JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 201.216.166.23

201.216.166.23 was found in our database!

This IP was reported 13 times. Confidence of Abuse is 46%: ?

46%

ISP	Telgua
Usage Type	Fixed Line ISP
ASN	AS14754
Hostname(s)	23.166.216.201.static.intelnet.net.gt
Domain Name	telgua.com.gt
Country	🇬🇹 Guatemala
City	Huehuetenango, Huehuetenango

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 201.216.166.23

Whois 201.216.166.23

IP Abuse Reports for 201.216.166.23:

This IP address has been reported a total of 13 times from 7 distinct sources. 201.216.166.23 was first reported on July 3rd 2026, and the most recent report was 7 hours ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇺🇸 TPI-Abuse	2026-07-11 22:15:57 (7 hours ago)	(mod_security) mod_security (id:240335) triggered by 201.216.166.23 (23.166.216.201.static.intelnet. ... show more (mod_security) mod_security (id:240335) triggered by 201.216.166.23 (23.166.216.201.static.intelnet.net.gt): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Jul 11 18:15:52.713001 2026] [security2:error] [pid 20252:tid 20267] [client 201.216.166.23:33418] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 201.216.166.23 (+1 hits since last alert)\|supercyprus.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "supercyprus.com"] [uri "/xmlrpc.php"] [unique_id "alLAmI6qlQ3KPJbm2s42zgAAAAg"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-07-11 20:47:25 (8 hours ago)	(mod_security) mod_security (id:240335) triggered by 201.216.166.23 (23.166.216.201.static.intelnet. ... show more (mod_security) mod_security (id:240335) triggered by 201.216.166.23 (23.166.216.201.static.intelnet.net.gt): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Jul 11 16:47:18.909073 2026] [security2:error] [pid 9756:tid 9756] [client 201.216.166.23:61742] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 201.216.166.23 (+1 hits since last alert)\|nextlevelcharge.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "nextlevelcharge.com"] [uri "/xmlrpc.php"] [unique_id "alKr1gymAtzn15FvEOI88QAAAAc"] show less	Brute-Force Bad Web Bot Web App Attack
🇩🇪 konseptit	2026-07-11 20:44:36 (8 hours ago)	(wordpress) Failed wordpress login from 201.216.166.23 (GT/Guatemala/23.166.216.201.static.intelnet. ... show more (wordpress) Failed wordpress login from 201.216.166.23 (GT/Guatemala/23.166.216.201.static.intelnet.net.gt) show less	Brute-Force
🇺🇸 TPI-Abuse	2026-07-11 19:15:22 (10 hours ago)	(mod_security) mod_security (id:240335) triggered by 201.216.166.23 (23.166.216.201.static.intelnet. ... show more (mod_security) mod_security (id:240335) triggered by 201.216.166.23 (23.166.216.201.static.intelnet.net.gt): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Jul 11 15:15:16.635365 2026] [security2:error] [pid 15397:tid 15397] [client 201.216.166.23:18925] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 201.216.166.23 (+1 hits since last alert)\|gracebaptisthartsville.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "gracebaptisthartsville.com"] [uri "/xmlrpc.php"] [unique_id "alKWRL1VTayaiBYecEoLkQAAAAA"] show less	Brute-Force Bad Web Bot Web App Attack
🇩🇪 rh24	2026-07-08 22:58:49 (3 days ago)	(wordpress) Failed wordpress login from 201.216.166.23 (GT/Guatemala/23.166.216.201.static.intelnet. ... show more (wordpress) Failed wordpress login from 201.216.166.23 (GT/Guatemala/23.166.216.201.static.intelnet.net.gt): (CF_ENABLE) show less	Brute-Force
🇺🇸 integrantservices.com	2026-07-08 22:23:57 (3 days ago)	(wordpress) Failed wordpress login from 201.216.166.23 (GT/Guatemala/23.166.216.201.static.intelnet. ... show more (wordpress) Failed wordpress login from 201.216.166.23 (GT/Guatemala/23.166.216.201.static.intelnet.net.gt) show less	Brute-Force
