JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 112.208.66.228

112.208.66.228 was found in our database!

This IP was reported 16 times. Confidence of Abuse is 60%: ?

60%

ISP	HOME_DSL
Usage Type	Fixed Line ISP
ASN	AS9299
Hostname(s)	112.208.66.228.pldt.net
Domain Name	pldthome.com
Country	🇵🇭 Philippines
City	Calinog, Western Visayas

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 112.208.66.228

Whois 112.208.66.228

IP Abuse Reports for 112.208.66.228:

This IP address has been reported a total of 16 times from 11 distinct sources. 112.208.66.228 was first reported on May 1st 2025, and the most recent report was 2 hours ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇺🇸 TPI-Abuse	2026-06-15 01:18:23 (2 hours ago)	(mod_security) mod_security (id:225170) triggered by 112.208.66.228 (112.208.66.228.pldt.net): 1 in ... show more (mod_security) mod_security (id:225170) triggered by 112.208.66.228 (112.208.66.228.pldt.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Jun 14 21:18:20.237921 2026] [security2:error] [pid 11692:tid 11694] [client 112.208.66.228:50987] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)\|\|ethicmark.org\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "ethicmark.org"] [uri "/wp-json/wp/v2/users"] [unique_id "ai9S3BnntfI0eOF6-sS8lAAAAUA"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-06-15 00:51:38 (2 hours ago)	(mod_security) mod_security (id:225170) triggered by 112.208.66.228 (112.208.66.228.pldt.net): 1 in ... show more (mod_security) mod_security (id:225170) triggered by 112.208.66.228 (112.208.66.228.pldt.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Jun 14 20:51:32.551981 2026] [security2:error] [pid 18164:tid 18164] [client 112.208.66.228:52264] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)\|\|elgatocapa.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "elgatocapa.com"] [uri "/wp-json/wp/v2/users"] [unique_id "ai9MlDCicsf5Ic6pMRc7ZQAAABY"] show less	Brute-Force Bad Web Bot Web App Attack
🇬🇧 consul.to	2026-06-15 00:08:40 (3 hours ago)	Web attack/malicious scanning detected	Web App Attack
🇩🇪 4server	2026-06-14 23:13:21 (4 hours ago)	[MonJun1501:13:17.6239042026][security2:error][pid2397636:tid2397670][client112.208.66.228:0]ModSecu ... show more [MonJun1501:13:17.6239042026][security2:error][pid2397636:tid2397670][client112.208.66.228:0]ModSecurity:Accessdeniedwithcode403\(phase1\).Stringmatch\"/xmlrpc.php\"atREQUEST_URI.[file\"/etc/apache2/conf.d/modsec_custom_rules.conf\"][line\"170\"][id\"960024\"][msg\"XML-RPCdisabled\"][hostname\"dellafoglia.ch\"][uri\"/xmlrpc.php\"][unique_id\"ai81jVJCBUvnhLQgbZXbNAAAABc\"] show less	Port Scan Brute-Force Web App Attack
🇺🇸 TPI-Abuse	2026-06-14 22:21:28 (5 hours ago)	(mod_security) mod_security (id:225170) triggered by 112.208.66.228 (112.208.66.228.pldt.net): 1 in ... show more (mod_security) mod_security (id:225170) triggered by 112.208.66.228 (112.208.66.228.pldt.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Jun 14 18:21:23.754223 2026] [security2:error] [pid 18638:tid 18638] [client 112.208.66.228:51261] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)\|\|coolerboxes.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "coolerboxes.com"] [uri "/wp-json/wp/v2/users"] [unique_id "ai8pY3hmvXkaI5jViUzYtQAAAAY"] show less	Brute-Force Bad Web Bot Web App Attack
🇩🇪 big-cloud.nl	2026-06-14 04:20:16 (23 hours ago)	Try to access /xmlrpc.php	Web App Attack
Anonymous	2026-06-14 04:20:09 (23 hours ago)	(wordpress) Failed wordpress login from 112.208.66.228 (PH/Philippines/112.208.66.228.pldt.net)	Brute-Force
🇳🇿 Tripwire	2026-06-13 23:17:31 (1 day ago)	Probing for Wordpress - /xmlrpc.php	Brute-Force Web App Attack
🇫🇷 SpaceHost-Server	2026-06-13 22:25:44 (1 day ago)		Brute-Force Web App Attack
🇩🇪 4server	2026-06-13 13:02:16 (1 day ago)	[SatJun1315:02:10.3292462026][security2:error][pid1155204:tid1155294][client112.208.66.228:0]ModSecu ... show more [SatJun1315:02:10.3292462026][security2:error][pid1155204:tid1155294][client112.208.66.228:0]ModSecurity:Accessdeniedwithcode403\(phase1\).Stringmatch\"/xmlrpc.php\"atREQUEST_URI.[file\"/etc/apache2/conf.d/modsec_custom_rules.conf\"][line\"170\"][id\"960024\"][msg\"XML-RPCdisabled\"][hostname\"simireinigung.ch\"][uri\"/xmlrpc.php\"][unique_id\"ai1U0tQR_2L686OuBKXY2gAAAMA\"] show less	Port Scan Brute-Force Web App Attack
🇳🇱 wlt-blocker	2026-06-12 23:41:31 (2 days ago)	Unauthorized access to webpage admin	Web App Attack
🇺🇸 TPI-Abuse	2026-06-12 20:44:42 (2 days ago)	(mod_security) mod_security (id:225170) triggered by 112.208.66.228 (112.208.66.228.pldt.net): 1 in ... show more (mod_security) mod_security (id:225170) triggered by 112.208.66.228 (112.208.66.228.pldt.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jun 12 16:44:38.848794 2026] [security2:error] [pid 6528:tid 6528] [client 112.208.66.228:53591] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)\|\|campnecon.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "campnecon.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aixvtlk0gVLOSjOAL7SEUQAAAAQ"] show less	Brute-Force Bad Web Bot Web App Attack
🇳🇿 Tripwire	2026-06-12 00:12:17 (3 days ago)	Probing for Wordpress - /xmlrpc.php	Brute-Force Web App Attack
🇳🇱 ipoac.nl	2026-06-11 21:14:19 (3 days ago)	-:443 112.208.66.228 - - [11/Jun/2026:23:14:18 +0200] - "POST /xmlrpc.php HTTP/1.1" 403 6401 "-" "Mo ... show more -:443 112.208.66.228 - - [11/Jun/2026:23:14:18 +0200] - "POST /xmlrpc.php HTTP/1.1" 403 6401 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7; x86) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.0.0 Safari/537.36" show less	Bad Web Bot
🇺🇸 TheMadBeaker	2025-07-03 00:48:34 (11 months ago)	Fail2Ban Ban Triggered HTTP Exploit Attempt	Brute-Force Web App Attack

Showing 1 to 15 of 16 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇰🇷 218.157.205.238

🇩🇪 193.142.43.122

🇳🇱 178.16.53.216

🇮🇩 157.15.40.86

🇵🇱 146.59.1.225

🇸🇬 101.32.240.31

🇧🇬 79.124.56.138

🇫🇷 62.210.142.171

🇸🇬 43.156.60.15

🇺🇸 34.182.184.122

🇮🇳 203.193.168.136

🇺🇸 195.184.76.232

🇻🇪 190.142.97.50

🇮🇩 182.11.152.10

🇮🇳 152.52.236.122

🇸🇦 129.208.105.248

🇮🇩 121.101.134.202

🇩🇪 91.217.249.185

🇮🇷 78.109.200.147

🇳🇱 45.142.193.121