This IP address has been reported a total of
8
times from
4 distinct
sources.
172.83.252.167 was first reported on
February 14th 2026 , and the most recent report was
4 days ago United States of America
with 1
report.
The most common categories in these recent reports were:
Web App Attack
1
time;
Brute-Force
1
time;
Bad Web Bot
1
time.
Recent Reports
We have received reports of abusive activity from this IP address within the last week. It is
potentially still actively engaged in abusive activities.
Reporter
IoA Timestamp (UTC)
Comment
Categories
🇺🇸
TPI-Abuse
2026-10-23 00:14:24
(4 days ago)
(mod_security) mod_security (id:210350) triggered by 172.83.252.167 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210350) triggered by 172.83.252.167 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 22 20:14:19.382944 2026] [security2:error] [pid 470:tid 470] [client 172.83.252.167:11065] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.ankitoner.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.ankitoner.com"] [uri "/superelvis/bn_frien.htm"] [unique_id "atqm22XSuI6Ikz-EazQOAgAAAAM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-04-11 08:52:01
(6 months ago)
(mod_security) mod_security (id:210350) triggered by 172.83.252.167 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210350) triggered by 172.83.252.167 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Apr 11 04:51:55.953834 2026] [security2:error] [pid 2760015:tid 2760015] [client 172.83.252.167:43119] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||sahinozalit.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "sahinozalit.com"] [uri "/"] [unique_id "adoLqwJiYbUU0RM4HLrnlAAAAAE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇫🇷
mrcrassi
2026-04-07 10:21:09
(6 months ago)
Triggered Cloudflare WAF (firewallCustom) from FI.
Action taken: BLOCK
Protocol: HTTP/1.1 (POST meth ...
show more
Triggered Cloudflare WAF (firewallCustom) from FI.
Action taken: BLOCK
Protocol: HTTP/1.1 (POST method)
Endpoint: /wp-login.php
UA: Wget/1.21.4
This report was generated by:
https://github.com/sefinek/Cloudflare-WAF-To-AbuseIPDB
show less
Bad Web Bot
🇩🇪
John Chrys.
2026-04-01 21:58:05
(6 months ago)
172.83.252.167 - - [02/Apr/2026:00:55:08 +0300] "POST /xmlrpc.php HTTP/1.1" 403 3448 "-" "Wget/1.21. ...
show more
172.83.252.167 - - [02/Apr/2026:00:55:08 +0300] "POST /xmlrpc.php HTTP/1.1" 403 3448 "-" "Wget/1.21.4"
172.83.252.167 - - [02/Apr/2026:00:55:08 +0300] "POST /xmlrpc.php HTTP/1.1" 403 3448 "-" "curl/8.6.0"
172.83.252.167 - - [02/Apr/2026:00:55:08 +0300] "POST /xmlrpc.php HTTP/1.1" 403 3448 "-" "Wget/1.21.4"
172.83.252.167 - - [02/Apr/2026:00:55:09 +0300] "POST /xmlrpc.php HTTP/1.1" 403 3448 "-" "curl/7.88.1"
172.83.252.167 - - [02/Apr/2026:00:55:09 +0300] "POST /xmlrpc.php HTTP/1.1" 403 3448 "-" "curl/7.88.1"
172.83.252.167 - - [02/Apr/2026:00:55:09 +0300] "POST /xmlrpc.php HTTP/1.1" 403 3448 "-" "curl/7.88.1"
...
show less
Brute-Force
Web App Attack
🇺🇸
TPI-Abuse
2026-02-21 03:31:21
(8 months ago)
(mod_security) mod_security (id:225170) triggered by 172.83.252.167 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:225170) triggered by 172.83.252.167 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Feb 20 22:31:17.871594 2026] [security2:error] [pid 13530:tid 13530] [client 172.83.252.167:53579] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||riccardiagency.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "riccardiagency.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aZknBdafrnknj27QVDjSOQAAAAA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-02-21 00:07:11
(8 months ago)
(mod_security) mod_security (id:225170) triggered by 172.83.252.167 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:225170) triggered by 172.83.252.167 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Feb 20 19:07:05.720038 2026] [security2:error] [pid 24531:tid 24531] [client 172.83.252.167:29083] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||gilgoinn.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "gilgoinn.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aZj3KSjLEXTjLYoT_9GBiAAAAAI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
EchoGuard
2026-02-16 16:16:55
(8 months ago)
FortiGate SSL VPN login failures
VPN IP
Brute-Force
🇺🇸
EchoGuard
2026-02-14 18:00:52
(8 months ago)
FortiGate SSL VPN login failures
VPN IP
Brute-Force
Showing 1 to
8
of 8 reports
