JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 201.69.148.159

201.69.148.159 was found in our database!

This IP was reported 12 times. Confidence of Abuse is 55%: ?

55%

ISP	TELEFÔNICA BRASIL S.A
Usage Type	Fixed Line ISP
ASN	AS27699
Hostname(s)	201-69-148-159.dial-up.telesp.net.br
Domain Name	telefonica.com.br
Country	🇧🇷 Brazil
City	Sao Paulo, Sao Paulo

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 201.69.148.159

Whois 201.69.148.159

IP Abuse Reports for 201.69.148.159:

This IP address has been reported a total of 12 times from 10 distinct sources. 201.69.148.159 was first reported on October 2nd 2023, and the most recent report was 55 minutes ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇫🇷 Kenshin869	2026-06-24 03:02:39 (55 minutes ago)	Wordpress unauthorized access attempt	Brute-Force
🇺🇸 nationaleventpros.com	2026-06-24 02:48:46 (1 hour ago)	WordPress login attempt	Brute-Force
🇺🇸 TPI-Abuse	2026-06-23 05:39:30 (22 hours ago)	(mod_security) mod_security (id:225170) triggered by 201.69.148.159 (201-69-148-159.dial-up.telesp.n ... show more (mod_security) mod_security (id:225170) triggered by 201.69.148.159 (201-69-148-159.dial-up.telesp.net.br): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jun 23 01:39:24.983028 2026] [security2:error] [pid 12786:tid 12786] [client 201.69.148.159:50381] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)\|\|realclean.net\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "realclean.net"] [uri "/wp-json/wp/v2/users"] [unique_id "ajocDGcQ0hMZjU4o0mM-GgAAABI"] show less	Brute-Force Bad Web Bot Web App Attack
🇫🇮 stinpriza	2026-06-22 03:07:27 (2 days ago)	Web App Attack	Web App Attack
🇩🇪 4server	2026-06-22 03:00:08 (2 days ago)	[MonJun2205:00:06.7203312026][security2:error][pid1362735:tid1362754][client201.69.148.159:0]ModSecu ... show more [MonJun2205:00:06.7203312026][security2:error][pid1362735:tid1362754][client201.69.148.159:0]ModSecurity:Accessdeniedwithcode403\(phase1\).Stringmatch\"/xmlrpc.php\"atREQUEST_URI.[file\"/etc/apache2/conf.d/modsec_custom_rules.conf\"][line\"170\"][id\"960024\"][msg\"XML-RPCdisabled\"][hostname\"chryptofarm.ch\"][uri\"/xmlrpc.php\"][unique_id\"ajilNpX6WTT87FScGC72TwAAANA\"] show less	Port Scan Brute-Force Web App Attack
🇩🇪 big-cloud.nl	2026-06-20 16:39:16 (3 days ago)	Try to access /xmlrpc.php	Web App Attack
🇨🇭 4server	2026-06-20 03:19:42 (4 days ago)	[SatJun2005:19:36.2107302026][security2:error][pid2123836:tid2124120][client201.69.148.159:0]ModSecu ... show more [SatJun2005:19:36.2107302026][security2:error][pid2123836:tid2124120][client201.69.148.159:0]ModSecurity:Accessdeniedwithcode403\(phase1\).Stringmatch\"/xmlrpc.php\"atREQUEST_URI.[file\"/etc/apache2/conf.d/modsec_custom_rules.conf\"][line\"368\"][id\"960024\"][msg\"XML-RPCdisabled\"][hostname\"ristrutturazione-case.ch\"][uri\"/xmlrpc.php\"][unique_id\"ajYGyFl9saM9drpgGMF5KwAAAQM\"] show less	Hacking Web App Attack
🇮🇹 VHosting	2026-06-20 03:05:03 (4 days ago)	Detected WordPress attack from 4 different servers	Brute-Force Web App Attack
🇺🇸 TPI-Abuse	2026-06-19 07:01:47 (4 days ago)	(mod_security) mod_security (id:225170) triggered by 201.69.148.159 (201-69-148-159.dial-up.telesp.n ... show more (mod_security) mod_security (id:225170) triggered by 201.69.148.159 (201-69-148-159.dial-up.telesp.net.br): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jun 19 03:01:39.677195 2026] [security2:error] [pid 21056:tid 21056] [client 201.69.148.159:62604] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)\|\|nextlevelcharge.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "nextlevelcharge.com"] [uri "/wp-json/wp/v2/users"] [unique_id "ajTpU_QG6EBMht2BSCP-zgAAAAQ"] show less	Brute-Force Bad Web Bot Web App Attack
🇩🇪 pscriptos	2026-06-19 06:09:11 (4 days ago)	{"ClientAddr":"201.69.148.159:63840","ClientHost":"201.69.148.159","ClientPort":"63840","ClientUsern ... show more {"ClientAddr":"201.69.148.159:63840","ClientHost":"201.69.148.159","ClientPort":"63840","ClientUsername":"-","DownstreamContentSize":418,"DownstreamStatus":403,"Duration":153524280,"OriginContentSize":418,"OriginDuration":149884589,"OriginStatus":403,"Overhead":3639691,"RequestAddr":"www.cleveradmin.de","RequestContentSize":680,"RequestCount":621203,"RequestHost":"www.cleveradmin.de","RequestMethod":"POST","RequestPath":"/xmlrpc.php","RequestPort":"-","RequestProtocol":"HTTP/1.1","RequestScheme":"https","RetryAttempts":0,"RouterName":"cleveradmin-www-websecure@file","ServiceAddr":"172.16.80.10:80","ServiceName":"cleveradmin-www@file","ServiceURL":"http://172.16.80.10:80","StartLocal":"2026-06-19T08:05:34.304893499+02:00","StartUTC":"2026-06-19T06:05:34.304893499Z","TLSCipher":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","TLSVersion":"1.2","entryPointName":"websecure","level":"info","msg":"","time":"2026-06-19T08:05:34+02:00"} {"ClientAddr":"201.69.148.159:65148","ClientHost":"201.69.148.159 ... show less	Brute-Force Web App Attack
🇳🇱 Roderic	2023-10-04 08:13:59 (2 years ago)	201.69.148.159 (BR/Brazil/201-69-148-159.dial-up.telesp.net.br), 3 distributed sshd attacks on accou ... show more 201.69.148.159 (BR/Brazil/201-69-148-159.dial-up.telesp.net.br), 3 distributed sshd attacks on account [redacted] show less	Brute-Force SSH
🇺🇸 MPL	2023-10-02 20:27:00 (2 years ago)	tcp/22 (6 or more attempts)	Port Scan

Showing 1 to 12 of 12 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇭🇰 199.45.155.73

🇩🇪 193.124.20.253

🇧🇷 192.141.106.229

🇬🇧 35.203.211.179

🇺🇸 24.199.84.251

🇳🇱 176.65.139.181

🇫🇮 147.185.133.166

🇰🇷 121.186.9.58

🇮🇩 103.168.29.186

🇳🇱 91.92.40.204

🇨🇳 58.19.78.136

🇨🇳 36.106.167.128

🇬🇧 35.203.210.76

🇺🇸 34.186.159.34

🇩🇪 8.211.8.52

🇨🇳 1.83.125.185

🇧🇷 205.210.31.220

🇮🇩 202.47.73.10

🇨🇳 183.184.53.77

🇨🇦 172.70.80.209