AbuseIPDB » 203.159.80.189

Check an IP Address, Domain Name, or Subnet

e.g. 18.206.238.77, microsoft.com, or 5.188.10.0/24

203.159.80.189 was found in our database!

This IP was reported 40 times. Confidence of Abuse is 100%: ?

100%

ISP	Legaco Networks B.V.
Usage Type	Data Center/Web Hosting/Transit
Domain Name	legaconetworks.nl
Country	Netherlands
City	Brielle, Zuid-Holland

IP info including ISP, Usage Type, and Location provided by IP2Location. Updated monthly.

Report 203.159.80.189

Whois 203.159.80.189

IP Abuse Reports for 203.159.80.189:

This IP address has been reported a total of 40 times from 28 distinct sources. 203.159.80.189 was first reported on March 21st 2021, and the most recent report was 3 hours ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	Date	Comment	Categories
el-brujo	3 hours ago	14/May/2021:03:23:46 +0200Apache-Error: [file "apache2_util.c"] [line 273] [level 3] [client 203.159 ... show more14/May/2021:03:23:46 +0200Apache-Error: [file "apache2_util.c"] [line 273] [level 3] [client 203.159.80.189] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/activated_rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "140"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "elhacker.info"] [uri "/.env"] [unique_id "YJ3RImpcvZNYFftDwdw4dAAAAMY"] ... show less	Hacking Web App Attack
conseilgouz	10 hours ago	see-17 : Block hidden directories=>/.env(/)	Hacking
volkan	11 May 2021	scanning for exploits - *.env	Web App Attack
digitama.co.id	10 May 2021	Blacklisted for 10 days after 101 captcha requests	Brute-Force SSH
Anonymous	09 May 2021	GET /.env HTTP/1.1	Brute-Force Bad Web Bot Web App Attack
af437fal43hD	05 May 2021	/.env	Brute-Force Web App Attack
Martlark	03 May 2021	Flask-IPban - exploit URL requested:/.env	Web App Attack
kiwi.network	02 May 2021	Probing host IP: Attack repeated for 24 hours 203.159.80.189 - - [02/May/2021:22:37:48 0300] "GET / ... show moreProbing host IP: Attack repeated for 24 hours 203.159.80.189 - - [02/May/2021:22:37:48 0300] "GET /.env HTTP/1.1" 403 2077 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.129 Safari/537.36" 203.159.80.189 - - [02/May/2021:22:37:48 0300] "POST / HTTP/1.1" 401 1986 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.129 Safari/537.36" show less	Hacking Exploited Host Web App Attack
security.rdmc.fr	02 May 2021	Automatic report - Banned IP Access	Web App Attack
Ba-Yu	02 May 2021	General hacking/exploits/scanning	Web Spam Hacking Brute-Force Exploited Host Web App Attack
whitehoodie	02 May 2021	AUTOMATED REPORT: Tried to access .env file	Hacking Bad Web Bot Web App Attack
SleepyHosting	01 May 2021	(mod_security) mod_security (id:930130) triggered by 203.159.80.189 (NL/Netherlands/-): 5 in the las ... show more(mod_security) mod_security (id:930130) triggered by 203.159.80.189 (NL/Netherlands/-): 5 in the last 3600 secs show less	Brute-Force
conseilgouz	01 May 2021	lee-17 : Block hidden directories=>/.env(/)	Hacking
conseilgouz	01 May 2021	ece-17 : Block hidden directories=>/.env(/)	Hacking
hermawan	30 Apr 2021	[Fri Apr 30 23:28:21.745318 2021] [:error] [pid 25239:tid 140185533560576] [client 203.159.80.189:53 ... show more[Fri Apr 30 23:28:21.745318 2021] [:error] [pid 25239:tid 140185533560576] [client 203.159.80.189:53622] [client 203.159.80.189] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^[\\\\d.:]+$" at REQUEST_HEADERS:Host. [file "/etc/modsecurity/coreruleset-3.3.1-rc1/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "756"] [id "920350"] [msg "Host header is a numeric IP address"] [data "103.27.207.197"] [severity "WARNING"] [ver "OWASP_CRS/3.3.1"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "karangploso.jatim.bmkg.go.id"] [uri "/.env"] [unique_id "[email protected]"] ... show less	Hacking Web App Attack