JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 167.56.70.81

167.56.70.81 was found in our database!

This IP was reported 18 times. Confidence of Abuse is 61%: ?

61%

ISP	Administracion Nacional de Telecomunicaciones
Usage Type	Fixed Line ISP
ASN	AS6057
Hostname(s)	r167-56-70-81.dialup.adsl.anteldata.net.uy
Domain Name	antel.com.uy
Country	🇺🇾 Uruguay
City	Montevideo, Montevideo Department

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 167.56.70.81

Whois 167.56.70.81

IP Abuse Reports for 167.56.70.81:

This IP address has been reported a total of 18 times from 10 distinct sources. 167.56.70.81 was first reported on July 10th 2026, and the most recent report was 14 hours ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇫🇮 decode5921	2026-07-15 07:45:02 (14 hours ago)	Honeypot hit (honeypot:wp) — probed a non-existent bait path on a site that does not run that softwa ... show more Honeypot hit (honeypot:wp) — probed a non-existent bait path on a site that does not run that software. show less	Brute-Force Web App Attack
🇫🇮 decode5921	2026-07-14 07:30:03 (1 day ago)	Honeypot hit (honeypot:wp) — probed a non-existent bait path on a site that does not run that softwa ... show more Honeypot hit (honeypot:wp) — probed a non-existent bait path on a site that does not run that software. show less	Brute-Force Web App Attack
🇩🇪 findlab	2026-07-14 01:00:01 (1 day ago)	Backdrop CMS module - malicious activity detected	Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-07-13 17:25:18 (2 days ago)	(mod_security) mod_security (id:225170) triggered by 167.56.70.81 (r167-56-70-81.dialup.adsl.antelda ... show more (mod_security) mod_security (id:225170) triggered by 167.56.70.81 (r167-56-70-81.dialup.adsl.anteldata.net.uy): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jul 13 13:25:12.255512 2026] [security2:error] [pid 9837:tid 9837] [client 167.56.70.81:11869] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)\|\|adona.org\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "adona.org"] [uri "/wp-json/wp/v2/users"] [unique_id "alUfeCucQkJZV7XaqrZcMwAAAA4"] show less	Brute-Force Bad Web Bot Web App Attack
🇫🇮 decode5921	2026-07-13 07:15:02 (2 days ago)	Honeypot hit (honeypot:wp) — probed a non-existent bait path on a site that does not run that softwa ... show more Honeypot hit (honeypot:wp) — probed a non-existent bait path on a site that does not run that software. show less	Brute-Force Web App Attack
🇩🇪 4server	2026-07-13 01:09:20 (2 days ago)	[MonJul1303:09:16.0403892026][security2:error][pid3590057:tid3590079][client167.56.70.81:0]ModSecuri ... show more [MonJul1303:09:16.0403892026][security2:error][pid3590057:tid3590079][client167.56.70.81:0]ModSecurity:Accessdeniedwithcode403\(phase1\).Stringmatch\"/xmlrpc.php\"atREQUEST_URI.[file\"/etc/apache2/conf.d/modsec_custom_rules.conf\"][line\"170\"][id\"960024\"][msg\"XML-RPCdisabled\"][hostname\"dsfiduciaria.ch\"][uri\"/xmlrpc.php\"][unique_id\"alQ6vFPSTfSv5OBWm8ZKOwAAAAQ\"] show less	Port Scan Brute-Force Web App Attack
🇺🇸 TPI-Abuse	2026-07-12 23:44:17 (2 days ago)	(mod_security) mod_security (id:225170) triggered by 167.56.70.81 (r167-56-70-81.dialup.adsl.antelda ... show more (mod_security) mod_security (id:225170) triggered by 167.56.70.81 (r167-56-70-81.dialup.adsl.anteldata.net.uy): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Jul 12 19:44:11.934757 2026] [security2:error] [pid 14493:tid 14493] [client 167.56.70.81:19072] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)\|\|creationorevolution.net\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "creationorevolution.net"] [uri "/wp-json/wp/v2/users"] [unique_id "alQmy1vuQpBGu7nrZe-g7gAAAAY"] show less	Brute-Force Bad Web Bot Web App Attack
🇩🇪 big-cloud.nl	2026-07-12 14:37:55 (3 days ago)	Try to access /xmlrpc.php	Web App Attack
