JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 203.159.81.66

203.159.81.66 was found in our database!

This IP was reported 58 times. Confidence of Abuse is 4%: ?

ISP	VPN Consumer Network Services
Usage Type	Data Center/Web Hosting/Transit
ASN	AS206092
Domain Name	vpnconsumer.com
Country	🇮🇱 Israel
City	Tel Aviv, Tel Aviv

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 203.159.81.66

Whois 203.159.81.66

IP Abuse Reports for 203.159.81.66:

This IP address has been reported a total of 58 times from 29 distinct sources. 203.159.81.66 was first reported on March 24th 2024, and the most recent report was 7 hours ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇬🇧 consul.to	2026-06-23 04:37:15 (7 hours ago)	Web attack/malicious scanning detected	Web App Attack
🇺🇸 WizardsToolkit	2026-03-26 23:32:12 (2 months ago)	attempted to access /404.php	Web App Attack
🇩🇪 rh24	2026-02-23 23:59:48 (3 months ago)	(mod_security) mod_security triggered on hostname [redacted] 203.159.81.66 (IL/Israel/-): (CF_ENABL ... show more (mod_security) mod_security triggered on hostname [redacted] 203.159.81.66 (IL/Israel/-): (CF_ENABLE) show less	SQL Injection
Anonymous	2026-02-23 18:08:57 (3 months ago)	[redacted] 203.159.81.66 - - [23/Feb/2026:19:08:50 +0100] "GET /wp-admin/maint/file.php HTTP/1.1" 40 ... show more [redacted] 203.159.81.66 - - [23/Feb/2026:19:08:50 +0100] "GET /wp-admin/maint/file.php HTTP/1.1" 404 236 "-" "Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.149 Safari/537.36" [redacted] 203.159.81.66 - - [23/Feb/2026:19:08:51 +0100] "GET /.well-known/acme-challenge/admin.php HTTP/1.1" 404 236 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36" [redacted] 203.159.81.66 - - [23/Feb/2026:19:08:52 +0100] "GET /wp-admin/theme-editor.php HTTP/1.1" 404 236 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/69.0.3497.100 Safari/537.36" [redacted] 203.159.81.66 - - [23/Feb/2026:19:08:52 +0100] "GET /wp-admin/css/colors/blue/abc.php HTTP/1.1" 404 236 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:75.0) Gecko/20100101 Firefox/75.0" [redacted] 203.159.81.66 - - [23/Feb/2026:19:08:52 +0100] "GET ... show less	Hacking Web App Attack
🇫🇷 dynamix	2026-02-23 13:33:22 (3 months ago)	Multiple WAF Violations	Web App Attack
🇫🇷 ✨	2026-02-23 01:22:09 (4 months ago)	Domain : hermanwaldexhibition.com Rule : hack 2026-02-23 01:21:00 *hidden-privacy* GET /wp-admin ... show more Domain : hermanwaldexhibition.com Rule : hack 2026-02-23 01:21:00 *hidden-privacy* GET /wp-admin/css/colors/midnight/admin.php - 80 - 203.159.81.66 HTTP/1.1 Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/84.0.4147.105 Safari/537.36 OPR/70.0.3728.95 - hermanwaldexhibition.com 301 0 0 490 258 84 - - show less	Exploited Host Web App Attack
🇺🇸 TPI-Abuse	2026-02-22 16:54:57 (4 months ago)	(mod_security) mod_security (id:240000) triggered by 203.159.81.66 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:240000) triggered by 203.159.81.66 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Feb 22 11:53:24.381194 2026] [security2:error] [pid 32069:tid 32069] [client 203.159.81.66:44981] ModSecurity: Access denied with code 403 (phase 2). String match ".php" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/24_Apps_Joomla.conf"] [line "74"] [id "240000"] [rev "1"] [msg "COMODO WAF: Protecting Joomla folder\|\|borzoi-pedigree.info\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "Joomla"] [hostname "borzoi-pedigree.info"] [uri "/images/stories/themes.php"] [unique_id "aZs0hKMKmnUmGxRlTEIUkAAAAAQ"] show less	Brute-Force Bad Web Bot Web App Attack
