This IP address has been reported a total of
87
times from
52 distinct
sources.
203.159.81.12 was first reported on
, and the most recent report was
.
Recent Reports:
We have received reports of abusive activity from this IP address within the last week. It is
potentially still actively engaged in abusive activities.
Repeatedly blocked bad web bot (tenant=82 method=GET path=/wp-content/themes/twentytwenty/about.php ...
show moreRepeatedly blocked bad web bot (tenant=82 method=GET path=/wp-content/themes/twentytwenty/about.php ua='python-requests/2.34.2')
show less
Aggressive web search of vulnerable pages: /bless.php /O-Simple.php /lock360.php /zwso.php /chosen.p ...
show moreAggressive web search of vulnerable pages: /bless.php /O-Simple.php /lock360.php /zwso.php /chosen.php /about.php /admin.php /mah.php /.wp/wso. ...
show less
Honeypot hit: HTTP GET http://[SOME-IP]/.git/config
URL: http://[SOME-IP]/.git/config
Method: GET
St ...
show moreHoneypot hit: HTTP GET http://[SOME-IP]/.git/config
URL: http://[SOME-IP]/.git/config
Method: GET
Status: 200
User-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:105.0) Gecko/20100101 Firefox/105.0
Host: [SOME-IP]
Accept: */*
Other Headers: accept-encoding: *, connection: keep-alive
show less
Hacking
Bad Web Bot
Anonymous
[redacted] 203.159.81.12 - - [24/Feb/2026:10:45:23 +0100] "GET /admin/controller/extension/extension ...
show more[redacted] 203.159.81.12 - - [24/Feb/2026:10:45:23 +0100] "GET /admin/controller/extension/extension/ HTTP/1.1" 404 236 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36"
[redacted] 203.159.81.12 - - [24/Feb/2026:10:45:23 +0100] "GET /admin/editor/ HTTP/1.1" 404 236 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:79.0) Gecko/20100101 Firefox/79.0"
[redacted] 203.159.81.12 - - [24/Feb/2026:10:45:23 +0100] "GET /admin/images/slider/ HTTP/1.1" 404 236 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36"
[redacted] 203.159.81.12 - - [24/Feb/2026:10:45:23 +0100] "GET /admin/tmp/ HTTP/1.1" 404 236 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.130 Safari/537.36"
[redacted] 203.159.81.12 - - [24/Feb/2026:10:45:24 +0100] "GET /admin/uploads/ HTTP/1.1" 404 236 "-" "Mozilla/5.0 (Windows NT 10.0; Win6
...
show less
SIP distributed brute force and IRSF fraud against VoIP infrastructure (ASTPP/FreeSWITCH) port 5060. ...
show moreSIP distributed brute force and IRSF fraud against VoIP infrastructure (ASTPP/FreeSWITCH) port 5060. Coordinated botnet stole SIP credentials via password dictionary attack. Role: credential theft + fraudulent calls (43 calls, 2.73h) to premium rate numbers. Total incident: 1367 calls, 109h, USD 4273 damages.
show less