JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 166.1.131.216

166.1.131.216 was found in our database!

This IP was reported 12 times. Confidence of Abuse is 2%: ?

ISP	Ace Data Centers, Inc.
Usage Type	Data Center/Web Hosting/Transit
ASN	AS35830
Domain Name	acedatacenter.com
Country	🇿🇦 South Africa
City	Cape Town, Western Cape

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 166.1.131.216

Whois 166.1.131.216

IP Abuse Reports for 166.1.131.216:

This IP address has been reported a total of 12 times from 3 distinct sources. 166.1.131.216 was first reported on October 28th 2024, and the most recent report was 2 weeks ago.

Old Reports: The most recent abuse report for this IP address is from 2 weeks ago . It is possible that this IP is no longer involved in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇺🇸 TPI-Abuse	2026-05-20 11:25:36 (2 weeks ago)	(mod_security) mod_security (id:225170) triggered by 166.1.131.216 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:225170) triggered by 166.1.131.216 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed May 20 07:25:31.741200 2026] [security2:error] [pid 19593:tid 19593] [client 166.1.131.216:55947] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)\|\|flyingdodopublications.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "flyingdodopublications.com"] [uri "/wp-json/wp/v2/users"] [unique_id "ag2aK5sl1tfSnzuaJAHrPwAAAAo"], referer: https://www.google.com show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-05-19 13:16:45 (2 weeks ago)	(mod_security) mod_security (id:225170) triggered by 166.1.131.216 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:225170) triggered by 166.1.131.216 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue May 19 09:16:38.680181 2026] [security2:error] [pid 11581:tid 11581] [client 166.1.131.216:52919] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)\|\|pamelaweisberg.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "pamelaweisberg.com"] [uri "/wp-json/wp/v2/users"] [unique_id "agxitsPUIfHjvLxuUmzJwgAAAAA"], referer: https://www.google.com show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-04-29 10:35:08 (1 month ago)	(mod_security) mod_security (id:210730) triggered by 166.1.131.216 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:210730) triggered by 166.1.131.216 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Apr 29 06:35:03.901353 2026] [security2:error] [pid 6954:tid 6954] [client 166.1.131.216:36819] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy\|\|www.casagrotto.com\|F\|2"] [data ".ini"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.casagrotto.com"] [uri "/s3cmd.ini"] [unique_id "afHe13Z-IWcTRpSPQX27JAAAAAk"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-04-29 00:41:43 (1 month ago)	(mod_security) mod_security (id:210730) triggered by 166.1.131.216 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:210730) triggered by 166.1.131.216 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Apr 28 20:41:36.508929 2026] [security2:error] [pid 7357:tid 7357] [client 166.1.131.216:27621] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy\|\|www.envirotreecare.com\|F\|2"] [data ".ini"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.envirotreecare.com"] [uri "/s3cmd.ini"] [unique_id "afFTwGX4x-AGmT_HFIroQwAAAAw"] show less	Brute-Force Bad Web Bot Web App Attack