🇬🇧 consul.to	2026-02-22 15:06:10 (4 months ago)	Web attack/malicious scanning detected	Web App Attack
Anonymous	2026-01-26 19:56:18 (4 months ago)	wordpress-trap	Web App Attack
🇺🇸 TPI-Abuse	2026-01-06 17:46:27 (5 months ago)	(mod_security) mod_security (id:240000) triggered by 203.159.81.66 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:240000) triggered by 203.159.81.66 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jan 06 12:46:21.497948 2026] [security2:error] [pid 10419:tid 10419] [client 203.159.81.66:46909] ModSecurity: Access denied with code 403 (phase 2). String match ".php" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/24_Apps_Joomla.conf"] [line "74"] [id "240000"] [rev "1"] [msg "COMODO WAF: Protecting Joomla folder\|\|vitality-webb.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "Joomla"] [hostname "vitality-webb.com"] [uri "/images/stories/themes.php"] [unique_id "aV1Kbb953AoaGAMx7p9cKgAAAAs"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-01-06 10:21:51 (5 months ago)	(mod_security) mod_security (id:240000) triggered by 203.159.81.66 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:240000) triggered by 203.159.81.66 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jan 06 05:21:48.232759 2026] [security2:error] [pid 15133:tid 15133] [client 203.159.81.66:22145] ModSecurity: Access denied with code 403 (phase 2). String match ".php" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/24_Apps_Joomla.conf"] [line "74"] [id "240000"] [rev "1"] [msg "COMODO WAF: Protecting Joomla folder\|\|www.freepatternstoknit.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "Joomla"] [hostname "www.freepatternstoknit.com"] [uri "/images/stories/themes.php"] [unique_id "aVziPBjDlQ1PTN4o-CNVvgAAABs"] show less	Brute-Force Bad Web Bot Web App Attack
🇫🇷 dynamix	2026-01-06 09:32:56 (5 months ago)	Multiple WAF Violations	Web App Attack
Anonymous	2025-11-26 01:53:14 (6 months ago)	wordpress-trap	Web App Attack
🇧🇪 cmbplf	2025-11-21 18:54:36 (7 months ago)	987 requests with url.path */xmlrpc.php	Brute-Force Bad Web Bot
🇵🇱 sefinek.net	2025-11-20 19:14:49 (7 months ago)	Triggered Cloudflare WAF (firewallCustom) from IL. Action taken: MANAGED_CHALLENGE Protocol: HTTP/1. ... show more Triggered Cloudflare WAF (firewallCustom) from IL. Action taken: MANAGED_CHALLENGE Protocol: HTTP/1.1 (GET method) Endpoint: /.well-known/acme-challenge/wp-login.php UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/75.0.3770.100 Safari/537.36 This report was generated by: https://github.com/sefinek/Cloudflare-WAF-To-AbuseIPDB show less	Bad Web Bot

Showing 1 to 15 of 58 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇰🇷 211.247.127.250

🇺🇸 185.141.119.163

🇨🇦 85.217.149.41

🇨🇱 64.176.12.40

🇳🇱 45.142.193.53

🇬🇧 35.203.211.132

🇺🇸 20.29.23.198

🇰🇷 220.93.167.144

🇳🇬 197.211.59.229

🇺🇸 185.141.119.152

🇺🇸 185.141.119.140

🇮🇱 185.60.170.211

🇺🇸 172.59.220.147

🇺🇸 164.90.156.35

🇮🇳 117.241.77.78

🇸🇬 101.47.155.9

🇺🇸 47.251.252.163

🇺🇸 2607:f8b0:4001:c32::12d

🇺🇸 2607:f8b0:4001:c01::12e

🇵🇦 190.123.46.124