Anonymous	2026-07-12 07:42:54 (3 days ago)	167.56.70.81 - - [12/Jul/2026:09:39:09 +0200] "POST /xmlrpc.php HTTP/1.1" 200 624 "-" "Mozilla/5.0 ( ... show more 167.56.70.81 - - [12/Jul/2026:09:39:09 +0200] "POST /xmlrpc.php HTTP/1.1" 200 624 "-" "Mozilla/5.0 (Windows NT 6.3; x86) AppleWebKit/537.36 (KHTML, like Gecko) Opera/66.0.0.0 Safari/537.36" 167.56.70.81 - - [12/Jul/2026:09:41:13 +0200] "POST /xmlrpc.php HTTP/1.1" 200 624 "-" "Mozilla/5.0 (Windows NT 10.0; x64) AppleWebKit/537.36 (KHTML, like Gecko) Safari/12.0.0.0 Safari/537.36" 167.56.70.81 - - [12/Jul/2026:09:41:43 +0200] "POST /xmlrpc.php HTTP/1.1" 200 624 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; x86) AppleWebKit/537.36 (KHTML, like Gecko) Opera/65.0.0.0 Safari/537.36" 167.56.70.81 - - [12/Jul/2026:09:42:18 +0200] "POST /xmlrpc.php HTTP/1.1" 200 624 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; x86) AppleWebKit/537.36 (KHTML, like Gecko) Opera/63.0.0.0 Safari/537.36" 167.56.70.81 - - [12/Jul/2026:09:42:51 +0200] "POST /xmlrpc.php HTTP/1.1" 200 624 "-" "Mozilla/5.0 (Windows NT 6.2; arm64) AppleWebKit/537.36 (KHTML, like Gecko) Firefox/89.0.0.0 Safari/537.36" ... show less	Brute-Force Web App Attack
🇫🇮 decode5921	2026-07-12 07:00:02 (3 days ago)	Honeypot hit (honeypot:wp) — probed a non-existent bait path on a site that does not run that softwa ... show more Honeypot hit (honeypot:wp) — probed a non-existent bait path on a site that does not run that software. show less	Brute-Force Web App Attack
🇺🇸 TPI-Abuse	2026-07-11 23:22:05 (3 days ago)	(mod_security) mod_security (id:225170) triggered by 167.56.70.81 (r167-56-70-81.dialup.adsl.antelda ... show more (mod_security) mod_security (id:225170) triggered by 167.56.70.81 (r167-56-70-81.dialup.adsl.anteldata.net.uy): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Jul 11 19:22:00.092733 2026] [security2:error] [pid 10280:tid 10280] [client 167.56.70.81:20338] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)\|\|dalessalesandservice.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "dalessalesandservice.com"] [uri "/wp-json/wp/v2/users"] [unique_id "alLQGAbAw1EzP5O3_-mpygAAAAE"] show less	Brute-Force Bad Web Bot Web App Attack
🇮🇪 Jim Keir	2026-07-11 22:51:09 (3 days ago)	2026-07-11 22:51:09 167.56.70.81 File scanning, blocking 167.56.70.81 for 5 minutes	Web App Attack
🇫🇮 decode5921	2026-07-11 06:45:02 (4 days ago)	Honeypot hit (honeypot:wp) — probed a non-existent bait path on a site that does not run that softwa ... show more Honeypot hit (honeypot:wp) — probed a non-existent bait path on a site that does not run that software. show less	Brute-Force Web App Attack
🇨🇭 4server	2026-07-11 05:33:06 (4 days ago)	[SatJul1107:32:59.5707902026][security2:error][pid230181:tid230524][client167.56.70.81:0]ModSecurity ... show more [SatJul1107:32:59.5707902026][security2:error][pid230181:tid230524][client167.56.70.81:0]ModSecurity:Accessdeniedwithcode403\(phase1\).Stringmatch\"/xmlrpc.php\"atREQUEST_URI.[file\"/etc/apache2/conf.d/modsec_custom_rules.conf\"][line\"368\"][id\"960024\"][msg\"XML-RPCdisabled\"][hostname\"giuristifriburgo.ch\"][uri\"/xmlrpc.php\"][unique_id\"alHVi0T5q6PWUP_c_CZJmQAAAJE\"] show less	Hacking Web App Attack
🇩🇪 Marc	2026-07-10 16:07:49 (5 days ago)	167.56.70.81 - - [10/Jul/2026:18:05:41 +0200] "POST /xmlrpc.php HTTP/1.1" 200 3972 "-" "Mozilla/5.0 ... show more 167.56.70.81 - - [10/Jul/2026:18:05:41 +0200] "POST /xmlrpc.php HTTP/1.1" 200 3972 "-" "Mozilla/5.0 (Linux; Android 10; x86) AppleWebKit/537.36 (KHTML, like Gecko) Edge/89.0.0.0 Safari/537.36" 167.56.70.81 - - [10/Jul/2026:18:07:21 +0200] "POST /xmlrpc.php HTTP/1.1" 200 3972 "-" "Mozilla/5.0 (Linux; Android 10; arm64) AppleWebKit/537.36 (KHTML, like Gecko) Opera/69.0.0.0 Safari/537.36" 167.56.70.81 - - [10/Jul/2026:18:07:49 +0200] "POST /xmlrpc.php HTTP/1.1" 200 3974 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; arm64) AppleWebKit/537.36 (KHTML, like Gecko) Edge/96.0.0.0 Safari/537.36" show less	Brute-Force Web App Attack

Showing 1 to 15 of 18 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇸🇬 47.79.0.255

🇩🇪 213.209.159.235

🇹🇼 128.14.237.130

🇳🇬 102.90.125.43

🇧🇬 79.124.62.134

🇮🇹 37.116.206.82

🇺🇸 2607:f8b0:4004:c0b::12d

🇳🇱 185.212.129.205

🇧🇷 177.125.235.80

🇧🇷 177.36.2.139

🇺🇸 147.185.132.238

🇮🇷 94.184.18.240

🇧🇬 79.124.62.230

🇵🇱 20.215.50.93

🇮🇳 203.145.143.163

🇹🇼 198.235.24.114

🇹🇼 198.235.24.54

🇵🇱 194.180.48.31

🇪🇸 188.92.252.198

🇺🇸 157.245.10.25