JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 167.253.16.102

167.253.16.102 was found in our database!

This IP was reported 10 times. Confidence of Abuse is 30%: ?

30%

ISP	VPNVault LLC
Usage Type	Data Center/Web Hosting/Transit
ASN	AS26548
Hostname(s)	167-253-16-102.cloudairone.com
Domain Name	vpnvau.lt
Country	🇺🇸 United States of America
City	Seattle, Washington

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 167.253.16.102

Whois 167.253.16.102

IP Abuse Reports for 167.253.16.102:

This IP address has been reported a total of 10 times from 7 distinct sources. 167.253.16.102 was first reported on January 30th 2026, and the most recent report was 20 hours ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇺🇸 TPI-Abuse	2026-06-07 06:07:24 (20 hours ago)	(mod_security) mod_security (id:211030) triggered by 167.253.16.102 (167-253-16-102.cloudairone.com) ... show more (mod_security) mod_security (id:211030) triggered by 167.253.16.102 (167-253-16-102.cloudairone.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Jun 07 02:07:20.218042 2026] [security2:error] [pid 3029:tid 3029] [client 167.253.16.102:43013] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at ARGS. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/08_Global_Other.conf"] [line "17"] [id "211030"] [rev "3"] [msg "COMODO WAF: LDAP Injection Attack\|\|www.oualierealty.com\|F\|2"] [data "Matched Data: (%'%~%'%\|%\|%( found within ARGS: 0"] [severity "CRITICAL"] [tag "CWAF"] [tag "Other"] [hostname "www.oualierealty.com"] [uri "/index.php"] [unique_id "aiUKmFq5ztKjz3OrY6qD0wAAAAI"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-05-20 18:37:22 (2 weeks ago)	(mod_security) mod_security (id:210492) triggered by 167.253.16.102 (167-253-16-102.cloudairone.com) ... show more (mod_security) mod_security (id:210492) triggered by 167.253.16.102 (167-253-16-102.cloudairone.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed May 20 14:37:14.434619 2026] [security2:error] [pid 12990:tid 12990] [client 167.253.16.102:9073] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.bergenoaks.com.velvetculture.com"] [uri "/.wp-config.php.swp"] [unique_id "ag3_WiR-rkG_b4k5LGwAWgAAABI"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-05-20 03:10:34 (2 weeks ago)	(mod_security) mod_security (id:210492) triggered by 167.253.16.102 (167-253-16-102.cloudairone.com) ... show more (mod_security) mod_security (id:210492) triggered by 167.253.16.102 (167-253-16-102.cloudairone.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue May 19 23:10:30.214345 2026] [security2:error] [pid 28347:tid 28347] [client 167.253.16.102:44265] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "badconsultingllc.com"] [uri "/.wp-config.php.swp"] [unique_id "ag0mJtOuQu9JwQLuNgVfjwAAAAM"] show less	Brute-Force Bad Web Bot Web App Attack
🇨🇭 Ribeye375	2026-05-19 11:38:16 (2 weeks ago)	HIPS recon-attempt - Block tcp/0:65535	Web App Attack
🇩🇪 Lino Project	2026-05-17 18:16:57 (3 weeks ago)	CrowdSec abuse IP report (host SRV-2) Scenario: crowdsecurity/http-wordpress-scan	Hacking
🇫🇷 masterguru	2026-05-17 06:28:55 (3 weeks ago)	Restricted File Access Attempt. Matched phrase ".env" at REQUEST_FILENAME. (930130-201)	Hacking Web App Attack
🇺🇸 mnsf	2026-05-15 15:06:39 (3 weeks ago)	Scanning/Probing (34)	Brute-Force Web App Attack
🇮🇩 Burayot	2026-04-25 18:29:58 (1 month ago)	LF_MODSEC: (mod_security) mod_security (id:1000001) triggered by 167.253.16.102 (US/United States/16 ... show more LF_MODSEC: (mod_security) mod_security (id:1000001) triggered by 167.253.16.102 (US/United States/167-253-16-102.cloudairone.com): 2 in the last 3600 secs show less	Web App Attack
🇪🇸 masterguru	2026-04-15 03:41:41 (1 month ago)	COMODO WAF: URL file extension is restricted by policy. Match of "pmFromFile userdata_wl_extensions" ... show more COMODO WAF: URL file extension is restricted by policy. Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. (210730-122) show less	Hacking
Anonymous	2026-01-30 08:45:39 (4 months ago)	Attempted brute force login to web vpn 1 time(s); last attempt for 2026.01.30 is noted in report tim ... show more Attempted brute force login to web vpn 1 time(s); last attempt for 2026.01.30 is noted in report timestamp show less	Hacking Brute-Force

Showing 1 to 10 of 10 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇧🇷 205.210.31.228

🇺🇾 167.62.238.221

🇺🇸 147.185.132.141

🇭🇰 103.20.223.56

🇺🇸 66.132.195.30

🇳🇱 64.89.162.139

🇹🇷 45.158.14.124

🇳🇱 45.142.193.10

🇺🇸 20.121.67.158

🇩🇪 217.154.173.63

🇺🇿 213.230.64.246

🇺🇸 192.210.198.202

🇸🇾 185.216.134.126

🇫🇷 185.177.72.54

🇧🇷 177.154.81.192

🇨🇳 116.228.233.93

🇺🇸 107.173.253.233

🇮🇳 106.217.19.109

🇨🇳 61.160.105.66

🇳🇱 45.148.10.240