JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 168.167.28.4

168.167.28.4 was found in our database!

This IP was reported 27 times. Confidence of Abuse is 55%: ?

55%

ISP	Botswana Telecommunications Corporation
Usage Type	Fixed Line ISP
ASN	AS14988
Domain Name	btc.bw
Country	🇧🇼 Botswana
City	Gaborone, Gaborone

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 168.167.28.4

Whois 168.167.28.4

IP Abuse Reports for 168.167.28.4:

This IP address has been reported a total of 27 times from 20 distinct sources. 168.167.28.4 was first reported on March 29th 2026, and the most recent report was 2 days ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇩🇪 LRob	2026-07-16 09:44:35 (2 days ago)	CrowdSec: crowdsecurity/http-bf-wordpress_bf_xmlrpc \| req: /xmlrpc.php \| UA: WordPress.com; https:// ... show more CrowdSec: crowdsecurity/http-bf-wordpress_bf_xmlrpc \| req: /xmlrpc.php \| UA: WordPress.com; https://wordpress.com show less	Brute-Force Web App Attack
🇫🇷 dynamix	2026-07-16 09:13:23 (2 days ago)	WordPress XMLRPC Brute Force Attack	Brute-Force Web App Attack
🇫🇮 YF	2026-07-15 16:31:13 (3 days ago)	xmlrpc.php Potential DDoS or brute force	DDoS Attack Brute-Force
🇺🇸 TPI-Abuse	2026-07-15 15:15:46 (3 days ago)	(mod_security) mod_security (id:240335) triggered by 168.167.28.4 (-): 1 in the last 300 secs; Ports ... show more (mod_security) mod_security (id:240335) triggered by 168.167.28.4 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jul 15 11:15:38.867965 2026] [security2:error] [pid 6219:tid 6219] [client 168.167.28.4:50389] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 168.167.28.4 (+1 hits since last alert)\|egelfitness.nl\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "egelfitness.nl"] [uri "/xmlrpc.php"] [unique_id "alekGv4idSXzKuRfQP6w0AAAAAA"] show less	Brute-Force Bad Web Bot Web App Attack
🇨🇭 Mario Bretscher	2026-07-15 14:05:45 (3 days ago)	Jul 15 16:05:17 tubegrabe-stafel.ch Cerber(tubegrabe-stafel.ch)[21317]: Authentication failure for m ... show more Jul 15 16:05:17 tubegrabe-stafel.ch Cerber(tubegrabe-stafel.ch)[21317]: Authentication failure for marbre! from 168.167.28.4 Jul 15 16:05:43 tubegrabe-stafel.ch Cerber(tubegrabe-stafel.ch)[25483]: Authentication failure for marbre! from 168.167.28.4 ... show less	Web Spam
🇺🇸 TPI-Abuse	2026-07-15 10:09:34 (3 days ago)	(mod_security) mod_security (id:240335) triggered by 168.167.28.4 (-): 1 in the last 300 secs; Ports ... show more (mod_security) mod_security (id:240335) triggered by 168.167.28.4 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jul 15 06:09:28.404300 2026] [security2:error] [pid 29134:tid 29134] [client 168.167.28.4:56977] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 168.167.28.4 (+1 hits since last alert)\|globalsolutions.technology\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "globalsolutions.technology"] [uri "/xmlrpc.php"] [unique_id "aldcWM7KXMtXzgP1R4s6ugAAAAU"] show less	Brute-Force Bad Web Bot Web App Attack
🇳🇱 debestelapp	2026-07-15 10:00:06 (3 days ago)		Web App Attack
🇺🇸 kosada.com	2026-07-06 17:40:39 (1 week ago)	Web bot: denial-of-service flood	DDoS Attack Bad Web Bot
🇺🇸 kosada.com	2026-06-25 21:04:46 (3 weeks ago)	Web bot: denial-of-service flood	DDoS Attack Bad Web Bot
Anonymous	2026-06-23 09:18:18 (3 weeks ago)	[redacted] 168.167.28.4 - - [23/Jun/2026:11:17:35 +0200] "POST /xmlrpc.php HTTP/1.1" 405 428 "-" "Je ... show more [redacted] 168.167.28.4 - - [23/Jun/2026:11:17:35 +0200] "POST /xmlrpc.php HTTP/1.1" 405 428 "-" "Jetpack/13.0; WordPress/6.3; http://site11067460.com" [redacted] 168.167.28.4 - - [23/Jun/2026:11:17:46 +0200] "POST /xmlrpc.php HTTP/1.1" 405 428 "-" "Jetpack/12.5; WordPress/6.4; http://site61667290.com" [redacted] 168.167.28.4 - - [23/Jun/2026:11:17:55 +0200] "POST /xmlrpc.php HTTP/1.1" 405 428 "-" "WordPress.com; https://wordpress.com" [redacted] 168.167.28.4 - - [23/Jun/2026:11:18:05 +0200] "POST /xmlrpc.php HTTP/1.1" 405 428 "-" "Jetpack by WordPress.com (Jetpack 12.1; WordPress 6.4)" [redacted] 168.167.28.4 - - [23/Jun/2026:11:18:17 +0200] "POST /xmlrpc.php HTTP/1.1" 405 428 "-" "Jetpack by WordPress.com (Jetpack 12.1; WordPress 6.3)" ... show less	Hacking Web App Attack
🇫🇷 MatStef132	2026-06-21 21:25:25 (3 weeks ago)	MatShield L7: blocked on mathost.eu (ua-quarantined)	Bad Web Bot
🇩🇪 Vegascosmetics	2026-06-17 17:49:14 (1 month ago)	(Kingcopy.org-AI-IDS-Report):IP automatically blocked after obfuscated redirect. Vegas Security	DDoS Attack Hacking Exploited Host
🇩🇪 SMARTNET	2026-05-27 06:03:53 (1 month ago)	Aisuru(Mirai variant) DDoS \| Incident ID: 6ed80dcf-192e-41b9-b3cf-8e7356812aa9	DDoS Attack
🇫🇷 security.rdmc.fr	2026-05-14 07:09:02 (2 months ago)	Port Scan Attack proto:TCP src:39854 dst:23	Port Scan
🇺🇸 MPL	2026-05-14 05:11:27 (2 months ago)	tcp/23 (4 or more attempts)	Port Scan

Showing 1 to 15 of 27 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇧🇷 189.114.112.215

🇳🇬 165.154.11.121

🇫🇷 159.92.165.34

🇧🇬 93.94.141.115

🇸🇬 84.247.149.82

🇱🇹 62.60.130.219

🇧🇷 45.233.14.31

🇨🇭 34.65.135.168

🇹🇷 176.90.53.82

🇺🇸 159.223.122.27

🇮🇩 103.97.101.25

🇺🇸 97.74.6.204

🇫🇷 92.205.57.72

🇳🇱 91.92.40.44

🇨🇦 54.39.210.89

🇳🇱 45.156.87.13

🇳🇱 45.148.10.157

🇳🇱 45.148.10.147

🇯🇵 43.165.185.177

🇬🇧 35.203.211.195