JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

109.161.166.236

Recent Activity

Abuse Confidence Score

19% Caution

35 reports

23 reporters · latest 1 day ago

ISP: ZAIN BAHRAIN B.S.C.
Usage Type: Mobile ISP
ASN: AS31452
Domain Name: zain.com
Country: 🇧🇭 Bahrain
City: Madinat Hamad, Northern

ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report Whois

Example preview

Account required for the enhanced features Log in Sign up

Abuse Reports

Export reports CSV

Total reports

35 from 23 distinct reporters

First reported

June 21st 2026

Most recent report

1 day ago

Last 60 days

Top reporter locations 🇩🇪 Germany 2 🇷🇺 Russian Federation 1

Most common categories Web App Attack 2 Hacking 2 Bad Web Bot 1 Exploited Host 1 Port Scan 1

Recent reports We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇩🇪 FeG Deutschland	2026-11-11 06:08:30 UTC · (1 day ago)	Looking for CMS/PHP/SQL vulnerablilities/excessive crawling - 28	Exploited Host Web App Attack
Anonymous	2026-11-06 22:15:04 UTC · (6 days ago)	Large-scale coordinated botnet (8M+ IPs). Ordered by Alexander Pen'kov (alexander-pen-kov-7b41aa6a/Shursky [yordim\|LIS\|MOW]): Retaliation after theft; Attacker: Mikhail Smirnov (mikhail-smirnov-79830323/Aidan [MOW]): Employed by Angara Technologies G ... show more Large-scale coordinated botnet (8M+ IPs). Ordered by Alexander Pen'kov (alexander-pen-kov-7b41aa6a/Shursky [yordim\|LIS\|MOW]): Retaliation after theft; Attacker: Mikhail Smirnov (mikhail-smirnov-79830323/Aidan [MOW]): Employed by Angara Technologies Group \| Attack Signature Blocked: /wishlist/index/add/product/450/form_key/G3U4Fgez1IEwKLPr/ \| UA: Opera/8.91.(Windows NT 6.1; mt-MT) Presto/2.9.161 Version/12.00 \| (Magento Site) show less	Hacking Bad Web Bot Web App Attack
Anonymous	2026-09-22 08:13:19 UTC · (1 month ago)	denied traffic to a honeypot network. destination port 23.	Port Scan Hacking
🇺🇸 lostswordfish.com	2026-06-24 09:26:03 UTC · (4 months ago)	Wordfence waf block on pameganslaw	Web App Attack
🇳🇱 Site.eu	2026-06-24 09:04:16 UTC · (4 months ago)	Repeated wp-login/xmlrpc attempts	Brute-Force SSH
🇩🇪 rh24	2026-06-24 04:28:05 UTC · (4 months ago)	(wordpress) Failed wordpress login from 109.161.166.236 (BH/Bahrain/109-161-166-236.rev.bb.zain.com): (CF_ENABLE)	Brute-Force
🇺🇸 oralunal	2026-06-23 19:04:19 UTC · (4 months ago)	IP banned by Fail2Ban in jail ente-suss ente.com-ssl_log mvfnds ...	Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-06-23 18:35:31 UTC · (4 months ago)	(mod_security) mod_security (id:240335) triggered by 109.161.166.236 (109-161-166-236.rev.bb.zain.com): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jun 23 14:35:23.635523 2026] [security2:error] [pid 32566:tid 32566 ... show more (mod_security) mod_security (id:240335) triggered by 109.161.166.236 (109-161-166-236.rev.bb.zain.com): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jun 23 14:35:23.635523 2026] [security2:error] [pid 32566:tid 32566] [client 109.161.166.236:57642] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 109.161.166.236 (+1 hits since last alert)\|thebrotherhoodlounge.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "thebrotherhoodlounge.com"] [uri "/xmlrpc.php"] [unique_id "ajrR65GrseRkEA7Vsx_4lAAAAAM"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-06-23 14:53:46 UTC · (4 months ago)	(mod_security) mod_security (id:240335) triggered by 109.161.166.236 (109-161-166-236.rev.bb.zain.com): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jun 23 10:53:40.060180 2026] [security2:error] [pid 28747:tid 28755 ... show more (mod_security) mod_security (id:240335) triggered by 109.161.166.236 (109-161-166-236.rev.bb.zain.com): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jun 23 10:53:40.060180 2026] [security2:error] [pid 28747:tid 28755] [client 109.161.166.236:50041] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 109.161.166.236 (+1 hits since last alert)\|northtexaslive.