🇨🇿 lp	2025-01-28 22:21:35 (1 year ago)	Unauthorized VPN login attempts: 1 attempts were recorded from 166.1.131.216 2025-01-28T22:23:21+01: ... show more Unauthorized VPN login attempts: 1 attempts were recorded from 166.1.131.216 2025-01-28T22:23:21+01:00 vpn Access-Reject 'barnett' station: 166.1.131.216 auth-type: - realm: vse.cz nas: <redacted> called: <redacted> => address-pool: - msg: '<redacted>' show less	Brute-Force Web App Attack
🇨🇿 lp	2025-01-28 04:22:16 (1 year ago)	Unauthorized VPN login attempts: 1 attempts were recorded from 166.1.131.216 2025-01-28T04:25:12+01: ... show more Unauthorized VPN login attempts: 1 attempts were recorded from 166.1.131.216 2025-01-28T04:25:12+01:00 vpn Access-Reject 'cpanel2' station: 166.1.131.216 auth-type: - realm: vse.cz nas: <redacted> called: <redacted> => address-pool: - msg: '<redacted>' show less	Brute-Force Web App Attack
🇨🇿 lp	2025-01-25 19:21:01 (1 year ago)	Unauthorized VPN login attempts: 1 attempts were recorded from 166.1.131.216 2025-01-25T19:44:05+01: ... show more Unauthorized VPN login attempts: 1 attempts were recorded from 166.1.131.216 2025-01-25T19:44:05+01:00 vpn Access-Reject 'batman' station: 166.1.131.216 auth-type: - realm: vse.cz nas: <redacted> called: <redacted> => address-pool: - msg: '<redacted>' show less	Brute-Force Web App Attack
🇨🇿 lp	2025-01-25 11:50:28 (1 year ago)	Unauthorized VPN login attempts: 1 attempts were recorded from 166.1.131.216 2025-01-25T11:28:11+01: ... show more Unauthorized VPN login attempts: 1 attempts were recorded from 166.1.131.216 2025-01-25T11:28:11+01:00 vpn Access-Reject 'oak' station: 166.1.131.216 auth-type: - realm: vse.cz nas: <redacted> called: <redacted> => address-pool: - msg: '<redacted>' show less	Brute-Force Web App Attack
🇨🇿 lp	2025-01-24 19:21:20 (1 year ago)	Unauthorized VPN login attempts: 1 attempts were recorded from 166.1.131.216 2025-01-24T19:37:44+01: ... show more Unauthorized VPN login attempts: 1 attempts were recorded from 166.1.131.216 2025-01-24T19:37:44+01:00 vpn Access-Reject 'beshaming' station: 166.1.131.216 auth-type: - realm: vse.cz nas: <redacted> called: <redacted> => address-pool: - msg: '<redacted>' show less	Brute-Force Web App Attack
🇨🇿 lp	2025-01-24 02:50:14 (1 year ago)	Unauthorized VPN login attempts: 2 attempts were recorded from 166.1.131.216 2025-01-24T02:41:20+01: ... show more Unauthorized VPN login attempts: 2 attempts were recorded from 166.1.131.216 2025-01-24T02:41:20+01:00 vpn Access-Reject 'esterizing' station: 166.1.131.216 auth-type: - realm: vse.cz nas: <redacted> called: <redacted> => address-pool: - msg: '<redacted>' 2025-01-24T03:20:43+01:00 vpn Access-Reject 'mail19' station: 166.1.131.216 auth-type: - realm: vse.cz nas: <redacted> called: <redacted> => address-pool: - msg: '<redacted>' show less	Brute-Force Web App Attack
🇨🇿 lp	2025-01-23 08:50:35 (1 year ago)	Unauthorized VPN login attempts: 1 attempts were recorded from 166.1.131.216 2025-01-23T09:37:28+01: ... show more Unauthorized VPN login attempts: 1 attempts were recorded from 166.1.131.216 2025-01-23T09:37:28+01:00 vpn Access-Reject 'earsplitting' station: 166.1.131.216 auth-type: - realm: vse.cz nas: <redacted> called: <redacted> => address-pool: - msg: '<redacted>' show less	Brute-Force Web App Attack
🇳🇿 Tripwire	2024-10-28 11:10:06 (1 year ago)	Wordpress login attempts	Brute-Force Web App Attack

Showing 1 to 12 of 12 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇺🇸 209.217.225.18

🇺🇬 196.0.120.211

🇬🇧 193.163.125.163

🇩🇪 185.218.19.41

🇦🇷 181.167.144.229

🇳🇱 172.94.9.31

🇺🇸 170.106.72.178

🇻🇳 103.249.200.174

🇻🇳 103.90.227.203

🇫🇷 91.231.89.207

🇸🇬 47.84.143.211

🇬🇧 35.203.210.120

🇫🇷 185.177.72.23

🇸🇪 171.25.158.68

🇱🇹 77.90.185.207

🇩🇪 49.12.145.66

🇯🇵 35.187.222.91

🇮🇳 27.100.38.198

🇮🇳 203.115.96.197

🇳🇴 185.101.33.182