JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 200.125.170.158

200.125.170.158 was found in our database!

This IP was reported 48 times. Confidence of Abuse is 57%: ?

57%

ISP	WIRELESS MULTI SERVICE VARGAS CABRERA, S. R. L
Usage Type	Fixed Line ISP
ASN	AS269931
Hostname(s)	INTERNET-DEDICADO-158.wmservice.com.do
Domain Name	wmservice.com.do
Country	🇩🇴 Dominican Republic
City	Villa Bisono, Santiago Province

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 200.125.170.158

Whois 200.125.170.158

IP Abuse Reports for 200.125.170.158:

This IP address has been reported a total of 48 times from 26 distinct sources. 200.125.170.158 was first reported on November 29th 2022, and the most recent report was 2 hours ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇩🇪 ghostwarriors	2026-07-18 17:20:22 (2 hours ago)	Webpage scraping	Brute-Force Bad Web Bot Web App Attack
Anonymous	2026-07-18 17:01:28 (2 hours ago)	Fail2Ban: WordPress XML-RPC brute-force attack detected.	Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-07-16 14:31:24 (2 days ago)	(mod_security) mod_security (id:240335) triggered by 200.125.170.158 (INTERNET-DEDICADO-158.wmservic ... show more (mod_security) mod_security (id:240335) triggered by 200.125.170.158 (INTERNET-DEDICADO-158.wmservice.com.do): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jul 16 10:31:19.236355 2026] [security2:error] [pid 16326:tid 16329] [client 200.125.170.158:60535] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 200.125.170.158 (+1 hits since last alert)\|pilargarciamanzanares.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "pilargarciamanzanares.com"] [uri "/xmlrpc.php"] [unique_id "aljrN_D0GCq80Cyk2wjfcAAAAAA"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-07-09 19:24:30 (1 week ago)	(mod_security) mod_security (id:240335) triggered by 200.125.170.158 (INTERNET-DEDICADO-158.wmservic ... show more (mod_security) mod_security (id:240335) triggered by 200.125.170.158 (INTERNET-DEDICADO-158.wmservice.com.do): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jul 09 15:24:27.013422 2026] [security2:error] [pid 18256:tid 18261] [client 200.125.170.158:60526] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 200.125.170.158 (+1 hits since last alert)\|hoffmanandassoc.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "hoffmanandassoc.com"] [uri "/xmlrpc.php"] [unique_id "ak_1a07LPBsLY29OhippRgAAAUI"] show less	Brute-Force Bad Web Bot Web App Attack
Anonymous	2026-07-08 17:10:25 (1 week ago)	Attribution: mikhail-smirnov-79830323 (LinkedIn/profile ID) employed by Angara Technologies Group (E ... show more Attribution: mikhail-smirnov-79830323 (LinkedIn/profile ID) employed by Angara Technologies Group (Explicitly identified himself as enemy a week before attack began) \| Aggressive search filter manipulation / web scraper probe on port 443 \| URI: Excessive filters used: /catalogsearch/result/?product_vc_type=103&q=nec+np403&screensize=18%2C23%2C46%2C47 \| UA: Opera/8.96.(Windows NT 6.1; ca-ES) Presto/2.9.190 Version/11.00 \| (Magento Site) show less	Hacking Bad Web Bot
🇺🇸 integrantservices.com	2026-07-04 19:30:36 (2 weeks ago)	(wordpress) Failed wordpress login from 200.125.170.158 (DO/Dominican Republic/INTERNET-DEDICADO-158 ... show more (wordpress) Failed wordpress login from 200.125.170.158 (DO/Dominican Republic/INTERNET-DEDICADO-158.wmservice.com.do) show less	Brute-Force
🇱🇻 garmtech.com	2026-07-01 21:13:07 (2 weeks ago)	IM360 WAF: Rate limit exceeded for XMLRPC DoS (fault code)	Web App Attack
