JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 166.0.218.57

166.0.218.57

Neutral Activity

59 reports found in our database

0% Low Risk

Abuse confidence score ?

ISP

InterLIR LLC

Usage Type

Data Center/Web Hosting/Transit

ASN

AS213823

Hostname(s)

166-0-218-57.ips.acedatacenter.com

Domain Name

interlir.com

Country

🇩🇪 Germany

City

Frankfurt am Main, Hesse

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report Whois

No reports in the last 60 days

166.0.218.57 has been reported 59 times. The most recent report is from 2 years ago.

The full history is preserved below and remains searchable. A 0% score reflects the absence of recent activity, but this is not a guarantee that earlier reports were invalid. Abuse confidence score decays, naturally, over time, when the abusive activity stops.

IP Abuse Reports for 166.0.218.57:

This IP address has been reported a total of 59 times from 27 distinct sources. 166.0.218.57 was first reported on September 10th 2023, and the most recent report was 2 years ago.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇫🇮 bittiguru.fi	2023-12-08 09:00:30 (2 years ago)	166.0.218.57 - [08/Dec/2023:11:00:17 +0200] "POST /xmlrpc.php HTTP/2.0" 503 18945 "-" "curl/7.30.0" ... show more 166.0.218.57 - [08/Dec/2023:11:00:17 +0200] "POST /xmlrpc.php HTTP/2.0" 503 18945 "-" "curl/7.30.0" "-" 166.0.218.57 - [08/Dec/2023:11:00:30 +0200] "POST /xmlrpc.php HTTP/2.0" 499 0 "-" "curl/7.30.0" "-" ... show less	Hacking Brute-Force Web App Attack
🇺🇸 TPI-Abuse	2023-12-08 07:27:18 (2 years ago)	(mod_security) mod_security (id:240335) triggered by 166.0.218.57 (166.0.218.57.static.quadranet.com ... show more (mod_security) mod_security (id:240335) triggered by 166.0.218.57 (166.0.218.57.static.quadranet.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Dec 08 02:27:11.727002 2023] [security2:error] [pid 3624889] [client 166.0.218.57:52006] [client 166.0.218.57] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 166.0.218.57 (+1 hits since last alert)\|www.nancyscafeandcatering.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "www.nancyscafeandcatering.com"] [uri "/xmlrpc.php"] [unique_id "ZXLFT68ysb-gFH-amtIfRwAAAAo"] show less	Brute-Force Bad Web Bot Web App Attack
🇲🇹 Malta	2023-12-08 04:42:11 (2 years ago)	166.0.218.57 - - [08/Dec/2023:05:42:10 +0100] "POST /xmlrpc.php HTTP/1.1" "curl/7.30.0" Brute-force ... show more 166.0.218.57 - - [08/Dec/2023:05:42:10 +0100] "POST /xmlrpc.php HTTP/1.1" "curl/7.30.0" Brute-force password attempt show less	Hacking Brute-Force Web App Attack
🇺🇦 URAN Publishing Service	2023-12-07 23:58:56 (2 years ago)	166.0.218.57 - - [08/Dec/2023:01:58:24 +0200] "GET /wp-login.php HTTP/1.1" 404 274 "-" "Mozilla/5.0 ... show more 166.0.218.57 - - [08/Dec/2023:01:58:24 +0200] "GET /wp-login.php HTTP/1.1" 404 274 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.124 Safari/537.36" 166.0.218.57 - - [08/Dec/2023:01:58:55 +0200] "GET /wp-login.php HTTP/1.1" 404 281 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.124 Safari/537.36" ... show less	Web App Attack
