This IP address has been reported a total of
10
times from
8 distinct
sources.
199.96.166.82 was first reported on
November 12th 2025 , and the most recent report was
2 days ago Switzerland
with 1
report.
The only category in these recent reports was:
Web App Attack
1
time.
Recent Reports
We have received reports of abusive activity from this IP address within the last week. It is
potentially still actively engaged in abusive activities.
Reporter
IoA Timestamp (UTC)
Comment
Categories
🇨🇭
Ribeye375
2026-09-27 18:25:36
(2 days ago)
HIPS apache-modsecurity - Block tcp/http,https
Web App Attack
🇺🇸
TPI-Abuse
2026-05-22 11:30:26
(4 months ago)
(mod_security) mod_security (id:210492) triggered by 199.96.166.82 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210492) triggered by 199.96.166.82 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri May 22 07:30:20.496890 2026] [security2:error] [pid 4564:tid 4564] [client 199.96.166.82:50393] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.bak" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "support.leonardodecaprio.com"] [uri "/wp-config.bak"] [unique_id "ahA-TMDZGEITMW9zKzpF2gAAAAA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-05-20 16:22:27
(4 months ago)
(mod_security) mod_security (id:210492) triggered by 199.96.166.82 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210492) triggered by 199.96.166.82 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed May 20 12:22:19.660827 2026] [security2:error] [pid 17051:tid 17051] [client 199.96.166.82:9199] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.txt" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.kavahawaii.com.kh6jim.com"] [uri "/wp-config.txt"] [unique_id "ag3fu81yY8Sg60sbpyKz4QAAABA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇫🇷
ELYAZ
2026-05-17 22:50:00
(4 months ago)
(y3) Failed access -byebye- from 199.96.166.82 (US/United States/-): (CF_ENABLE)
Hacking
🇺🇸
mnsf
2026-05-15 16:05:38
(4 months ago)
Scanning/Probing (34)
Brute-Force
Web App Attack
2026-05-04 08:17:36
(4 months ago)
199.96.166.82 - - [04/May/2026:16:17:35 +0800] "GET /.wp-config.php.swp HTTP/1.1" 301 - "-" "Mozilla ...
show more
199.96.166.82 - - [04/May/2026:16:17:35 +0800] "GET /.wp-config.php.swp HTTP/1.1" 301 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36"
...
show less
Bad Web Bot
Web App Attack
🇮🇩
Burayot
2026-02-03 22:18:57
(7 months ago)
LF_MODSEC: (mod_security) mod_security (id:1000001) triggered by 199.96.166.82 (US/United States/-): ...
show more
LF_MODSEC: (mod_security) mod_security (id:1000001) triggered by 199.96.166.82 (US/United States/-): 1 in the last 3600 secs
show less
Web App Attack
🇺🇸
TPI-Abuse
2026-01-31 16:31:22
(7 months ago)
(mod_security) mod_security (id:225170) triggered by 199.96.166.82 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:225170) triggered by 199.96.166.82 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Jan 31 11:31:15.194493 2026] [security2:error] [pid 21493:tid 21571] [client 199.96.166.82:14487] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||www.neotienda.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "www.neotienda.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aX4uU0SccFLcoKKGdF8vawAAAsQ"], referer: https://www.google.com
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
fbarela
2025-11-28 05:00:40
(10 months ago)
FortiGate SSL VPN login failures.
Hacking
Brute-Force
🇨🇭
backslash
2025-11-12 01:15:44
(10 months ago)
block ruleset 798ECF92F12ADC636D3520C2890AF17ADEFDE3BE
Bad Web Bot
Showing 1 to
10
of 10 reports
