JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

118.148.166.123

Activity Trending Down

Abuse Confidence Score

75% Critical

30 reports

22 reporters · latest 2 weeks ago

ISP: 2degrees
Usage Type: Fixed Line ISP
ASN: AS9790
Domain Name: 2degrees.nz
Country: 🇳🇿 New Zealand
City: Tauranga, Bay of Plenty

ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report Whois

Example preview

Account required for the enhanced features Log in Sign up

Abuse Reports

Export reports CSV

Total reports

30 from 22 distinct reporters

First reported

October 22nd 2026

Most recent report

2 weeks ago

Last 60 days

Top reporter locations 🇩🇪 Germany 10 🇬🇧 United Kingdom of Great Britain and Northern Ireland 5 🇺🇸 United States of America 5

Most common categories Web App Attack 25 Brute-Force 7 Hacking 5 Port Scan 5 Bad Web Bot 3

Old reports The most recent abuse report for this IP address is from 2 weeks ago. It is possible that this IP is no longer involved in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
Anonymous	2026-10-28 14:39:20 UTC · (2 weeks ago)	WordPress login / xmlrpc probing across multiple sites	Web App Attack
🇨🇭 4server	2026-10-28 00:16:54 UTC · (2 weeks ago)	[WedOct2801:16:50.2892562026][security2:error][pid33377:tid33489][client118.148.166.123:0]ModSecurity:Accessdeniedwithcode403\(phase1\).Stringmatch\"/xmlrpc.php\"atREQUEST_URI.[file\"/etc/apache2/conf.d/modsec_custom_rules.conf\"][line\"714\"][id\"96 ... show more [WedOct2801:16:50.2892562026][security2:error][pid33377:tid33489][client118.148.166.123:0]ModSecurity:Accessdeniedwithcode403\(phase1\).Stringmatch\"/xmlrpc.php\"atREQUEST_URI.[file\"/etc/apache2/conf.d/modsec_custom_rules.conf\"][line\"714\"][id\"960024\"][msg\"XML-RPCdisabled\"][hostname\"spc-ticino.ch\"][uri\"/xmlrpc.php\"][unique_id\"auE-8ue2OYGtG6BQUFDF3wAAAMw\"] show less	Hacking Web App Attack
🇩🇪 4server	2026-10-27 20:16:46 UTC · (2 weeks ago)	[TueOct2721:16:40.3858162026][security2:error][pid187516:tid187654][client118.148.166.123:0]ModSecurity:Accessdeniedwithcode403\(phase1\).Stringmatch\"/xmlrpc.php\"atREQUEST_URI.[file\"/etc/apache2/conf.d/modsec_custom_rules.conf\"][line\"170\"][id\" ... show more [TueOct2721:16:40.3858162026][security2:error][pid187516:tid187654][client118.148.166.123:0]ModSecurity:Accessdeniedwithcode403\(phase1\).Stringmatch\"/xmlrpc.php\"atREQUEST_URI.[file\"/etc/apache2/conf.d/modsec_custom_rules.conf\"][line\"170\"][id\"960024\"][msg\"XML-RPCdisabled\"][hostname\"jrtradeinnovation.ch\"][uri\"/xmlrpc.php\"][unique_id\"auEGqMk_MYGuQ6mDAkUZtQAAAJQ\"] show less	Port Scan Brute-Force Web App Attack
Anonymous	2026-10-27 17:15:54 UTC · (2 weeks ago)	(caddyscan) Scanner path probe from 118.148.166.123 (NZ/New Zealand/-): 5 in the last 3600 secs; Ports: ; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: [REDACTED] 200 2627 118.148.166.123 - - [27/Oct/2026:17:06:05 +0000] "POST /xmlrpc.php HTTP/ ... show more (caddyscan) Scanner path probe from 118.148.166.123 (NZ/New Zealand/-): 5 in the last 3600 secs; Ports: ; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: [REDACTED] 200 2627 118.148.166.123 - - [27/Oct/2026:17:06:05 +0000] "POST /xmlrpc.php HTTP/1.1" [REDACTED] 200 2627 118.148.166.123 - - [27/Oct/2026:17:15:50 +0000] "POST /xmlrpc.php HTTP/1.1" [REDACTED] 200 2627 118.148.166.123 - - [27/Oct/2026:17:15:50 +0000] "POST /xmlrpc.php HTTP/1.1" [REDACTED] 200 2627 118.148.166.123 - - [27/Oct/2026:17:15:51 +0000] "POST /xmlrpc.php HTTP/1.1" [REDACTED] 200 2627 118.148.166.123 - - [27/Oct/2026:17:15:52 +0000] "POST /xmlrpc.php HTTP/1.1" show less	Port Scan