🇺🇸 TPI-Abuse	2026-07-08 21:54:17 (3 days ago)	(mod_security) mod_security (id:240335) triggered by 201.216.166.23 (23.166.216.201.static.intelnet. ... show more (mod_security) mod_security (id:240335) triggered by 201.216.166.23 (23.166.216.201.static.intelnet.net.gt): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jul 08 17:54:14.125215 2026] [security2:error] [pid 1254:tid 1254] [client 201.216.166.23:14343] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 201.216.166.23 (+1 hits since last alert)\|verdeprofundo.net\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "verdeprofundo.net"] [uri "/xmlrpc.php"] [unique_id "ak7HBk7WywU2S3wtX2Tk3QAAABE"] show less	Brute-Force Bad Web Bot Web App Attack
🇫🇷 dynamix	2026-07-08 21:52:29 (3 days ago)	WordPress XMLRPC Brute Force Attack	Brute-Force Web App Attack
🇺🇸 TPI-Abuse	2026-07-08 18:59:54 (3 days ago)	(mod_security) mod_security (id:240335) triggered by 201.216.166.23 (23.166.216.201.static.intelnet. ... show more (mod_security) mod_security (id:240335) triggered by 201.216.166.23 (23.166.216.201.static.intelnet.net.gt): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jul 08 14:59:48.918261 2026] [security2:error] [pid 15415:tid 15415] [client 201.216.166.23:54898] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 201.216.166.23 (+1 hits since last alert)\|pleaseaddbacon.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "pleaseaddbacon.com"] [uri "/xmlrpc.php"] [unique_id "ak6eJFGU5XvEr8HSzyaG8gAAABI"] show less	Brute-Force Bad Web Bot Web App Attack
Anonymous	2026-07-08 16:52:38 (3 days ago)	Attribution: mikhail-smirnov-79830323 (LinkedIn/profile ID) employed by Angara Technologies Group (E ... show more Attribution: mikhail-smirnov-79830323 (LinkedIn/profile ID) employed by Angara Technologies Group (Explicitly identified himself as enemy a week before attack began) \| Aggressive search filter manipulation / web scraper probe on port 443 \| URI: Excessive filters used: /brands.html?___SID=517434777e0cd3e6323319186368e31eU&electric_power=120-130&rating=6 \| UA: Opera/8.79.(Windows NT 5.0; fr-FR) Presto/2.9.169 Version/12.00 \| (Magento Site) show less	Hacking Bad Web Bot
🇪🇸 alferez	2026-07-04 00:11:20 (1 week ago)	xmlrpc.php attack DOS	Hacking Exploited Host Web App Attack
🇫🇷 dynamix	2026-07-03 22:50:21 (1 week ago)	WordPress XMLRPC Brute Force Attack	Brute-Force Web App Attack
🇺🇸 TPI-Abuse	2026-07-03 22:24:04 (1 week ago)	(mod_security) mod_security (id:240335) triggered by 201.216.166.23 (23.166.216.201.static.intelnet. ... show more (mod_security) mod_security (id:240335) triggered by 201.216.166.23 (23.166.216.201.static.intelnet.net.gt): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jul 03 18:23:57.929220 2026] [security2:error] [pid 18087:tid 18087] [client 201.216.166.23:49499] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 201.216.166.23 (+1 hits since last alert)\|hookedupfishing.net\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "hookedupfishing.net"] [uri "/xmlrpc.php"] [unique_id "akg2fRKbUdarkengdDLdkgAAAAM"] show less	Brute-Force Bad Web Bot Web App Attack

Showing 1 to 13 of 13 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇬🇧 31.14.254.71

🇰🇭 202.62.47.156

🇳🇱 193.176.31.208

🇩🇪 178.104.87.76

🇺🇸 167.172.149.71

🇰🇷 115.89.243.42

🇧🇩 103.205.36.205

🇧🇩 103.138.146.59

🇦🇺 65.254.93.170

🇸🇬 47.84.143.120

🇺🇸 45.79.153.51

🇵🇰 39.34.188.60

🇮🇩 36.78.222.206

🇺🇸 35.139.160.160

🇮🇷 217.218.250.79

🇺🇦 195.211.86.21

🇬🇧 195.96.139.121

🇧🇷 191.180.15.190

🇺🇸 173.239.214.78

🇨🇳 115.190.54.120