JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 104.166.189.200

104.166.189.200 was found in our database!

This IP was reported 26 times. Confidence of Abuse is 12%: ?

12%

ISP	Zenlayer Inc
Usage Type	Data Center/Web Hosting/Transit
ASN	AS21859
Domain Name	zenlayer.com
Country	🇳🇱 Netherlands
City	Amsterdam, North Holland

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 104.166.189.200

Whois 104.166.189.200

IP Abuse Reports for 104.166.189.200:

This IP address has been reported a total of 26 times from 22 distinct sources. 104.166.189.200 was first reported on February 1st 2025, and the most recent report was 1 day ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇺🇸 TPI-Abuse	2026-08-22 17:25:11 (1 day ago)	(mod_security) mod_security (id:240335) triggered by 104.166.189.200 (-): 1 in the last 300 secs; Po ... show more (mod_security) mod_security (id:240335) triggered by 104.166.189.200 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Aug 22 13:25:05.996296 2026] [security2:error] [pid 6141:tid 6145] [client 104.166.189.200:49489] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 104.166.189.200 (+1 hits since last alert)\|michaelrandon.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "michaelrandon.com"] [uri "/xmlrpc.php"] [unique_id "aonbcQc1dOZr7TRcfVLWdAAAAME"] show less	Brute-Force Bad Web Bot Web App Attack
🇩🇪 4server	2026-07-15 09:23:54 (1 month ago)	[WedJul1511:23:50.3702772026][security2:error][pid3186206:tid3186295][client104.166.189.200:0]ModSec ... show more [WedJul1511:23:50.3702772026][security2:error][pid3186206:tid3186295][client104.166.189.200:0]ModSecurity:Accessdeniedwithcode403\(phase1\).Stringmatch\"/xmlrpc.php\"atREQUEST_URI.[file\"/etc/apache2/conf.d/modsec_custom_rules.conf\"][line\"170\"][id\"960024\"][msg\"XML-RPCdisabled\"][hostname\"risanamento-pareti-umide.ch\"][uri\"/xmlrpc.php\"][unique_id\"aldRpsn_EZaU-E9SJ7SdowAAAMM\"] show less	Port Scan Brute-Force Web App Attack
🇺🇸 TPI-Abuse	2026-07-14 05:27:23 (1 month ago)	(mod_security) mod_security (id:240335) triggered by 104.166.189.200 (-): 1 in the last 300 secs; Po ... show more (mod_security) mod_security (id:240335) triggered by 104.166.189.200 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jul 14 01:27:15.607644 2026] [security2:error] [pid 18403:tid 18403] [client 104.166.189.200:57014] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 104.166.189.200 (+1 hits since last alert)\|thesalonx.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "thesalonx.com"] [uri "/xmlrpc.php"] [unique_id "alXIs39Z244Cd7dn4_I0KgAAAAA"] show less	Brute-Force Bad Web Bot Web App Attack
🇮🇹 VHosting	2026-05-09 12:25:02 (3 months ago)	Detected WordPress attack from 4 different servers	Brute-Force Web App Attack
Anonymous	2026-04-21 13:15:15 (4 months ago)	2026-04-20 17:48:18,532 fail2ban.actions\[2022\]: WARNING \[asterisk-iptables\] Ban 104.166.189.2002 ... show more 2026-04-20 17:48:18,532 fail2ban.actions\[2022\]: WARNING \[asterisk-iptables\] Ban 104.166.189.2002026-04-20 19:44:22,811 fail2ban.actions\[2022\]: WARNING \[asterisk-iptables\] Ban 104.166.189.2002026-04-20 21:40:44,136 fail2ban.actions\[2022\]: WARNING \[asterisk-iptables\] Ban 104.166.189.2002026-04-20 23:36:27,204 fail2ban.actions\[2022\]: WARNING \[asterisk-iptables\] Ban 104.166.189.2002026-04-21 01:31:37,383 fail2ban.actions\[2022\]: WARNING \[asterisk-iptables\] Ban 104.166.189.2002026-04-21 03:27:26,622 fail2ban.actions\[2022\]: WARNING \[asterisk-iptables\] Ban 104.166.189.2002026-04-21 05:23:03,551 fail2ban.actions\[2022\]: WARNING \[asterisk-iptables\] Ban 104.166.189.2002026-04-21 07:18:51,454 fail2ban.actions\[2022\]: WARNING \[asterisk-iptables\] Ban 104.166.189.2002026-04-21 09:15:13,504 fail2ban.actions\[2022\]: WARNING \[asterisk-iptables\] Ban 104.166.189.200 ... show less	Fraud VoIP Brute-Force SSH
