JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 169.58.130.17

169.58.130.17 was found in our database!

This IP was reported 15 times. Confidence of Abuse is 74%: ?

74%

ISP	Contabo GmbH
Usage Type	Data Center/Web Hosting/Transit
ASN	AS51167
Hostname(s)	vmi3488473.contaboserver.net
Domain Name	contabo.com
Country	🇫🇷 France
City	Lauterbourg, Grand Est

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 169.58.130.17

Whois 169.58.130.17

IP Abuse Reports for 169.58.130.17:

This IP address has been reported a total of 15 times from 12 distinct sources. 169.58.130.17 was first reported on August 17th 2026, and the most recent report was 49 minutes ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇩🇪 F242	2026-08-19 14:40:54 (49 minutes ago)	Wordpress Login or XMLRPC abuse	Web App Attack
🇪🇸 masterguru	2026-08-19 11:21:40 (4 hours ago)	wp-login request blocked, no referer. Pattern match "wp-login.php" at REQUEST_URI. (5001900-122)	Web App Attack
🇺🇸 lostswordfish.com	2026-08-19 09:50:04 (5 hours ago)	Wordfence waf block on 1105merrystreet	Web App Attack
🇨🇿 ptlab	2026-08-19 04:45:24 (10 hours ago)	Detected wp_login attack from WP-host.	Hacking Web App Attack
🇲🇽 octageeks.com	2026-08-19 04:42:02 (10 hours ago)	Wordpress malicious attack:[octaflood]	Web App Attack
🇩🇪 FeG Deutschland	2026-08-18 18:55:03 (20 hours ago)	Looking for CMS/PHP/SQL vulnerablilities/excessive crawling - 257	Exploited Host Web App Attack
🇬🇧 spamverify.com	2026-08-18 18:24:03 (21 hours ago)	Honeypot Hit: WordPress Login	Web Spam Blog Spam Bad Web Bot Web App Attack
Anonymous	2026-08-18 18:00:01 (21 hours ago)	169.58.130.17 - - [18/Aug/2026:19:59:56 +0200] "GET /wp-login.php HTTP/2.0" 200 4001 "-" "Mozilla/5. ... show more 169.58.130.17 - - [18/Aug/2026:19:59:56 +0200] "GET /wp-login.php HTTP/2.0" 200 4001 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36" ... show less	Web App Attack
🇺🇸 TPI-Abuse	2026-08-18 03:39:33 (1 day ago)	(mod_security) mod_security (id:225170) triggered by 169.58.130.17 (vmi3488473.contaboserver.net): 1 ... show more (mod_security) mod_security (id:225170) triggered by 169.58.130.17 (vmi3488473.contaboserver.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Aug 17 23:39:26.479528 2026] [security2:error] [pid 13323:tid 13323] [client 169.58.130.17:56578] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)\|\|gulftelecom.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "gulftelecom.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aoPT7vBWiRbzvIGUWDj2nQAAAC8"], referer: https://gulftelecom.com/ show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-08-18 03:19:55 (1 day ago)	(mod_security) mod_security (id:225170) triggered by 169.58.130.17 (vmi3488473.contaboserver.net): 1 ... show more (mod_security) mod_security (id:225170) triggered by 169.58.130.17 (vmi3488473.contaboserver.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Aug 17 23:19:48.110128 2026] [security2:error] [pid 25520:tid 25520] [client 169.58.130.17:54448] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)\|\|hotpay.co\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "hotpay.co"] [uri "/wp-json/wp/v2/users"] [unique_id "aoPPVBQagdyBFNextCGrrQAAAAc"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-08-18 02:03:56 (1 day ago)	(mod_security) mod_security (id:225170) triggered by 169.58.130.17 (vmi3488473.contaboserver.net): 1 ... show more (mod_security) mod_security (id:225170) triggered by 169.58.130.17 (vmi3488473.contaboserver.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Aug 17 22:03:50.702914 2026] [security2:error] [pid 29744:tid 29744] [client 169.58.130.17:44378] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)\|\|ronjamestelevision.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "ronjamestelevision.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aoO9ht4vXlm5TwaGjb55nwAAABc"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 xxkodedxx	2026-08-17 18:57:56 (1 day ago)	[Zorvexus edge-defense] GET .env / WordPress honeypot probe Trigger: 1× honeypot-get in 10m window. ... show more [Zorvexus edge-defense] GET .env / WordPress honeypot probe Trigger: 1× honeypot-get in 10m window. Active: 18:57:32 UTC Volume: 1 honeypot probe(s) Bait taken: /wp-json/ldlms/v2/users?per_page=100&_fields=user_login UA: "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36" Auto-banned 30d. zorvexus-banner. show less	Bad Web Bot Web App Attack
🇨🇭 backslash	2026-08-17 18:42:01 (1 day ago)	block ruleset 486D2EE5E731CC049D1E480D68D04DFFE28AADF1	Bad Web Bot
🇫🇷 Stara	2026-08-17 11:55:19 (2 days ago)	Automated block - Joomla/WordPress/OpenCart vulnerability scanner exploitation detected (Mala Kinesk ... show more Automated block - Joomla/WordPress/OpenCart vulnerability scanner exploitation detected (Mala Kineskinja) show less	Hacking Brute-Force Web App Attack
🇺🇸 TPI-Abuse	2026-08-17 11:24:13 (2 days ago)	(mod_security) mod_security (id:225170) triggered by 169.58.130.17 (vmi3488473.contaboserver.net): 1 ... show more (mod_security) mod_security (id:225170) triggered by 169.58.130.17 (vmi3488473.contaboserver.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Aug 17 07:24:06.607891 2026] [security2:error] [pid 7575:tid 7575] [client 169.58.130.17:51974] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)\|\|batesstrategygroup.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "batesstrategygroup.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aoLvVhUq9en7788T9h8WggAAABM"], referer: https://batesstrategygroup.com/ show less	Brute-Force Bad Web Bot Web App Attack

Showing 1 to 15 of 15 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇭🇰 199.45.154.182

🇳🇱 185.223.235.3

🇺🇸 159.223.100.14

🇺🇸 134.122.28.193

🇺🇦 109.200.147.6

🇱🇹 91.224.92.17

🇳🇱 81.19.216.75

🇹🇼 60.249.3.202

🇫🇷 51.159.110.167

🇺🇸 45.194.67.26

🇦🇷 186.13.24.118

🇺🇸 174.138.44.8

🇳🇱 152.42.136.22

🇮🇳 122.168.194.41

🇨🇳 101.71.38.198

🇷🇴 2.57.122.209

🇹🇼 198.235.24.110

🇩🇪 194.164.192.228

🇩🇪 185.84.159.31

🇺🇸 147.185.132.255