Anonymous	2023-12-07 20:51:58 (2 years ago)	Attempted WordPress login: 166.0.218.57 - - [07/Dec/2023:20:51:58 +0000] "GET /wp-login.php HTTP/1. ... show more Attempted WordPress login: 166.0.218.57 - - [07/Dec/2023:20:51:58 +0000] "GET /wp-login.php HTTP/1.1" 200 234 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.124 Safari/537.36" show less	Hacking Web App Attack
🇩🇪 ps-center	2023-12-07 19:05:28 (2 years ago)	ABV: Web Attack GET /dieanderebibliothek/wp-login.php	Web Spam Hacking Bad Web Bot Web App Attack
🇨🇦 mitsurugi	2023-12-07 16:37:57 (2 years ago)	Xmlrpc attack.	Brute-Force Web App Attack
🇫🇷 Sklurk	2023-12-07 14:19:47 (2 years ago)	Web App Attack	Web App Attack
🇬🇧 SilverZippo	2023-12-07 10:03:31 (2 years ago)	Web App Attack	Web App Attack
🇺🇸 TPI-Abuse	2023-12-07 09:07:53 (2 years ago)	(mod_security) mod_security (id:240335) triggered by 166.0.218.57 (166.0.218.57.static.quadranet.com ... show more (mod_security) mod_security (id:240335) triggered by 166.0.218.57 (166.0.218.57.static.quadranet.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Dec 07 04:07:47.275504 2023] [security2:error] [pid 9339] [client 166.0.218.57:49606] [client 166.0.218.57] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 166.0.218.57 (+1 hits since last alert)\|www.insidepublications.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "www.insidepublications.com"] [uri "/xmlrpc.php"] [unique_id "ZXGLY6v0-fYAJ7gLQGMmhwAAAAQ"] show less	Brute-Force Bad Web Bot Web App Attack
Anonymous	2023-12-07 08:44:02 (2 years ago)	Bot / scanning and/or hacking attempts: done, streams: 0/2/2/0/0 (open/recv/resp/push/rst), idle, st ... show more Bot / scanning and/or hacking attempts: done, streams: 0/2/2/0/0 (open/recv/resp/push/rst), idle, streams: 0/1/1/0/0 (open/recv/resp/push/rst), GET /wp-login.php HTTP/1.1 show less	Hacking Web App Attack
🇨🇭 zynex	2023-12-07 06:45:20 (2 years ago)	URL Probing: /wp-login.php	Web App Attack
🇺🇸 TPI-Abuse	2023-12-07 04:58:49 (2 years ago)	(mod_security) mod_security (id:240335) triggered by 166.0.218.57 (166.0.218.57.static.quadranet.com ... show more (mod_security) mod_security (id:240335) triggered by 166.0.218.57 (166.0.218.57.static.quadranet.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Dec 06 23:58:42.318490 2023] [security2:error] [pid 15300] [client 166.0.218.57:32932] [client 166.0.218.57] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 166.0.218.57 (+1 hits since last alert)\|www.mounthoodhistory.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "www.mounthoodhistory.com"] [uri "/xmlrpc.php"] [unique_id "ZXFRAk13tJowpnpx20u-aAAAADM"] show less	Brute-Force Bad Web Bot Web App Attack
🇦🇺 MAGIC	2023-12-05 11:12:43 (2 years ago)	VM1 Bad user agents ignoring web crawling rules. Draing bandwidth	DDoS Attack Bad Web Bot
🇦🇺 MAGIC	2023-12-04 00:03:02 (2 years ago)	VM1 Bad user agents ignoring web crawling rules. Draing bandwidth	DDoS Attack Bad Web Bot

Showing 1 to 15 of 59 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇨🇳 220.249.82.190

🇺🇸 20.127.185.37

🇷🇴 2.57.121.25

🇰🇷 222.112.65.219

🇹🇳 197.5.145.114

🇬🇧 195.206.182.209

🇳🇴 195.204.187.27

🇨🇴 179.33.186.150

🇺🇸 172.173.200.62

🇨🇦 167.114.96.241

🇨🇳 122.97.136.150

🇧🇩 103.113.153.50

🇷🇺 81.23.187.30

🇮🇩 49.0.3.142

🇨🇳 39.129.13.19

🇫🇮 35.228.95.31

🇺🇸 3.238.52.249

🇺🇸 3.88.150.233

🇨🇱 200.27.142.120

🇺🇸 181.214.83.153