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "northtexaslive.com"] [uri "/xmlrpc.php"] [unique_id "ajqd9Ih2hijwV7MCACIwHAAAAQQ"] show less	Brute-Force Bad Web Bot Web App Attack
🇪🇸 alferez	2026-06-23 14:36:17 UTC · (4 months ago)	xmlrpc.php attack DOS	Hacking Exploited Host Web App Attack
🇦🇺 AWW-Admin	2026-06-23 11:31:05 UTC · (4 months ago)	(wordpress) Failed wordpress login from 109.161.166.236 (BH/Bahrain/109-161-166-236.rev.bb.zain.com)	Brute-Force
🇺🇸 TPI-Abuse	2026-06-23 06:39:38 UTC · (4 months ago)	(mod_security) mod_security (id:240335) triggered by 109.161.166.236 (109-161-166-236.rev.bb.zain.com): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jun 23 02:39:30.905019 2026] [security2:error] [pid 1919:tid 1919] ... show more (mod_security) mod_security (id:240335) triggered by 109.161.166.236 (109-161-166-236.rev.bb.zain.com): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jun 23 02:39:30.905019 2026] [security2:error] [pid 1919:tid 1919] [client 109.161.166.236:65332] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 109.161.166.236 (+1 hits since last alert)\|thehealthyplaceclayton.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "thehealthyplaceclayton.com"] [uri "/xmlrpc.php"] [unique_id "ajoqIhNnxfSKL9G8VPbRsAAAAAs"] show less	Brute-Force Bad Web Bot Web App Attack
Anonymous	2026-06-23 05:54:41 UTC · (4 months ago)	[redacted] 109.161.166.236 - - [23/Jun/2026:07:53:59 +0200] "POST /xmlrpc.php HTTP/1.1" 403 6555 "-" "Jetpack by WordPress.com" [redacted] 109.161.166.236 - - [23/Jun/2026:07:54:10 +0200] "POST /xmlrpc.php HTTP/1.1" 403 6641 "-" "Jetpack/12.1; WordP ... show more [redacted] 109.161.166.236 - - [23/Jun/2026:07:53:59 +0200] "POST /xmlrpc.php HTTP/1.1" 403 6555 "-" "Jetpack by WordPress.com" [redacted] 109.161.166.236 - - [23/Jun/2026:07:54:10 +0200] "POST /xmlrpc.php HTTP/1.1" 403 6641 "-" "Jetpack/12.1; WordPress/6.1; http://site16271420.com" [redacted] 109.161.166.236 - - [23/Jun/2026:07:54:20 +0200] "POST /xmlrpc.php HTTP/1.1" 403 6555 "-" "Jetpack by WordPress.com" [redacted] 109.161.166.236 - - [23/Jun/2026:07:54:30 +0200] "POST /xmlrpc.php HTTP/1.1" 403 6555 "-" "Jetpack by WordPress.com" [redacted] 109.161.166.236 - - [23/Jun/2026:07:54:40 +0200] "POST /xmlrpc.php HTTP/1.1" 403 6641 "-" "Jetpack by WordPress.com (Jetpack 12.1; WordPress 6.4)" ... show less	Hacking Web App Attack
🇹🇭 thaizone.com	2026-06-23 05:20:11 UTC · (4 months ago)	Brute-forcing login against websites (D1-1) #1	Web App Attack Hacking
Anonymous	2026-06-23 04:55:49 UTC · (4 months ago)	[ssd5.kdns.gr] httpd-xmlrpc-post: sites=pidalio.gr; logs=/var/log/httpd/domains/pidalio.gr.log; samples=/xmlrpc.php	Brute-Force Web App Attack

Showing 1 to 15 of 35 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown

Recently Reported IPs:

🇩🇪 185.73.23.133

🇧🇷 177.193.214.34

🇨🇦 138.197.142.83

🇨🇳 124.74.97.18

🇪🇸 46.6.124.199

🇷🇺 46.0.88.44

🇹🇷 45.136.7.187

🇩🇪 23.132.164.185

🇺🇸 20.118.251.121

🇻🇳 2001:ee0:820a:d40b:2486:2544:4e32:e582

🇳🇱 195.178.110.97

🇬🇧 195.96.139.215

🇩🇪 176.2.36.181

🇨🇦 144.217.61.131

🇻🇳 118.70.182.193

🇺🇸 104.28.245.40

🇺🇸 104.28.213.40

🇺🇸 91.230.168.140

🇧🇷 45.186.158.87

🇧🇷 45.170.147.160