JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

166.1.90.13

Activity Trending Down

Abuse Confidence Score

72% Elevated

43 reports

37 reporters · latest 3 weeks ago

ISP: InterLIR LLC
Usage Type: Data Center/Web Hosting/Transit
ASN: AS16276
Hostname(s): host-8f3f79.ns.truo.co
Domain Name: interlir.com
Country: 🇺🇸 United States of America
City: Warrenton, Virginia

ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report Whois

Example preview

Account required for the enhanced features Log in Sign up

Abuse Reports

Export reports CSV

Total reports

43 from 37 distinct reporters

First reported

October 12th 2026

Most recent report

3 weeks ago

Last 60 days

Top reporter locations 🇩🇪 Germany 10 🇺🇸 United States of America 10 🇫🇷 France 7

Most common categories Web App Attack 28 Brute-Force 9 Port Scan 9 Bad Web Bot 8 Hacking 8

Old reports The most recent abuse report for this IP address is from 3 weeks ago. It is possible that this IP is no longer involved in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
Anonymous	2026-10-20 00:38:57 UTC · (3 weeks ago)	MikroTik Enterprise Honeypot	Port Scan
🇩🇪 Holger	2026-10-16 23:22:46 UTC · (4 weeks ago)	WordPress WebAttack	Brute-Force Web App Attack
🇧🇪 sid3windr	2026-10-14 15:10:30 UTC · (4 weeks ago)	GET /config/database.php (Tarpitted for 1d15h8m34s, wasted 8.06MB)	Web App Attack
🇩🇪 Holger	2026-10-14 06:16:50 UTC · (4 weeks ago)	WordPress WebAttack	Brute-Force Web App Attack
🇫🇷 service Informatique	2026-10-14 04:00:37 UTC · (1 month ago)	GET /wp-config	Web App Attack
🇳🇱 JCB	2026-10-13 16:33:00 UTC · (1 month ago)	166.1.90.13 - - [13/Oct/2026:08:20:00 +0300] "GET /application-prod.yml HTTP/1.1" 404 236 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)" 166.1.90.13 - - [13/Oct/2026:08:20:00 +0300] "GET /application-production.yml HT ... show more 166.1.90.13 - - [13/Oct/2026:08:20:00 +0300] "GET /application-prod.yml HTTP/1.1" 404 236 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)" 166.1.90.13 - - [13/Oct/2026:08:20:00 +0300] "GET /application-production.yml HTTP/1.1" 404 236 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)" ... show less	Web App Attack
🇺🇸 TPI-Abuse	2026-10-13 11:45:13 UTC · (1 month ago)	(mod_security) mod_security (id:210492) triggered by 166.1.90.13 (host-8f3f79.ns.truo.co): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 13 07:45:06.775929 2026] [security2:error] [pid 24982:tid 24982] [client 166 ... show more (mod_security) mod_security (id:210492) triggered by 166.1.90.13 (host-8f3f79.ns.truo.co): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 13 07:45:06.775929 2026] [security2:error] [pid 24982:tid 24982] [client 166.1.90.13:48424] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "192.64.150.98"] [uri "/wp-config.php.bak"] [unique_id "as4ZwuRuWo6afNxVC4G5dwAAAFU"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 LTU	2026-10-13 11:43:00 UTC · (1 month ago)	Anomalous Server Path Access/Reconnaissance/Enumeration	Hacking
🇭🇰 PingMeMaybe	2026-10-13 10:08:46 UTC · (1 month ago)	Blocked by UFW on hk [8443/tcp] Source port: 39214 TTL: 46 Packet length: 60 TOS: 0x00 This report was generated by: https://github.com/sefinek/UFW-AbuseIPDB-Reporter	Port Scan
🇺🇸 cwytech	2026-10-13 09:44:19 UTC · (1 month ago)	Fleet-wide ban from the Ghostfleet 👻. Triggered by scenario: cwy/web-asn-lockdown-high.	Bad Web Bot Web App Attack
🇧🇾 lns.bz	2026-10-13 09:00:40 UTC · (1 month ago)	Too many 404 requests [BY]	Web App Attack
🇺🇸 HamSammich	2026-10-13 08:58:45 UTC · (1 month ago)	Automated sensor: 188 HTTP, HTTPS connection/probe attempts over the last 24h (latest 2026-10-13T08:58Z).	Brute-Force Web App Attack
🇺🇸 xmission.com	2026-10-13 08:29:35 UTC · (1 month ago)	Blocked by UFW (TCP on 8443) Source port: 55700 TTL: 53 Packet length: 60 TOS: 0x00 This report (for 166.1.90.13) was generated by: https://github.com/sefinek/UFW-AbuseIPDB-Reporter	Port Scan
🇫🇷 Baking333	2026-10-13 08:02:58 UTC · (1 month ago)	[redacted] 166.1.90.13 - - [13/Oct/2026:09:02:55 +0100] "GET /.[redacted] HTTP/1.1" 307 5645 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://[redacted]/[redacted])" [redacted] 166.1.90.13 - - [13/Oct/2026:09:02:55 +0100] "GET /.aws/credentials H ... show more [redacted] 166.1.90.13 - - [13/Oct/2026:09:02:55 +0100] "GET /.[redacted] HTTP/1.1" 307 5645 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://[redacted]/[redacted])" [redacted] 166.1.90.13 - - [13/Oct/2026:09:02:55 +0100] "GET /.aws/credentials HTTP/1.1" 307 5645 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://[redacted]/[redacted])" show less	Bad Web Bot Web App Attack
🇩🇪 luxuria.cfd	2026-10-13 07:38:49 UTC · (1 month ago)	DDoS/portscan detected by allservers-monitor. Blocked via iptables.	DDoS Attack Port Scan

Showing 1 to 15 of 43 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown

Recently Reported IPs:

🇸🇬 124.243.154.156

🇻🇳 118.70.182.193

🇳🇱 86.38.187.70

🇳🇱 86.38.187.8

🇵🇱 2400:cb00:73:1000:a79f:f338:57b2:ac94

🇲🇽 186.96.158.180

🇺🇸 172.104.11.189

🇵🇭 126.209.75.103

🇮🇩 114.12.4.223

🇷🇺 92.255.78.30

🇳🇱 86.38.187.69

🇳🇱 86.38.187.41

🇨🇦 85.217.149.70

🇦🇪 74.243.250.30

🇨🇳 39.78.143.93

🇬🇧 188.240.59.16

🇫🇷 91.231.89.132

🇳🇱 86.38.187.248

🇳🇱 86.38.187.37

🇳🇱 86.38.187.12