This IP address has been reported a total of
7
times from
5 distinct
sources.
178.66.159.56 was first reported on
July 13th 2025 , and the most recent report was
5 days ago Russian Federation
with 1
report.
The only category in these recent reports was:
Port Scan
1
time.
Recent Reports
We have received reports of abusive activity from this IP address within the last week. It is
potentially still actively engaged in abusive activities.
Reporter
IoA Timestamp (UTC)
Comment
Categories
๐ท๐บ
Anton La
2026-09-18 21:45:05
(5 days ago)
Keenetic Firewall: Blocked Traffic (No Port Detected - likely UDP). Blocked 203 times in last 24h.
Port Scan
2025-11-25 08:34:30
(9 months ago)
scanning http requests from known botnet
Web App Attack
๐บ๐ธ
TPI-Abuse
2025-10-24 11:24:25
(11 months ago)
(mod_security) mod_security (id:225170) triggered by 178.66.159.56 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:225170) triggered by 178.66.159.56 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 24 07:24:17.261736 2025] [security2:error] [pid 9545:tid 9545] [client 178.66.159.56:17247] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||fusionrep.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "fusionrep.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aPth4aKRykrXnrthXGZQhwAAAAQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
๐บ๐ธ
TPI-Abuse
2025-10-24 07:05:32
(11 months ago)
(mod_security) mod_security (id:225170) triggered by 178.66.159.56 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:225170) triggered by 178.66.159.56 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 24 03:05:26.669110 2025] [security2:error] [pid 31192:tid 31192] [client 178.66.159.56:22426] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||babylontravelone.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "babylontravelone.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aPslNkDFE1_jYsi-StaYMAAAABE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2025-10-24 06:00:43
(11 months ago)
Backdrop CMS module - malicious activity detected
Bad Web Bot
Web App Attack
๐บ๐ธ
TPI-Abuse
2025-10-24 00:30:45
(11 months ago)
(mod_security) mod_security (id:225170) triggered by 178.66.159.56 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:225170) triggered by 178.66.159.56 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 23 20:30:39.180838 2025] [security2:error] [pid 902356:tid 902356] [client 178.66.159.56:18188] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||sharawi-gum.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "sharawi-gum.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aPrIr9FlR6N7sdj6DNf4kwAAAAw"]
show less
Brute-Force
Bad Web Bot
Web App Attack
๐ซ๐ท
แดสแด
2025-07-13 10:23:29
(1 year ago)
Triggered Cloudflare WAF (l7ddos) from RU.
ASN: 12389 (ROSTELECOM-AS PJSC Rostelecom. Technical Team ...
show more
Triggered Cloudflare WAF (l7ddos) from RU.
ASN: 12389 (ROSTELECOM-AS PJSC Rostelecom. Technical Team)
Protocol: HTTP/2 (GET method)
UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
This report was generated by:
https://github.com/sefinek/Cloudflare-WAF-To-AbuseIPDB
show less
DDoS Attack
Bad Web Bot
Showing 1 to
7
of 7 reports
