JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 143.92.132.66

143.92.132.66 was found in our database!

This IP was reported 18 times. Confidence of Abuse is 70%: ?

70%

ISP	STC, Dammam Residential Fixed-Broadband
Usage Type	Fixed Line ISP
ASN	AS25019
Domain Name	stc.com.sa
Country	🇸🇦 Saudi Arabia
City	Riyadh, Riyadh Region

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 143.92.132.66

Whois 143.92.132.66

IP Abuse Reports for 143.92.132.66:

This IP address has been reported a total of 18 times from 12 distinct sources. 143.92.132.66 was first reported on August 18th 2026, and the most recent report was 1 day ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇩🇪 ghostwarriors	2026-08-22 23:51:12 (1 day ago)	Webpage scraping	Brute-Force Bad Web Bot Web App Attack
Anonymous	2026-08-22 23:33:10 (1 day ago)	Fail2Ban: WordPress XML-RPC brute-force attack detected.	Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-08-22 19:28:41 (1 day ago)	(mod_security) mod_security (id:240335) triggered by 143.92.132.66 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:240335) triggered by 143.92.132.66 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Aug 22 15:28:33.497961 2026] [security2:error] [pid 27291:tid 27291] [client 143.92.132.66:59788] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 143.92.132.66 (+1 hits since last alert)\|troop9weymouth.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "troop9weymouth.com"] [uri "/xmlrpc.php"] [unique_id "aon4YReSgwKaysaOHpBeqwAAABM"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-08-22 14:10:50 (1 day ago)	(mod_security) mod_security (id:240335) triggered by 143.92.132.66 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:240335) triggered by 143.92.132.66 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Aug 22 10:10:42.856193 2026] [security2:error] [pid 26763:tid 26763] [client 143.92.132.66:64830] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 143.92.132.66 (+1 hits since last alert)\|talentstar2025.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "talentstar2025.com"] [uri "/xmlrpc.php"] [unique_id "aomt4m_FK1-PclJjHN_55gAAAAc"] show less	Brute-Force Bad Web Bot Web App Attack
🇩🇪 big-cloud.nl	2026-08-22 04:24:55 (2 days ago)	Try to access /xmlrpc.php	Web App Attack
🇫🇷 eric-lemesre	2026-08-21 23:37:02 (2 days ago)	143.92.132.66 - - [22/Aug/2026:01:36:20 +0200] "POST /xmlrpc.php HTTP/1.1" 200 422 "-" "Jetpack by W ... show more 143.92.132.66 - - [22/Aug/2026:01:36:20 +0200] "POST /xmlrpc.php HTTP/1.1" 200 422 "-" "Jetpack by WordPress.com" 143.92.132.66 - - [22/Aug/2026:01:36:30 +0200] "POST /xmlrpc.php HTTP/1.1" 200 422 "-" "Jetpack/13.0; WordPress/6.1; http://site51301447.com" 143.92.132.66 - - [22/Aug/2026:01:36:41 +0200] "POST /xmlrpc.php HTTP/1.1" 200 422 "-" "WordPress.com; https://wordpress.com" 143.92.132.66 - - [22/Aug/2026:01:36:51 +0200] "POST /xmlrpc.php HTTP/1.1" 200 422 "-" "WordPress.com; https://wordpress.com" 143.92.132.66 - - [22/Aug/2026:01:37:02 +0200] "POST /xmlrpc.php HTTP/1.1" 200 422 "-" "Jetpack/12.1; WordPress/6.3; http://site96987255.com" ... show less	Web App Attack Brute-Force
🇺🇸 integrantservices.com	2026-08-21 21:23:28 (2 days ago)	(wordpress) Failed wordpress login from 143.92.132.66 (SA/Saudi Arabia/-)	Brute-Force
