.155.152

Whois 201.159.155.152

IP Abuse Reports for 201.159.155.152:

This IP address has been reported a total of 54 times from 27 distinct sources. 201.159.155.152 was first reported on March 9th 2026, and the most recent report was 3 days ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇪🇸 SweetHoneyPress	2026-07-08 10:56:30 (3 days ago)	WordPress honeypot: POST to /xmlrpc.php \| event_id=1009394 \| UA: Jetpack/12.5; WordPress/6.4; http:/ ... show more WordPress honeypot: POST to /xmlrpc.php \| event_id=1009394 \| UA: Jetpack/12.5; WordPress/6.4; http://site17050698.com show less	Web App Attack Brute-Force
🇪🇸 SweetHoneyPress	2026-07-08 10:41:24 (3 days ago)	WordPress honeypot: POST to /xmlrpc.php \| event_id=1009308 \| UA: Jetpack by WordPress.com	Web App Attack Brute-Force
🇩🇪 lenz	2026-07-08 09:40:49 (3 days ago)	Jul 8 11:40:09 hosting wordpress(grupa-ddd.pl)[1203]: XML-RPC authentication failure for admin from ... show more Jul 8 11:40:09 hosting wordpress(grupa-ddd.pl)[1203]: XML-RPC authentication failure for admin from 201.159.155.152 Jul 8 11:40:19 hosting wordpress(grupa-ddd.pl)[11820]: XML-RPC authentication failure for admin from 201.159.155.152 Jul 8 11:40:29 hosting wordpress(grupa-ddd.pl)[6431]: XML-RPC authentication failure for admin from 201.159.155.152 Jul 8 11:40:38 hosting wordpress(grupa-ddd.pl)[1200]: XML-RPC authentication failure for admin from 201.159.155.152 Jul 8 11:40:49 hosting wordpress(grupa-ddd.pl)[1201]: XML-RPC authentication failure for admin from 201.159.155.152 ... show less	Brute-Force Web App Attack
🇺🇸 TPI-Abuse	2026-07-06 16:34:11 (5 days ago)	(mod_security) mod_security (id:240335) triggered by 201.159.155.152 (201-159-155-152.g6internet.com ... show more (mod_security) mod_security (id:240335) triggered by 201.159.155.152 (201-159-155-152.g6internet.com.br): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jul 06 12:34:05.110080 2026] [security2:error] [pid 21595:tid 21595] [client 201.159.155.152:60542] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 201.159.155.152 (+1 hits since last alert)\|j3pr.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "j3pr.com"] [uri "/xmlrpc.php"] [unique_id "akvY_Yz4KIvKiWk9suLBXgAAAAE"] show less	Brute-Force Bad Web Bot Web App Attack
🇫🇮 bittiguru.fi	2026-07-03 15:33:43 (1 week ago)	201.159.155.152 - [03/Jul/2026:18:33:33 +0300] "POST /xmlrpc.php HTTP/1.1" 503 18963 "-" "Jetpack/12 ... show more 201.159.155.152 - [03/Jul/2026:18:33:33 +0300] "POST /xmlrpc.php HTTP/1.1" 503 18963 "-" "Jetpack/12.1; WordPress/6.4; http://site38710013.com" "-" 201.159.155.152 - [03/Jul/2026:18:33:42 +0300] "POST /xmlrpc.php HTTP/1.1" 503 18050 "-" "WordPress.com; https://wordpress.com" "-" ... show less	Hacking Brute-Force Web App Attack
🇫🇮 bittiguru.fi	2026-07-03 15:18:28 (1 week ago)	201.159.155.152 - [03/Jul/2026:18:18:19 +0300] "POST /xmlrpc.php HTTP/1.1" 503 18963 "-" "Jetpack/13 ... show more 201.159.155.152 - [03/Jul/2026:18:18:19 +0300] "POST /xmlrpc.php HTTP/1.1" 503 18963 "-" "Jetpack/13.0; WordPress/6.3; http://site30344218.com" "-" 201.159.155.152 - [03/Jul/2026:18:18:28 +0300] "POST /xmlrpc.php HTTP/1.1" 503 18050 "-" "Jetpack by WordPress.com" "-" ... show less	Hacking Brute-Force Web App Attack
🇺🇸 TPI-Abuse	2026-07-03 13:48:32 (1 week ago)	(mod_security) mod_security (id:240335) triggered by 201.159.155.152 (201-159-155-152.g6internet.com ... show more (mod_security) mod_security (id:240335) triggered by 201.159.155.152 (201-159-155-152.g6internet.com.br): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jul 03 09:48:26.042632 2026] [security2:error] [pid 23314:tid 23314] [client 201.159.155.152:4276] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 201.159.155.152 (+1 hits since last alert)\|ubuciko.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "ubuciko.com"] [uri "/xmlrpc.php"] [unique_id "ake9qidonnqJQeAeSq5rCQAAAAE"] show less	Brute-Force Bad Web Bot Web App Attack
Anonymous	2026-07-03 13:46:30 (1 week ago)	Fail2ban filtered ...	Web App Attack
