JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 166.1.131.169

166.1.131.169 was found in our database!

This IP was reported 12 times. Confidence of Abuse is 20%: ?

20%

ISP	Ace Data Centers, Inc.
Usage Type	Data Center/Web Hosting/Transit
ASN	AS35830
Domain Name	acedatacenter.com
Country	🇿🇦 South Africa
City	Cape Town, Western Cape

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 166.1.131.169

Whois 166.1.131.169

IP Abuse Reports for 166.1.131.169:

This IP address has been reported a total of 12 times from 6 distinct sources. 166.1.131.169 was first reported on February 28th 2025, and the most recent report was 1 day ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇺🇸 kosada.com	2026-06-11 03:45:35 (1 day ago)	Web password guessing	Brute-Force
🇺🇸 ambor	2026-05-31 16:41:46 (1 week ago)	Honeypot triggered on tcpdata.com - Attempted to access /wp-login.php (wordpress_login). User-Agent: ... show more Honeypot triggered on tcpdata.com - Attempted to access /wp-login.php (wordpress_login). User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 show less	Web App Attack
🇺🇸 kosada.com	2026-05-24 20:15:15 (2 weeks ago)	Web password guessing	Brute-Force
🇺🇸 TPI-Abuse	2026-05-21 09:43:35 (3 weeks ago)	(mod_security) mod_security (id:225170) triggered by 166.1.131.169 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:225170) triggered by 166.1.131.169 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu May 21 05:43:29.811697 2026] [security2:error] [pid 21425:tid 21425] [client 166.1.131.169:47357] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)\|\|g-peopleland.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "g-peopleland.com"] [uri "/wp-json/wp/v2/users"] [unique_id "ag7TwRjM3pVe_opQBJIt4AAAAA0"], referer: https://www.google.com show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-03-22 18:39:07 (2 months ago)	(mod_security) mod_security (id:225170) triggered by 166.1.131.169 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:225170) triggered by 166.1.131.169 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Mar 22 14:38:57.185180 2026] [security2:error] [pid 20956:tid 20956] [client 166.1.131.169:16917] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)\|\|btsalesrep.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "btsalesrep.com"] [uri "/wp-json/wp/v2/users"] [unique_id "acA3QV-pSC1grNDkmeXf8QAAABU"], referer: https://www.google.com show less	Brute-Force Bad Web Bot Web App Attack
Anonymous	2026-03-22 11:40:44 (2 months ago)	[redacted] 166.1.131.169 - - [22/Mar/2026:12:40:10 +0100] "POST /xmlrpc.php HTTP/1.1" 200 132 "-" "A ... show more [redacted] 166.1.131.169 - - [22/Mar/2026:12:40:10 +0100] "POST /xmlrpc.php HTTP/1.1" 200 132 "-" "Apache-HttpClient/4.5.13 (Java/11.0.30)" [redacted] 166.1.131.169 - - [22/Mar/2026:12:40:12 +0100] "POST /xmlrpc.php HTTP/1.1" 200 206 "-" "Apache-HttpClient/4.5.13 (Java/11.0.30)" [redacted] 166.1.131.169 - - [22/Mar/2026:12:40:28 +0100] "POST /xmlrpc.php HTTP/1.1" 200 132 "-" "Apache-HttpClient/4.5.13 (Java/11.0.30)" [redacted] 166.1.131.169 - - [22/Mar/2026:12:40:30 +0100] "POST /xmlrpc.php HTTP/1.1" 200 206 "-" "Apache-HttpClient/4.5.13 (Java/11.0.30)" [redacted] 166.1.131.169 - - [22/Mar/2026:12:40:32 +0100] "POST /xmlrpc.php HTTP/1.1" 200 206 "-" "Apache-HttpClient/4.5.13 (Java/11.0.30)" [redacted] 166.1.131.169 - - [22/Mar/2026:12:40:34 +0100] "POST /xmlrpc.php HTTP/1.1" 200 206 "-" "Apache-HttpClient/4.5.13 (Java/11.0.30)" [redacted] 166.1.131.169 - - [22/Mar/2026:12:40:36 +0100] "POST /xmlrpc.php HTTP/1.1" 200 206 "-" ... show less	Hacking Web App Attack
