This IP address has been reported a total of
18
times from
15 distinct
sources.
161.142.208.21 was first reported on
, and the most recent report was
.
In the last 60 days, the top reporter locations were:
Germany
with 4
reports;
Brazil
with 3
reports;
Switzerland
with 3
reports.
The most common categories in these recent reports were:
Web App Attack
17
times;
Hacking
6
times;
Brute-Force
5
times;
Bad Web Bot
4
times;
Exploited Host
1
time.
Old Reports
The most recent abuse report for this IP address is from
. It is possible that this IP is no
longer involved in abusive activities.
[WedSep3014:09:10.4197902026][security2:error][pid2153636:tid2153649][client161.142.208.21:0]ModSecu ...
show more[WedSep3014:09:10.4197902026][security2:error][pid2153636:tid2153649][client161.142.208.21:0]ModSecurity:Accessdeniedwithcode403\(phase1\).Stringmatch\"/xmlrpc.php\"atREQUEST_URI.[file\"/etc/apache2/conf.d/modsec_custom_rules.conf\"][line\"714\"][id\"960024\"][msg\"XML-RPCdisabled\"][hostname\"aidweb.ch\"][uri\"/xmlrpc.php\"][unique_id\"arz75nV5BXPqUpqhO78dngAAAQs\"]
show less
[TueSep2909:30:03.5585212026][security2:error][pid492708:tid492796][client161.142.208.21:0]ModSecuri ...
show more[TueSep2909:30:03.5585212026][security2:error][pid492708:tid492796][client161.142.208.21:0]ModSecurity:Accessdeniedwithcode403\(phase1\).Stringmatch\"/xmlrpc.php\"atREQUEST_URI.[file\"/etc/apache2/conf.d/modsec_custom_rules.conf\"][line\"714\"][id\"960024\"][msg\"XML-RPCdisabled\"][hostname\"aidweb.ch\"][uri\"/xmlrpc.php\"][unique_id\"arto-3sqC1GpURRkyCVfCQAAAMo\"]
show less
Hacking
Web App Attack
Anonymous
Fail2Ban: request for a known-malicious path (.env, .git, wp-login, actuator, ...) on a public web s ...
show moreFail2Ban: request for a known-malicious path (.env, .git, wp-login, actuator, ...) on a public web server; honeypot hit, banned on first attempt.
show less
Web vulnerability scanning: WordPress xmlrpc.php abuse. Blocked by firewall on 5 different hosting s ...
show moreWeb vulnerability scanning: WordPress xmlrpc.php abuse. Blocked by firewall on 5 different hosting servers. Protocol TCP, port 80, 443 (HTTP/HTTPS). Automated report.
show less
[SunSep2722:54:35.3470182026][security2:error][pid2608286:tid2608376][client161.142.208.21:0]ModSecu ...
show more[SunSep2722:54:35.3470182026][security2:error][pid2608286:tid2608376][client161.142.208.21:0]ModSecurity:Accessdeniedwithcode403\(phase1\).Stringmatch\"/xmlrpc.php\"atREQUEST_URI.[file\"/etc/apache2/conf.d/modsec_custom_rules.conf\"][line\"714\"][id\"960024\"][msg\"XML-RPCdisabled\"][hostname\"spc-ticino.ch\"][uri\"/xmlrpc.php\"][unique_id\"armCi3sobq9NYIAE9NOypAAAAEA\"]
show less
[27/Sep/2026:16:25:53 +0300] -- 161.142.208.21 Ban reason: Scanner [CMS_GENERIC] | Request: POST /xm ...
show more[27/Sep/2026:16:25:53 +0300] -- 161.142.208.21 Ban reason: Scanner [CMS_GENERIC] | Request: POST /xmlrpc.php HTTP/1.1
show less
Web vulnerability scanning: WordPress xmlrpc.php abuse. Blocked by firewall on 6 different hosting s ...
show moreWeb vulnerability scanning: WordPress xmlrpc.php abuse. Blocked by firewall on 6 different hosting servers. Protocol TCP, port 80, 443 (HTTP/HTTPS). Automated report.
show less
This address sent web requests that have no legitimate reading: known exploit paths, path traversal, ...
show moreThis address sent web requests that have no legitimate reading: known exploit paths, path traversal, injected payloads, or the signature of a vulnerability scanner. This is an attack on the sites we host, blocked on sight. Please check the machine behind it for an attack tool or malware. | method: GET | path: /wp-json/wp/v2/users | 2026-09-26 13:55 UTC
show less