🇬🇧 carter_383	2026-04-20 21:47:47 (4 months ago)	2026-04-20T22:47:46+00:00 freepbx asterisk-full: [2026-04-20 22:47:39] NOTICE[9172] res_pjsip/pjsip_ ... show more 2026-04-20T22:47:46+00:00 freepbx asterisk-full: [2026-04-20 22:47:39] NOTICE[9172] res_pjsip/pjsip_distributor.c: Request 'REGISTER' from '<sip:[email protected]>' failed for '104.166.189.200:49354' (callid: 1023418090-1877328236-1189172521) - No matching endpoint found 2026-04-20T22:47:46+00:00 freepbx asterisk-full: [2026-04-20 22:47:39] NOTICE[22160] res_pjsip/pjsip_distributor.c: Request 'REGISTER' from '<sip:[email protected]>' failed for '104.166.189.200:49354' (callid: 1023418090-1877328236-1189172521) - No matching endpoint found 2026-04-20T22:47:46+00:00 freepbx asterisk-full: [2026-04-20 22:47:39] NOTICE[22160] res_pjsip/pjsip_distributor.c: Request 'REGISTER' from '<sip:[email protected]>' failed for '104.166.189.200:49354' (callid: 1023418090-1877328236-1189172521) - Failed to authenticate ... show less	Hacking Brute-Force Web App Attack
🇬🇧 poundawebsiteltd	2026-02-28 09:03:37 (5 months ago)	WP Exploit attempt. Evidence: [REDACTED_DOMAIN]:443 104.166.189.200 - - [28/Feb/2026:09:03:32 +0000] ... show more WP Exploit attempt. Evidence: [REDACTED_DOMAIN]:443 104.166.189.200 - - [28/Feb/2026:09:03:32 +0000] POST /wp-login.php HTTP/1.1 503 22118 - Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 Version/17.0 Safari/605.1.15 show less	Web App Attack
🇧🇪 cmbplf	2026-01-11 06:21:21 (7 months ago)	823 POST requests with url.path */wp-login.php	Brute-Force Bad Web Bot
🇲🇹 Malta	2026-01-11 05:59:40 (7 months ago)	104.166.189.200 - - [11/Jan/2026:06:59:39 +0100] "POST /wp-login.php HTTP/1.1" "Mozilla/5.0 (iPhone; ... show more 104.166.189.200 - - [11/Jan/2026:06:59:39 +0100] "POST /wp-login.php HTTP/1.1" "Mozilla/5.0 (iPhone; CPU iPhone OS 17_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.0 Mobile/15E148 Safari/604.1" show less	Hacking Web App Attack
Anonymous	2026-01-11 05:48:24 (7 months ago)	Failed Wordpress Logins	Web App Attack
🇫🇷 SpaceHost-Server	2026-01-07 23:27:14 (7 months ago)		Brute-Force Web App Attack
🇮🇹 VHosting	2025-12-02 08:45:06 (8 months ago)	Detected WordPress attack from 4 different servers	Brute-Force Web App Attack
🇮🇹 VHosting	2025-08-26 21:20:02 (11 months ago)	Detected WordPress attack from 4 different servers	Brute-Force Web App Attack
🇮🇹 VHosting	2025-08-26 21:10:02 (11 months ago)	Detected WordPress attack from 4 different servers	Brute-Force Web App Attack
🇪🇸 10dencehispahard SL	2025-08-08 10:23:07 (1 year ago)	WP probing for vulnerabilities	Hacking Exploited Host

Showing 1 to 15 of 26 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇹🇷 94.102.4.88

🇵🇰 223.123.73.196

🇧🇬 193.24.211.230

🇺🇸 184.105.139.109

🇺🇸 147.185.132.222

🇻🇳 116.110.0.72

🇨🇦 85.217.149.67

🇬🇧 62.60.130.253

🇩🇪 46.101.111.185

🇺🇸 44.217.255.167

🇨🇳 36.104.144.114

🇧🇪 34.53.241.205

🇺🇸 216.73.217.59

🇺🇸 192.155.90.118

🇨🇳 140.250.125.158

🇨🇳 117.15.95.103

🇵🇰 110.37.34.216

🇮🇩 103.146.202.84

🇳🇱 31.14.32.7

🇨🇴 181.128.122.33