JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 203.159.81.95

203.159.81.95 was found in our database!

This IP was reported 70 times. Confidence of Abuse is 24%: ?

24%

ISP	VPN Consumer Network Services
Usage Type	Data Center/Web Hosting/Transit
ASN	AS206092
Domain Name	vpnconsumer.com
Country	🇮🇱 Israel
City	Tel Aviv, Tel Aviv

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 203.159.81.95

Whois 203.159.81.95

IP Abuse Reports for 203.159.81.95:

This IP address has been reported a total of 70 times from 40 distinct sources. 203.159.81.95 was first reported on October 1st 2022, and the most recent report was 11 hours ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇫🇮 JimArchon72	2026-08-28 19:40:01 (11 hours ago)	2026/08/28 19:39:53 "GET /wp-admin/fmadmin.php HTTP/2.0"	Web App Attack
🇺🇦 URAN Publishing Service	2026-08-28 19:02:30 (11 hours ago)	[28/Aug/2026:22:02:29 +0300] -- 203.159.81.95 Ban reason: User-Agent Go-http-client	Bad Web Bot Web App Attack
🇫🇷 dynamix	2026-07-16 12:07:51 (1 month ago)	Multiple WAF Violations	Web App Attack
Anonymous	2026-07-07 05:06:05 (1 month ago)	Trying to access config files	Web App Attack
🇩🇪 conseilgouz	2026-06-30 06:10:12 (1 month ago)	coe-7 : Trying access unauthorized files/dir=>/wp-admin/css/index.php	Hacking
🇫🇷 conseilgouz	2026-06-28 18:25:42 (2 months ago)	loe-7 : Trying access unauthorized files/dir=>//wp-content/index26.php	Hacking
🇬🇧 consul.to	2026-06-22 20:40:12 (2 months ago)	Web attack/malicious scanning detected	Web App Attack
🇫🇮 Shaik Sai Meera	2026-05-14 22:00:13 (3 months ago)	IM360 WAF: WordPress plugins/themes version enumeration	Brute-Force FTP Brute-Force Open Proxy
Anonymous	2026-04-24 07:40:03 (4 months ago)	\| [Dangerous/Israel] Aggressive IP 203.159.81.95 (~30 hits). Type: DoS Defender- Web server 400 erro ... show more \| [Dangerous/Israel] Aggressive IP 203.159.81.95 (~30 hits). Type: DoS Defender- Web server 400 error code show less	Web App Attack Hacking SQL Injection
Anonymous	2026-03-02 14:40:39 (5 months ago)	ALFA.TEaM.Web.Shell	Web App Attack
Anonymous	2026-02-23 19:50:42 (6 months ago)	[redacted] 203.159.81.95 - - [23/Feb/2026:20:50:38 +0100] "GET /admin/function.php HTTP/1.1" 404 236 ... show more [redacted] 203.159.81.95 - - [23/Feb/2026:20:50:38 +0100] "GET /admin/function.php HTTP/1.1" 404 236 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/75.0.3770.100 Safari/537.36" [redacted] 203.159.81.95 - - [23/Feb/2026:20:50:38 +0100] "GET /wp-includes/js/crop/admin.php HTTP/1.1" 404 236 "-" "Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.3" [redacted] 203.159.81.95 - - [23/Feb/2026:20:50:38 +0100] "GET /wp-includes/PHPMailer/admin.php HTTP/1.1" 404 236 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:76.0) Gecko/20100101 Firefox/76.0" [redacted] 203.159.81.95 - - [23/Feb/2026:20:50:40 +0100] "GET /.well-known/pki-validation/admin.php HTTP/1.1" 404 236 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.3" [redacted] 203.159.81.95 - - [23/Feb/2026:20:50:40 +0100] "GET /wp ... show less	Hacking Web App Attack
🇬🇧 consul.to	2026-02-23 08:16:50 (6 months ago)	Web attack/malicious scanning detected	Web App Attack
🇺🇸 TPI-Abuse	2026-02-22 16:52:55 (6 months ago)	(mod_security) mod_security (id:240000) triggered by 203.159.81.95 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:240000) triggered by 203.159.81.95 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Feb 22 11:52:23.331377 2026] [security2:error] [pid 31436:tid 31436] [client 203.159.81.95:63931] ModSecurity: Access denied with code 403 (phase 2). String match ".php" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/24_Apps_Joomla.conf"] [line "74"] [id "240000"] [rev "1"] [msg "COMODO WAF: Protecting Joomla folder\|\|leveeboard.org\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "Joomla"] [hostname "leveeboard.org"] [uri "/images/stories/themes.php"] [unique_id "aZs0RwrRY8LW2OdbVhfuLQAAAE0"] show less	Brute-Force Bad Web Bot Web App Attack
🇫🇷 dynamix	2026-02-22 13:49:37 (6 months ago)	Multiple WAF Violations	Web App Attack
🇺🇦 URAN Publishing Service	2026-02-22 11:19:36 (6 months ago)	203.159.81.95 - - [22/Feb/2026:13:19:34 +0200] "GET /wp-includes/IXR/fix.php7 HTTP/1.1" 404 282 "-" ... show more 203.159.81.95 - - [22/Feb/2026:13:19:34 +0200] "GET /wp-includes/IXR/fix.php7 HTTP/1.1" 404 282 "-" "Mozilla/5.0 (Windows NT 10.0; WOW64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/84.0.4147.105 Safari/537.36 OPR/70.0.3728.95" 203.159.81.95 - - [22/Feb/2026:13:19:35 +0200] "GET /wp-includes/widgets/dyqvcfqv.php HTTP/1.1" 404 282 "-" "Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36" ... show less	Web App Attack

Showing 1 to 15 of 70 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇭🇰 152.32.240.77

🇻🇳 103.159.54.61

🇳🇱 45.148.10.157

🇨🇳 14.103.118.61

🇧🇩 182.48.76.73

🇨🇳 123.180.182.54

🇨🇳 119.96.174.235

🇮🇳 106.216.120.44

🇺🇸 64.23.143.210

🇸🇬 47.84.109.254

🇩🇪 43.157.43.147

🇺🇸 4.148.2.5

🇺🇸 216.73.216.30

🇱🇹 213.176.26.182

🇻🇳 171.225.193.125

🇻🇳 113.174.100.102

🇪🇸 95.62.90.131

🇿🇲 74.244.129.93

🇮🇩 70.153.189.199

🇧🇷 45.168.90.225