🇺🇸 TPI-Abuse	2026-07-03 13:19:53 (1 week ago)	(mod_security) mod_security (id:240335) triggered by 201.159.155.152 (201-159-155-152.g6internet.com ... show more (mod_security) mod_security (id:240335) triggered by 201.159.155.152 (201-159-155-152.g6internet.com.br): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jul 03 09:19:46.243900 2026] [security2:error] [pid 8350:tid 8350] [client 201.159.155.152:41126] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 201.159.155.152 (+1 hits since last alert)\|edgebiopharma.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "edgebiopharma.com"] [uri "/xmlrpc.php"] [unique_id "ake28mB-wtvKVBJd9jerQAAAAAE"] show less	Brute-Force Bad Web Bot Web App Attack
🇬🇧 Apache	2026-07-03 10:54:06 (1 week ago)	(mod_security) mod_security (id:240335) triggered by 201.159.155.152 (BR/Brazil/201-159-155-152.g6in ... show more (mod_security) mod_security (id:240335) triggered by 201.159.155.152 (BR/Brazil/201-159-155-152.g6internet.com.br): 5 in the last 300 secs show less	Brute-Force Web App Attack
Anonymous	2026-07-02 10:50:22 (1 week ago)	201.159.155.152 - - [02/Jul/2026:12:50:01 +0200] "POST /xmlrpc.php HTTP/1.1" 200 593 "-" "Jetpack/12 ... show more 201.159.155.152 - - [02/Jul/2026:12:50:01 +0200] "POST /xmlrpc.php HTTP/1.1" 200 593 "-" "Jetpack/12.5; WordPress/6.1; http://site25472096.com" 201.159.155.152 - - [02/Jul/2026:12:50:03 +0200] "POST /xmlrpc.php HTTP/1.1" 200 403 "-" "Jetpack/12.5; WordPress/6.1; http://site25472096.com" 201.159.155.152 - - [02/Jul/2026:12:50:11 +0200] "POST /xmlrpc.php HTTP/1.1" 200 593 "-" "Jetpack by WordPress.com" 201.159.155.152 - - [02/Jul/2026:12:50:11 +0200] "POST /xmlrpc.php HTTP/1.1" 200 403 "-" "Jetpack by WordPress.com" 201.159.155.152 - - [02/Jul/2026:12:50:21 +0200] "POST /xmlrpc.php HTTP/1.1" 200 593 "-" "Jetpack/13.0; WordPress/6.3; http://site34801842.com" ... show less	Brute-Force Web App Attack
🇺🇸 TPI-Abuse	2026-07-01 09:54:48 (1 week ago)	(mod_security) mod_security (id:240335) triggered by 201.159.155.152 (201-159-155-152.g6internet.com ... show more (mod_security) mod_security (id:240335) triggered by 201.159.155.152 (201-159-155-152.g6internet.com.br): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jul 01 05:54:42.360185 2026] [security2:error] [pid 17361:tid 17361] [client 201.159.155.152:37442] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 201.159.155.152 (+1 hits since last alert)\|f40ph.org\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "f40ph.org"] [uri "/xmlrpc.php"] [unique_id "akTj4iCWq9Ue4WBHU5FLMgAAABA"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-06-29 13:35:39 (1 week ago)	(mod_security) mod_security (id:240335) triggered by 201.159.155.152 (201-159-155-152.g6internet.com ... show more (mod_security) mod_security (id:240335) triggered by 201.159.155.152 (201-159-155-152.g6internet.com.br): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jun 29 09:35:35.313280 2026] [security2:error] [pid 4619:tid 4619] [client 201.159.155.152:1768] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 201.159.155.152 (+1 hits since last alert)\|bernsteinip.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "bernsteinip.com"] [uri "/xmlrpc.php"] [unique_id "akJ0p1M7Dfs-W46glvJ0wgAAAA4"] show less	Brute-Force Bad Web Bot Web App Attack
🇳🇱 Site.eu	2026-06-29 11:02:30 (1 week ago)	Repeated wp-login/xmlrpc attempts	Brute-Force SSH
Anonymous	2026-06-29 10:30:03 (1 week ago)	(wordpress) Failed login wp-login.php or xmlrpc.php	Web App Attack

Showing 1 to 15 of 54 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇨🇳 218.202.143.68

🇺🇦 195.140.224.166

🇬🇧 154.16.44.94

🇺🇸 151.240.45.12

🇺🇸 143.244.187.66

🇨🇭 212.104.214.90

🇮🇩 182.8.179.195

🇨🇳 171.213.119.170

🇺🇸 151.245.32.125

🇺🇸 151.240.45.38

🇺🇸 151.240.45.33

🇫🇮 147.185.133.116

🇻🇳 103.241.43.193

🇩🇪 69.5.169.221

🇺🇸 50.217.255.171

🇳🇱 45.153.34.195

🇺🇸 45.131.194.51

🇩🇪 45.3.45.166

🇦🇱 31.171.152.210

🇮🇷 5.238.166.120