JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 167.99.252.116

167.99.252.116 was found in our database!

This IP was reported 24 times. Confidence of Abuse is 72%: ?

72%

ISP	DigitalOcean, LLC
Usage Type	Data Center/Web Hosting/Transit
ASN	AS14061
Domain Name	digitalocean.com
Country	🇩🇪 Germany
City	Frankfurt am Main, Hesse

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 167.99.252.116

Whois 167.99.252.116

IP Abuse Reports for 167.99.252.116:

This IP address has been reported a total of 24 times from 18 distinct sources. 167.99.252.116 was first reported on April 5th 2023, and the most recent report was 3 hours ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇵🇱 Budyn	2026-09-16 10:35:57 (3 hours ago)	Automated threat detected by Budyn Honeypot Sinkhole. Attack type: Unknown Bot / General Web Recon. ... show more Automated threat detected by Budyn Honeypot Sinkhole. Attack type: Unknown Bot / General Web Recon. Malicious scanner triggered a security trap targeting emulated vulnerabilities. Evidence: HOST: idp.budyn.xyz \| URI: /wp-json/batch/v1 \| UA: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 \| BODY: [Empty / GET Request] show less	Bad Web Bot Web App Attack
🇺🇸 Jason Howell	2026-09-16 09:58:07 (4 hours ago)	167.99.252.116 - - [16/Sep/2026:03:50:19 -0500] "POST /wp-login.php HTTP/1.1" 503 23316 "-" "Mozilla ... show more 167.99.252.116 - - [16/Sep/2026:03:50:19 -0500] "POST /wp-login.php HTTP/1.1" 503 23316 "-" "Mozilla/5.0" 167.99.252.116 - - [16/Sep/2026:03:58:51 -0500] "POST /wp-login.php HTTP/1.1" 503 22189 "-" "Mozilla/5.0" 167.99.252.116 - - [16/Sep/2026:04:07:25 -0500] "POST /wp-login.php HTTP/1.1" 503 23315 "-" "Mozilla/5.0" 167.99.252.116 - - [16/Sep/2026:04:15:57 -0500] "POST /wp-login.php HTTP/1.1" 503 22190 "-" "Mozilla/5.0" 167.99.252.116 - - [16/Sep/2026:04:58:06 -0500] "POST /wp-login.php HTTP/1.1" 503 23315 "-" "Mozilla/5.0" ... show less	Web App Attack
🇸🇪 vaia.cloud	2026-09-16 08:00:03 (6 hours ago)	crowdsecurity/http-cve-probing	Brute-Force Web App Attack
🇺🇸 Jason Howell	2026-09-16 07:43:40 (6 hours ago)	167.99.252.116 - - [16/Sep/2026:01:37:33 -0500] "POST /wp-login.php HTTP/1.1" 503 23315 "-" "Mozilla ... show more 167.99.252.116 - - [16/Sep/2026:01:37:33 -0500] "POST /wp-login.php HTTP/1.1" 503 23315 "-" "Mozilla/5.0" 167.99.252.116 - - [16/Sep/2026:01:45:39 -0500] "POST /wp-login.php HTTP/1.1" 503 22190 "-" "Mozilla/5.0" 167.99.252.116 - - [16/Sep/2026:01:53:58 -0500] "POST /wp-login.php HTTP/1.1" 503 23314 "-" "Mozilla/5.0" 167.99.252.116 - - [16/Sep/2026:02:02:18 -0500] "POST /wp-login.php HTTP/1.1" 503 22191 "-" "Mozilla/5.0" 167.99.252.116 - - [16/Sep/2026:02:43:38 -0500] "POST /wp-login.php HTTP/1.1" 503 23316 "-" "Mozilla/5.0" ... show less	Web App Attack
🇨🇭 Origon	2026-09-16 06:56:10 (7 hours ago)	recidive - IP: 167.99.252.116 - 2026-09-16 07:32:18,012 fail2ban.actions [3907706]: NOTICE [plesk-w ... show more recidive - IP: 167.99.252.116 - 2026-09-16 07:32:18,012 fail2ban.actions [3907706]: NOTICE [plesk-wordpress] Ban 167.99.252.116 2026-09-16 08:14:38,444 fail2ban.actions [3907706]: NOTICE [plesk-wordpress] Ban 167.99.252.116 2026-09-16 08:56:10,635 fail2ban.actions [3907706]: NOTICE [plesk-wordpress] Ban 167.99.252.116 show less	Web App Attack