🇺🇸 Lea	2026-10-27 17:02:02 UTC · (2 weeks ago)	Malicious web probe on bearstool.com: 118.148.166.123 - - [27/Oct/2026:13:02:02 -0400] "POST /xmlrpc.php HTTP/2.0" 403 5961 "" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7; arm64) AppleWebKit/537.36 (KHTML, like Gecko) Opera/63.0.0.0 Safari/537.36 ... show more Malicious web probe on bearstool.com: 118.148.166.123 - - [27/Oct/2026:13:02:02 -0400] "POST /xmlrpc.php HTTP/2.0" 403 5961 "" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7; arm64) AppleWebKit/537.36 (KHTML, like Gecko) Opera/63.0.0.0 Safari/537.36" show less	Bad Web Bot Web App Attack
🇫🇮 stinpriza	2026-10-27 02:57:23 UTC · (2 weeks ago)	Web App Attack	Web App Attack
Anonymous	2026-10-27 02:51:08 UTC · (2 weeks ago)	WordPress login / xmlrpc probing across multiple sites	Web App Attack
🇺🇸 rsiddall	2026-10-26 23:50:40 UTC · (2 weeks ago)	118.148.166.123 - - [26/Oct/2026:19:50:34 -0400] "POST /xmlrpc.php HTTP/1.1" 301 242 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; arm64) AppleWebKit/537.36 (KHTML, like Gecko) Safari/14.0.0.0 Safari/537.36" 118.148.166.123 - - [26/Oct/2026:19:50:38 - ... show more 118.148.166.123 - - [26/Oct/2026:19:50:34 -0400] "POST /xmlrpc.php HTTP/1.1" 301 242 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; arm64) AppleWebKit/537.36 (KHTML, like Gecko) Safari/14.0.0.0 Safari/537.36" 118.148.166.123 - - [26/Oct/2026:19:50:38 -0400] "POST /xmlrpc.php HTTP/1.1" 301 242 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7; x64) AppleWebKit/537.36 (KHTML, like Gecko) Safari/14.0.0.0 Safari/537.36" ... show less	Brute-Force
Anonymous	2026-10-26 07:32:03 UTC · (2 weeks ago)	Blocked by web application firewall: automated malicious HTTP requests (WordPress xmlrpc.php / wp-login brute-force and admin-panel scanning). Distributed botnet / automated tooling. No legitimate use.	Brute-Force Web App Attack
🇩🇪 neckaralb-admin.de	2026-10-26 07:01:42 UTC · (2 weeks ago)	(wordpress) Failed login wp-login.php or xmlrpc.php	Web App Attack
🇩🇪 big-cloud.nl	2026-10-25 20:04:26 UTC · (2 weeks ago)	Try to access /xmlrpc.php	Web App Attack
🇩🇪 maxpower	2026-10-25 17:54:37 UTC · (2 weeks ago)	(wp_fingerprint) REGOLA 6 - WP Exploit Attempt xmlrpc 118.148.166.123 (NZ/New Zealand/-): 1 in the last 3600 secs; Ports: ; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: 118.148.166.123 - - [25/Oct/2026:18:54:32 +0100] "POST /xmlrpc.php HTTP/1. ... show more (wp_fingerprint) REGOLA 6 - WP Exploit Attempt xmlrpc 118.148.166.123 (NZ/New Zealand/-): 1 in the last 3600 secs; Ports: ; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: 118.148.166.123 - - [25/Oct/2026:18:54:32 +0100] "POST /xmlrpc.php HTTP/1.1" 200 12028 "-" "Mozilla/5.0 (Windows NT 10.0; arm64) AppleWebKit/537.36 (KHTML, like Gecko) Opera/68.0.0.0 Safari/537.36" "-" host=villaelenabeb.it show less	Port Scan
Anonymous	2026-10-25 15:53:37 UTC · (2 weeks ago)	WordPress login / xmlrpc probing across multiple sites	Web App Attack
🇳🇱 Site.eu	2026-10-25 15:39:15 UTC · (2 weeks ago)	WordPress login brute force: 30 failed logins in 30 min on 1 server	Brute-Force Web App Attack
🇫🇮 inlink.ltd	2026-10-25 12:20:45 UTC · (2 weeks ago)	Known malicious PHP file or CMS probe	Web App Attack

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown

Recently Reported IPs:

🇸🇬 94.231.206.203

🇺🇸 91.230.168.29

🇺🇸 91.230.168.23

🇳🇱 89.21.67.166

🇵🇹 81.193.164.75

🇳🇱 77.67.26.173

🇺🇸 66.132.224.236

🇨🇳 47.95.140.179

🇺🇸 20.55.6.206

🇬🇧 2a06:4880::1f

🇬🇧 198.244.240.165

🇧🇷 191.7.159.201

🇺🇸 184.183.93.106

🇨🇳 111.228.12.237

🇭🇰 103.26.94.164

🇫🇷 88.168.210.79

🇬🇧 86.150.101.120

🇪🇸 79.98.223.6

🇬🇧 54.38.147.205

🇮🇳 20.207.207.21