🇺🇸 TPI-Abuse	2026-07-01 21:07:42 (2 weeks ago)	(mod_security) mod_security (id:240335) triggered by 200.125.170.158 (INTERNET-DEDICADO-158.wmservic ... show more (mod_security) mod_security (id:240335) triggered by 200.125.170.158 (INTERNET-DEDICADO-158.wmservice.com.do): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jul 01 17:07:35.504762 2026] [security2:error] [pid 8824:tid 8824] [client 200.125.170.158:51564] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 200.125.170.158 (+1 hits since last alert)\|jesussotoca.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "jesussotoca.com"] [uri "/xmlrpc.php"] [unique_id "akWBl7O2posWE3n2hT5KtAAAACM"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-06-26 18:34:58 (3 weeks ago)	(mod_security) mod_security (id:240335) triggered by 200.125.170.158 (INTERNET-DEDICADO-158.wmservic ... show more (mod_security) mod_security (id:240335) triggered by 200.125.170.158 (INTERNET-DEDICADO-158.wmservice.com.do): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jun 26 14:34:52.299584 2026] [security2:error] [pid 6072:tid 6072] [client 200.125.170.158:51293] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 200.125.170.158 (+1 hits since last alert)\|oakvillenaturopathicclinic.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "oakvillenaturopathicclinic.com"] [uri "/xmlrpc.php"] [unique_id "aj7GTBzRR2bLcvT-mWD4NgAAAAk"] show less	Brute-Force Bad Web Bot Web App Attack
Anonymous	2026-06-24 14:35:12 (3 weeks ago)	(wordpress) Failed wordpress login from 200.125.170.158 (DO/Dominican Republic/INTERNET-DEDICADO-158 ... show more (wordpress) Failed wordpress login from 200.125.170.158 (DO/Dominican Republic/INTERNET-DEDICADO-158.wmservice.com.do) show less	Brute-Force
🇺🇸 integrantservices.com	2026-06-22 17:58:24 (3 weeks ago)	(wordpress) Failed wordpress login from 200.125.170.158 (DO/Dominican Republic/INTERNET-DEDICADO-158 ... show more (wordpress) Failed wordpress login from 200.125.170.158 (DO/Dominican Republic/INTERNET-DEDICADO-158.wmservice.com.do) show less	Brute-Force
🇫🇮 23p02732	2026-06-20 01:27:53 (4 weeks ago)	Mailserver and mailaccount attacks	Brute-Force Bad Web Bot Exploited Host Web App Attack
🇺🇸 cwytech	2026-06-17 15:15:56 (1 month ago)	Fleet-wide ban from the Ghostfleet 👻. Triggered by scenario: cwy/wordpress-xmlrpc-bf-high.	Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-06-17 13:49:51 (1 month ago)	(mod_security) mod_security (id:240335) triggered by 200.125.170.158 (INTERNET-DEDICADO-158.wmservic ... show more (mod_security) mod_security (id:240335) triggered by 200.125.170.158 (INTERNET-DEDICADO-158.wmservice.com.do): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jun 17 09:49:46.744442 2026] [security2:error] [pid 19484:tid 19507] [client 200.125.170.158:62067] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 200.125.170.158 (+1 hits since last alert)\|georgementz.org\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "georgementz.org"] [uri "/xmlrpc.php"] [unique_id "ajKl-skTt4yMuHDwr9DZLQAAABI"] show less	Brute-Force Bad Web Bot Web App Attack
🇳🇱 debestelapp	2026-06-16 21:20:10 (1 month ago)		Web App Attack

Showing 1 to 15 of 48 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇮🇩 31.58.244.121

🇺🇸 192.178.115.91

🇩🇪 191.101.110.157

🇨🇳 183.128.65.42

🇸🇬 168.144.100.227

🇩🇪 104.204.218.170

🇱🇹 81.30.98.47

🇳🇱 45.148.10.183

🇩🇪 2a01:4f8:150:13a5::100:3a

🇳🇱 81.19.216.68

🇳🇱 77.251.115.208

🇬🇧 35.203.210.194

🇪🇸 212.30.33.214

🇵🇱 176.53.159.197

🇨🇳 117.187.180.215

🇷🇴 92.118.39.14

🇬🇪 91.231.218.149

🇫🇷 51.159.30.56

🇩🇪 213.209.159.242

🇵🇱 185.79.139.16