🇺🇸 TPI-Abuse	2026-08-21 15:35:58 (2 days ago)	(mod_security) mod_security (id:225170) triggered by 143.92.132.66 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:225170) triggered by 143.92.132.66 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Aug 21 11:35:50.949437 2026] [security2:error] [pid 28539:tid 28539] [client 143.92.132.66:60932] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)\|\|americanureport.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "americanureport.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aohwVvttjNP_NLNRtTM0kAAAABM"] show less	Brute-Force Bad Web Bot Web App Attack
🇬🇧 Nick Lewis	2026-08-20 20:13:28 (3 days ago)	(wordpress) Failed wordpress login from 143.92.132.66 (SA/Saudi Arabia/-)	Brute-Force
🇫🇷 applemooz	2026-08-19 20:08:50 (4 days ago)	WordPress XMLRPC Brute Force Attacks ...	Brute-Force Web App Attack
🇧🇪 madeit	2026-08-19 03:22:59 (5 days ago)		Web App Attack
🇳🇱 ConsulHosting	2026-08-18 17:03:19 (5 days ago)	Excessive failed CAPTCHA attempts (CAPTCHA DoS)	Web App Attack
🇺🇸 TPI-Abuse	2026-08-18 12:54:52 (5 days ago)	(mod_security) mod_security (id:225170) triggered by 143.92.132.66 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:225170) triggered by 143.92.132.66 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Aug 18 08:54:46.635524 2026] [security2:error] [pid 13375:tid 13375] [client 143.92.132.66:58458] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)\|\|danielbrower.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "danielbrower.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aoRWFm3op9WJ6bJ3qoC87QAAAAA"] show less	Brute-Force Bad Web Bot Web App Attack
🇩🇪 4server	2026-08-18 12:48:16 (5 days ago)	[TueAug1814:48:12.9191262026][security2:error][pid1040301:tid1040505][client143.92.132.66:0]ModSecur ... show more [TueAug1814:48:12.9191262026][security2:error][pid1040301:tid1040505][client143.92.132.66:0]ModSecurity:Accessdeniedwithcode403\(phase1\).Stringmatch\"/xmlrpc.php\"atREQUEST_URI.[file\"/etc/apache2/conf.d/modsec_custom_rules.conf\"][line\"170\"][id\"960024\"][msg\"XML-RPCdisabled\"][hostname\"danielasilvia.ch\"][uri\"/xmlrpc.php\"][unique_id\"aoRUjOgu4kEEHhbTiAxSKgAAAAk\"] show less	Port Scan Brute-Force Web App Attack
🇩🇪 pscriptos	2026-08-18 12:21:38 (5 days ago)	{"ClientAddr":"143.92.132.66:59139","ClientHost":"143.92.132.66","ClientPort":"59139","ClientUsernam ... show more {"ClientAddr":"143.92.132.66:59139","ClientHost":"143.92.132.66","ClientPort":"59139","ClientUsername":"-","DownstreamContentSize":418,"DownstreamStatus":403,"Duration":162738840,"OriginContentSize":418,"OriginDuration":158710785,"OriginStatus":403,"Overhead":4028055,"RequestAddr":"www.cleveradmin.de","RequestContentSize":680,"RequestCount":4197367,"RequestHost":"www.cleveradmin.de","RequestMethod":"POST","RequestPath":"/xmlrpc.php","RequestPort":"-","RequestProtocol":"HTTP/1.1","RequestScheme":"https","RetryAttempts":0,"RouterName":"cleveradmin-www-websecure@file","ServiceAddr":"172.16.80.10:80","ServiceName":"cleveradmin-www@file","ServiceURL":"http://172.16.80.10:80","StartLocal":"2026-08-18T14:16:09.407226921+02:00","StartUTC":"2026-08-18T12:16:09.407226921Z","TLSCipher":"TLS_AES_128_GCM_SHA256","TLSVersion":"1.3","entryPointName":"websecure","level":"info","msg":"","time":"2026-08-18T14:16:09+02:00"} {"ClientAddr":"143.92.132.66:62206","ClientHost":"143.92.132.66","ClientPort":"62 ... show less	Brute-Force Web App Attack

Showing 1 to 15 of 18 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇺🇸 216.244.81.2

🇰🇼 178.53.102.154

🇬🇧 172.217.32.22

🇲🇾 165.154.147.69

🇫🇮 147.185.133.68

🇺🇸 91.230.168.96

🇳🇱 89.21.67.174

🇳🇱 45.9.148.96

🇺🇸 35.225.246.38

🇦🇷 216.244.254.254

🇺🇸 205.210.31.71

🇺🇸 155.117.180.110

🇸🇬 138.2.102.66

🇨🇳 123.160.235.172

🇨🇳 36.143.210.226

🇬🇧 31.14.254.47

🇬🇧 5.252.83.138

🇦🇪 176.204.5.142

🇨🇳 171.13.113.28

🇺🇸 162.216.150.248