JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 118.33.31.166

118.33.31.166 was found in our database!

This IP was reported 34 times. Confidence of Abuse is 86%: ?

86%

ISP	Korea Telecom
Usage Type	Fixed Line ISP
ASN	AS4766
Domain Name	kt.com
Country	🇰🇷 Korea (the Republic of)
City	Goyang-si, Gyeonggi-do

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 118.33.31.166

Whois 118.33.31.166

IP Abuse Reports for 118.33.31.166:

This IP address has been reported a total of 34 times from 22 distinct sources. 118.33.31.166 was first reported on July 7th 2026, and the most recent report was 4 hours ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇨🇭 4server	2026-07-27 05:37:30 (4 hours ago)	[MonJul2707:37:27.0266032026][security2:error][pid3359198:tid3359518][client118.33.31.166:0]ModSecur ... show more [MonJul2707:37:27.0266032026][security2:error][pid3359198:tid3359518][client118.33.31.166:0]ModSecurity:Accessdeniedwithcode403\(phase1\).Stringmatch\"/xmlrpc.php\"atREQUEST_URI.[file\"/etc/apache2/conf.d/modsec_custom_rules.conf\"][line\"368\"][id\"960024\"][msg\"XML-RPCdisabled\"][hostname\"swiss-web-hosting.ch\"][uri\"/xmlrpc.php\"][unique_id\"ambul894XSkKThIRDr9LrAAAAJI\"] show less	Hacking Web App Attack
🇺🇦 Olexiy Backend	2026-07-27 02:26:50 (8 hours ago)	118.33.31.166 ...	Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-07-26 20:00:06 (14 hours ago)	(mod_security) mod_security (id:225170) triggered by 118.33.31.166 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:225170) triggered by 118.33.31.166 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Jul 26 15:59:58.148381 2026] [security2:error] [pid 3644881:tid 3644881] [client 118.33.31.166:63609] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)\|\|irishandmore.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "irishandmore.com"] [uri "/wp-json/wp/v2/users"] [unique_id "amZnPtwVfBuSdPRoOrFyaAAAAAQ"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-07-26 01:16:00 (1 day ago)	(mod_security) mod_security (id:225170) triggered by 118.33.31.166 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:225170) triggered by 118.33.31.166 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Jul 25 21:15:54.922559 2026] [security2:error] [pid 1596103:tid 1596103] [client 118.33.31.166:57184] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)\|\|lumentravel.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "lumentravel.com"] [uri "/wp-json/wp/v2/users"] [unique_id "amVfyjEl_TE-U4PLmDSMfQAAABk"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-07-25 20:44:26 (1 day ago)	(mod_security) mod_security (id:225170) triggered by 118.33.31.166 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:225170) triggered by 118.33.31.166 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Jul 25 16:44:19.724766 2026] [security2:error] [pid 1938796:tid 1938796] [client 118.33.31.166:51151] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)\|\|guitarwisdom.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "guitarwisdom.com"] [uri "/wp-json/wp/v2/users"] [unique_id "amUgI1yFz9aitwTZQ37k-AAAAAk"] show less	Brute-Force Bad Web Bot Web App Attack
🇩🇪 big-cloud.nl	2026-07-25 17:45:29 (1 day ago)	Try to access /xmlrpc.php	Web App Attack
🇺🇸 TPI-Abuse	2026-07-25 08:37:04 (2 days ago)	(mod_security) mod_security (id:225170) triggered by 118.33.31.166 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:225170) triggered by 118.33.31.166 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Jul 25 04:36:55.362504 2026] [security2:error] [pid 644737:tid 644737] [client 118.33.31.166:49316] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)\|\|ospectra.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "ospectra.com"] [uri "/wp-json/wp/v2/users"] [unique_id "amR1p0I9dbmFnPo6Gnz60QAAAAc"] show less	Brute-Force Bad Web Bot Web App Attack
🇬🇷 setupgr	2026-07-24 21:14:17 (2 days ago)	(XMLRPC) WP XMLRPC Attack 118.33.31.166 (KR/South Korea/Seoul/Paripark (Donggyo-dong)/-/[AS4766 KIXS ... show more (XMLRPC) WP XMLRPC Attack 118.33.31.166 (KR/South Korea/Seoul/Paripark (Donggyo-dong)/-/[AS4766 KIXS-AS-KR Korea Telecom]): 1 in the last 86400 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: 118.33.31.166 - - [25/Jul/2026:00:12:17 +0300] "POST /xmlrpc.php HTTP/1.1" 503 18928 "-" "Mozilla/5.0 (Windows NT 6.3; x64) AppleWebKit/537.36 (KHTML, like Gecko) Safari/11.0.0.0 Safari/537.36" show less	Port Scan
🇩🇪 neckaralb-admin.de	2026-07-14 07:04:28 (1 week ago)	(wordpress) Failed login wp-login.php or xmlrpc.php	Web App Attack
🇫🇷 SpaceHost-Server	2026-07-13 22:26:03 (1 week ago)		Brute-Force Web App Attack
🇩🇪 4server	2026-07-13 09:36:41 (2 weeks ago)	[MonJul1311:36:37.8166142026][security2:error][pid734736:tid734740][client118.33.31.166:0]ModSecurit ... show more [MonJul1311:36:37.8166142026][security2:error][pid734736:tid734740][client118.33.31.166:0]ModSecurity:Accessdeniedwithcode403\(phase1\).Stringmatch\"/xmlrpc.php\"atREQUEST_URI.[file\"/etc/apache2/conf.d/modsec_custom_rules.conf\"][line\"170\"][id\"960024\"][msg\"XML-RPCdisabled\"][hostname\"sanierung-pilzen-schimmel-schweiz.ch\"][uri\"/xmlrpc.php\"][unique_id\"alSxpZMgWVOPocOdRkWHcwAAAAE\"] show less	Port Scan Brute-Force Web App Attack
🇳🇱 Site.eu	2026-07-13 01:38:43 (2 weeks ago)	Repeated wp-login/xmlrpc attempts	Brute-Force SSH
🇫🇷 SpaceHost-Server	2026-07-12 22:25:56 (2 weeks ago)		Brute-Force Web App Attack
🇳🇱 Site.eu	2026-07-10 17:09:32 (2 weeks ago)	Repeated wp-login/xmlrpc attempts	Brute-Force SSH
🇬🇧 myintarweb	2026-07-10 12:54:48 (2 weeks ago)	118.33.31.166 - - [10/Jul/2026:13:54:47 +0100] 443 "GET /xmlrpc.php HTTP/1.1" 404 6565 "-" "Mozilla/ ... show more 118.33.31.166 - - [10/Jul/2026:13:54:47 +0100] 443 "GET /xmlrpc.php HTTP/1.1" 404 6565 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7; x86) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36" ... show less	Hacking Bad Web Bot Web App Attack

Showing 1 to 15 of 34 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇸🇬 172.253.211.24

🇭🇰 165.154.41.13

🇱🇹 77.90.185.20

🇺🇸 50.62.22.47

🇷🇺 46.161.50.108

🇷🇴 2.57.121.25

🇰🇷 219.250.188.143

🇺🇸 151.243.141.116

🇨🇳 139.227.100.253

🇫🇷 85.217.140.50

🇺🇸 65.49.20.102

🇱🇺 46.151.182.204

🇺🇸 45.33.109.8

🇮🇳 43.225.20.186

🇨🇭 20.203.142.71

🇰🇷 14.42.49.70

🇨🇦 4.206.92.183

🇹🇷 212.58.5.254

🇺🇸 209.85.216.43

🇬🇧 195.96.139.199