JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 203.159.81.21

203.159.81.21 was found in our database!

This IP was reported 96 times. Confidence of Abuse is 48%: ?

48%

ISP	VPN Consumer Network Services
Usage Type	Data Center/Web Hosting/Transit
ASN	AS206092
Domain Name	vpnconsumer.com
Country	🇮🇱 Israel
City	Tel Aviv, Tel Aviv

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 203.159.81.21

Whois 203.159.81.21

IP Abuse Reports for 203.159.81.21:

This IP address has been reported a total of 96 times from 53 distinct sources. 203.159.81.21 was first reported on April 14th 2024, and the most recent report was 18 hours ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇺🇸 TPI-Abuse	2026-06-22 18:05:18 (18 hours ago)	(mod_security) mod_security (id:240000) triggered by 203.159.81.21 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:240000) triggered by 203.159.81.21 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jun 22 14:05:14.161364 2026] [security2:error] [pid 4182:tid 4182] [client 203.159.81.21:55345] ModSecurity: Access denied with code 403 (phase 2). String match ".php" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/24_Apps_Joomla.conf"] [line "87"] [id "240000"] [rev "1"] [msg "COMODO WAF: Protecting Joomla folder\|\|paulburns.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "Joomla"] [hostname "paulburns.com"] [uri "/images/stories/themes.php"] [unique_id "ajl5WqGS6Il_zupqBYBMUgAAAAI"] show less	Brute-Force Bad Web Bot Web App Attack
🇫🇷 masterguru	2026-06-22 13:55:43 (22 hours ago)	Too much 404 requests in 1 minute. Operator GE matched 10 at IP:block_script. (46020-201)	Hacking
🇬🇧 consul.to	2026-06-22 02:05:26 (1 day ago)	Web attack/malicious scanning detected	Web App Attack
🇺🇸 TPI-Abuse	2026-06-21 22:57:07 (1 day ago)	(mod_security) mod_security (id:240000) triggered by 203.159.81.21 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:240000) triggered by 203.159.81.21 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Jun 21 18:56:59.351252 2026] [security2:error] [pid 25462:tid 25462] [client 203.159.81.21:33157] ModSecurity: Access denied with code 403 (phase 2). String match ".php" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/24_Apps_Joomla.conf"] [line "74"] [id "240000"] [rev "1"] [msg "COMODO WAF: Protecting Joomla folder\|\|lukeschicago.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "Joomla"] [hostname "lukeschicago.com"] [uri "/images/stories/themes.php"] [unique_id "ajhsO7Fd4C1kqVLmDM5IfAAAAAo"] show less	Brute-Force Bad Web Bot Web App Attack
🇬🇧 consul.to	2026-06-20 21:32:37 (2 days ago)	Web attack/malicious scanning detected	Web App Attack
🇬🇧 consul.to	2026-06-19 19:39:17 (3 days ago)	Web attack/malicious scanning detected	Web App Attack
🇳🇱 Site.eu	2026-06-19 18:54:35 (3 days ago)	Excessive 404/403 errors	Brute-Force
🇺🇸 nodepile	2026-06-11 07:38:05 (1 week ago)	Repeatedly blocked bad web bot (tenant=82 method=GET path=/crgio.php ua='python-requests/2.34.2')	Bad Web Bot
🇫🇮 inlink.ltd	2026-06-09 01:18:50 (2 weeks ago)	Known malicious PHP file or CMS probe	Web App Attack
🇫🇷 dynamix	2026-06-07 12:00:11 (2 weeks ago)	Multiple WAF Violations	Web App Attack
🇫🇷 Octopuce	2026-06-07 00:41:06 (2 weeks ago)	Aggressive web search of vulnerable pages: /lock.php /wp-admin/css/colors/blue/gold.php /wp-includes ... show more Aggressive web search of vulnerable pages: /lock.php /wp-admin/css/colors/blue/gold.php /wp-includes/atomlib.php /wp-includes/rest-api/index.ph ... show less	Web App Attack
🇺🇸 TPI-Abuse	2026-04-27 12:38:17 (1 month ago)	(mod_security) mod_security (id:210730) triggered by 203.159.81.21 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:210730) triggered by 203.159.81.21 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Apr 27 08:38:09.073994 2026] [security2:error] [pid 31572:tid 31599] [client 203.159.81.21:60875] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy\|\|philacentric.com\|F\|2"] [data ".com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "philacentric.com"] [uri "/mailto:[email protected]"] [unique_id "ae9YsZ-AUDboz1yrCFR3mQAAAhY"] show less	Brute-Force Bad Web Bot Web App Attack
🇳🇱 Alboweb B.V.	2026-04-25 18:17:21 (1 month ago)	Bad web bot activity detected by Fail2Ban in plesk-apache-badbot jail	Bad Web Bot
🇫🇷 dynamix	2026-02-24 09:13:36 (3 months ago)	Multiple WAF Violations	Web App Attack
🇬🇧 consul.to	2026-02-24 06:20:42 (3 months ago)	Web attack/malicious scanning detected	Web App Attack

Showing 1 to 15 of 96 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇰🇷 211.223.107.86

🇨🇳 120.85.185.142

🇫🇮 77.105.161.120

🇺🇸 172.185.24.228

🇮🇳 168.144.185.111

🇨🇳 106.227.33.165

🇻🇳 103.200.25.79

🇮🇩 103.153.190.105

🇦🇪 91.72.153.110

🇳🇱 45.148.10.147

🇨🇳 220.197.14.60

🇷🇴 193.32.162.203

🇳🇱 138.226.239.11

🇨🇳 124.64.220.255

🇨🇳 119.97.189.120

🇵🇹 94.61.159.91

🇫🇷 92.205.188.223

🇷🇺 79.104.0.82

🇬🇧 213.166.84.46

🇰🇷 112.169.8.251