JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 203.159.81.4

203.159.81.4 was found in our database!

This IP was reported 104 times. Confidence of Abuse is 28%: ?

28%

ISP	VPN Consumer Network Services
Usage Type	Data Center/Web Hosting/Transit
ASN	AS206092
Domain Name	vpnconsumer.com
Country	🇮🇱 Israel
City	Tel Aviv, Tel Aviv

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 203.159.81.4

Whois 203.159.81.4

IP Abuse Reports for 203.159.81.4:

This IP address has been reported a total of 104 times from 51 distinct sources. 203.159.81.4 was first reported on February 2nd 2024, and the most recent report was 7 hours ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇫🇷 Octopuce	2026-07-08 08:34:57 (7 hours ago)	Aggressive web search of vulnerable pages: /.well-known/wp-conflg.php /wp-admin/css/colors/blue/atom ... show more Aggressive web search of vulnerable pages: /.well-known/wp-conflg.php /wp-admin/css/colors/blue/atomlib.php /wp-admin/js/widgets/bypass.php /wp ... show less	Web App Attack
🇬🇧 consul.to	2026-06-24 02:24:32 (2 weeks ago)	Web attack/malicious scanning detected	Web App Attack
🇫🇷 masterguru	2026-06-22 13:55:13 (2 weeks ago)	Too much 404 requests in 1 minute. Operator GE matched 10 at IP:block_script. (46020-201)	Hacking
🇬🇧 consul.to	2026-06-22 12:28:47 (2 weeks ago)	Web attack/malicious scanning detected	Web App Attack
🇬🇧 consul.to	2026-06-21 08:56:47 (2 weeks ago)	Web attack/malicious scanning detected	Web App Attack
Anonymous	2026-06-12 12:10:33 (3 weeks ago)	Port Scan	Port Scan
🇺🇸 nodepile	2026-06-11 07:59:53 (3 weeks ago)	Repeatedly blocked bad web bot (tenant=82 method=GET path=/ss.php ua='python-requests/2.34.2')	Bad Web Bot
🇫🇷 Octopuce	2026-06-07 00:38:56 (1 month ago)	Aggressive web search of vulnerable pages: /filemanager.php /cgi-bin/bypass.php /.well-known/pki-val ... show more Aggressive web search of vulnerable pages: /filemanager.php /cgi-bin/bypass.php /.well-known/pki-validation/admin.php /wp-includes/IXR/admin.ph ... show less	Web App Attack
🇬🇧 consul.to	2026-06-06 20:35:55 (1 month ago)	Web attack/malicious scanning detected	Web App Attack
🇩🇪 ValtonTahiri	2026-02-24 22:27:04 (4 months ago)	Honeypot hit: HTTP GET http://[SOME-IP]/ URL: http://[SOME-IP]/ Method: GET Status: 200 User-agent: ... show more Honeypot hit: HTTP GET http://[SOME-IP]/ URL: http://[SOME-IP]/ Method: GET Status: 200 User-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 Host: [SOME-IP] Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Accept-language: en-US,en;q=0.5 Other Headers: accept-encoding: gzip, deflate, connection: keep-alive, upgrade-insecure-requests: 1, cache-control: max-age=0 show less	Hacking Bad Web Bot
🇫🇷 dynamix	2026-02-24 07:07:35 (4 months ago)	Multiple WAF Violations	Web App Attack
🇺🇸 TPI-Abuse	2026-02-24 05:37:25 (4 months ago)	(mod_security) mod_security (id:240000) triggered by 203.159.81.4 (-): 1 in the last 300 secs; Ports ... show more (mod_security) mod_security (id:240000) triggered by 203.159.81.4 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Feb 24 00:37:18.930943 2026] [security2:error] [pid 21370:tid 21370] [client 203.159.81.4:64663] ModSecurity: Access denied with code 403 (phase 2). String match ".php" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/24_Apps_Joomla.conf"] [line "74"] [id "240000"] [rev "1"] [msg "COMODO WAF: Protecting Joomla folder\|\|anthraxbook.info\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "Joomla"] [hostname "anthraxbook.info"] [uri "/images/stories/themes.php"] [unique_id "aZ05DrzoM1kVRxlYY2A0aQAAAAo"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-02-24 03:41:12 (4 months ago)	(mod_security) mod_security (id:240000) triggered by 203.159.81.4 (-): 1 in the last 300 secs; Ports ... show more (mod_security) mod_security (id:240000) triggered by 203.159.81.4 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Feb 23 22:41:04.869790 2026] [security2:error] [pid 23217:tid 23217] [client 203.159.81.4:36853] ModSecurity: Access denied with code 403 (phase 2). String match ".php" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/24_Apps_Joomla.conf"] [line "74"] [id "240000"] [rev "1"] [msg "COMODO WAF: Protecting Joomla folder\|\|nwesolutions.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "Joomla"] [hostname "nwesolutions.com"] [uri "/images/stories/themes.php"] [unique_id "aZ0d0D1O7x3q1e0ycNi_dAAAAAQ"] show less	Brute-Force Bad Web Bot Web App Attack
Anonymous	2026-01-06 17:03:34 (6 months ago)	Blocked by FortiWeb WAF ML threat detection. ML probability: 90%, Country: IL, Attack patterns: Word ... show more Blocked by FortiWeb WAF ML threat detection. ML probability: 90%, Country: IL, Attack patterns: WordPress scanning show less	Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-01-06 01:09:35 (6 months ago)	(mod_security) mod_security (id:240000) triggered by 203.159.81.4 (-): 1 in the last 300 secs; Ports ... show more (mod_security) mod_security (id:240000) triggered by 203.159.81.4 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jan 05 20:09:29.121646 2026] [security2:error] [pid 25343:tid 25343] [client 203.159.81.4:64567] ModSecurity: Access denied with code 403 (phase 2). String match ".php" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/24_Apps_Joomla.conf"] [line "74"] [id "240000"] [rev "1"] [msg "COMODO WAF: Protecting Joomla folder\|\|toolsforpoets.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "Joomla"] [hostname "toolsforpoets.com"] [uri "/images/stories/themes.php"] [unique_id "aVxgyftCOVtjQPBtRgg-lgAAACI"] show less	Brute-Force Bad Web Bot Web App Attack

Showing 1 to 15 of 104 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇩🇪 217.154.77.185

🇦🇴 193.163.125.189

🇧🇷 177.155.83.225

🇧🇷 170.245.250.157

🇨🇴 152.200.181.42

🇮🇩 103.153.190.105

🇰🇷 2406:da12:c4c:af03:45ef:885:e37d:8aa5

🇺🇸 216.73.216.36

🇯🇵 203.25.124.210

🇬🇧 185.216.145.186

🇷🇺 185.200.241.61

🇧🇷 177.190.66.26

🇺🇸 143.42.0.97

🇺🇸 134.209.122.148

🇷🇺 95.174.98.68

🇺🇸 66.132.186.185

🇨🇳 61.185.30.170

🇺🇸 20.102.96.148

🇧🇷 2804:74e8:cab:9000:2923:1fd1:5f90:bfca

🇺🇸 205.169.39.7