Anonymous	2026-09-16 06:21:48 (7 hours ago)	IP matched detection query 20 more in short time bad rqs.	Brute-Force Web App Attack Hacking
🇮🇹 VHosting	2026-09-16 05:35:04 (8 hours ago)	Detected WordPress attack from different servers	Brute-Force Web App Attack
🇺🇸 Jason Howell	2026-09-16 05:33:41 (8 hours ago)	167.99.252.116 - - [15/Sep/2026:23:55:33 -0500] "GET /wp-login.php HTTP/1.1" 301 583 "-" "Mozilla/5. ... show more 167.99.252.116 - - [15/Sep/2026:23:55:33 -0500] "GET /wp-login.php HTTP/1.1" 301 583 "-" "Mozilla/5.0" 167.99.252.116 - - [15/Sep/2026:23:55:34 -0500] "GET /wp-login.php HTTP/1.1" 200 6304 "-" "Mozilla/5.0" 167.99.252.116 - - [16/Sep/2026:00:30:00 -0500] "POST /wp-login.php HTTP/1.1" 503 23316 "-" "Mozilla/5.0" 167.99.252.116 - - [16/Sep/2026:00:31:49 -0500] "POST /wp-login.php HTTP/1.1" 503 18633 "-" "Mozilla/5.0" 167.99.252.116 - - [16/Sep/2026:00:33:40 -0500] "POST /wp-login.php HTTP/1.1" 503 22190 "-" "Mozilla/5.0" ... show less	Web App Attack
🇫🇷 masterguru	2026-09-16 05:31:17 (8 hours ago)	wp-login request blocked, no referer. Pattern match "wp-login.php" at REQUEST_URI. (88020-193)	Hacking
🇳🇱 Alt255	2026-09-16 05:31:14 (8 hours ago)	[ti-02ra] WordPress login brute-force: 4 suspicious requests detected by fail2ban jail apache-wordpr ... show more [ti-02ra] WordPress login brute-force: 4 suspicious requests detected by fail2ban jail apache-wordpress. Example: 167.99.252.116 - - [16/Sep/2026:07:29:03 +0200] "POST /wp-login.php HTTP/1.1" 200 15607 "-" "Mozilla/5.0" 167.99.252.116 - - [16/Sep/2026:07:29:03 +0200] "POST /wp-login.php HTTP/1.1" 200 15608 "-" "Mozilla/5.0" 167.99.252.116 - - [16/Sep/2026:07:30:57 +0200] "POST /wp-login.php HTTP/1.1" 200 12020 "-" "Mozilla/5.0" 167.99.252.116 - - [16/Sep/2026:07:30:57 +0200] "POST /wp-login.php HTTP/1.1" 200 12022 "-" "Mozilla/5.0" ... show less	Brute-Force Web App Attack
🇩🇪 FeG Deutschland	2026-09-16 04:45:13 (9 hours ago)	Looking for CMS/PHP/SQL vulnerablilities/excessive crawling - 1247	Exploited Host Web App Attack
🇩🇪 filstal.org	2026-09-16 04:37:02 (9 hours ago)	WordPress login brute-force detected.	Brute-Force Web App Attack
🇵🇱 Budyn	2026-09-16 04:36:40 (9 hours ago)	Automated threat detected by Budyn Honeypot Sinkhole. Attack type: WP Path Scanning (Recon). Malicio ... show more Automated threat detected by Budyn Honeypot Sinkhole. Attack type: WP Path Scanning (Recon). Malicious scanner triggered a security trap targeting emulated vulnerabilities. Evidence: HOST: cdn.budyn.ovh \| URI: /wp-login.php \| UA: Mozilla/5.0 \| BODY: [Empty / GET Request] show less	Bad Web Bot Web App Attack
🇩🇪 raph	2026-09-16 04:31:03 (9 hours ago)	[Wordpress] crawler /wp-admin/, /wp-content/, etc.	Bad Web Bot Web App Attack
🇺🇸 MPL	2026-09-15 18:56:04 (19 hours ago)	tcp/8443	Port Scan

Showing 1 to 15 of 24 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇭🇰 223.17.1.118

🇺🇸 216.180.246.246

🇨🇦 216.110.250.181

🇺🇸 34.94.35.161

🇺🇸 209.240.54.65

🇺🇸 209.227.63.139

🇺🇸 202.88.36.184

🇦🇷 190.5.160.20

🇺🇸 172.58.241.13

🇺🇸 172.58.166.86

🇺🇸 157.230.157.187

🇮🇩 103.214.100.4

🇮🇳 223.223.138.5

🇦🇷 200.59.88.125

🇬🇧 193.163.125.103

🇺🇦 176.98.8.220

🇺🇸 173.239.240.78

🇺🇸 170.130.187.34

🇺🇸 156.248.87.131

🇺🇸 147.224.161.222