🇨🇳 ThreatBook.io	2025-04-30 22:12:53 (1 year ago)	ThreatBook Intelligence: Scanner,Spam more details on https://threatbook.io/ip/166.1.131.169 2025-04 ... show more ThreatBook Intelligence: Scanner,Spam more details on https://threatbook.io/ip/166.1.131.169 2025-04-30 02:07:10 /+CSCOE+/logon.html show less	Web App Attack
🇨🇳 ThreatBook.io	2025-04-26 22:12:02 (1 year ago)	ThreatBook Intelligence: Scanner,Spam more details on https://threatbook.io/ip/166.1.131.169 2025-04 ... show more ThreatBook Intelligence: Scanner,Spam more details on https://threatbook.io/ip/166.1.131.169 2025-04-26 10:11:43 /+CSCOE+/logon.html 2025-04-26 09:37:51 /+CSCOE+/logon.html show less	Web App Attack
🇨🇿 lp	2025-03-05 04:21:35 (1 year ago)	Unauthorized VPN login attempts: 1 attempts were recorded from 166.1.131.169 2025-03-05T04:50:28+01: ... show more Unauthorized VPN login attempts: 1 attempts were recorded from 166.1.131.169 2025-03-05T04:50:28+01:00 vpn Access-Reject 'pang' station: 166.1.131.169 auth-type: - realm: vse.cz nas: <redacted> called: <redacted> => address-pool: - msg: '<redacted>' show less	Brute-Force Web App Attack
🇨🇿 lp	2025-03-02 14:49:30 (1 year ago)	Unauthorized VPN login attempts: 2 attempts were recorded from 166.1.131.169 2025-03-02T14:30:28+01: ... show more Unauthorized VPN login attempts: 2 attempts were recorded from 166.1.131.169 2025-03-02T14:30:28+01:00 vpn Access-Reject 'aristides' station: 166.1.131.169 auth-type: - realm: vse.cz nas: <redacted> called: <redacted> => address-pool: - msg: '<redacted>' 2025-03-02T15:41:56+01:00 vpn Access-Reject 'azmeena' station: 166.1.131.169 auth-type: - realm: vse.cz nas: <redacted> called: <redacted> => address-pool: - msg: '<redacted>' show less	Brute-Force Web App Attack
🇨🇿 lp	2025-03-01 20:49:44 (1 year ago)	Unauthorized VPN login attempts: 1 attempts were recorded from 166.1.131.169 2025-03-01T20:19:06+01: ... show more Unauthorized VPN login attempts: 1 attempts were recorded from 166.1.131.169 2025-03-01T20:19:06+01:00 vpn Access-Reject 'amrik' station: 166.1.131.169 auth-type: - realm: vse.cz nas: <redacted> called: <redacted> => address-pool: - msg: '<redacted>' show less	Brute-Force Web App Attack
🇨🇿 lp	2025-02-28 01:21:15 (1 year ago)	Unauthorized VPN login attempts: 1 attempts were recorded from 166.1.131.169 2025-02-28T01:43:57+01: ... show more Unauthorized VPN login attempts: 1 attempts were recorded from 166.1.131.169 2025-02-28T01:43:57+01:00 vpn Access-Reject 'eggwhite' station: 166.1.131.169 auth-type: - realm: vse.cz nas: <redacted> called: <redacted> => address-pool: - msg: '<redacted>' show less	Brute-Force Web App Attack

Showing 1 to 12 of 12 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇧🇪 188.93.112.20

🇺🇸 69.57.160.154

🇨🇳 43.136.120.160

🇺🇸 205.210.31.13

🇺🇾 179.25.147.49

🇫🇮 178.20.28.85

🇺🇸 162.216.149.221

🇫🇷 85.204.70.92

🇺🇸 50.187.96.101

🇺🇸 20.124.91.101

🇷🇴 193.46.255.86

🇧🇷 168.0.130.99

🇺🇸 147.185.132.113

🇨🇳 101.126.66.30

🇫🇷 51.68.34.131

🇳🇬 41.242.115.84

🇬🇧 37.10.113.220

🇯🇵 8.216.66.146

🇩🇪 172.217.33.208

🇺🇸 162.216.16.86