JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 58.255.237.166

58.255.237.166 was found in our database!

This IP was reported 9 times. Confidence of Abuse is 20%: ?

20%

ISP	China Unicom Guangdong province network
Usage Type	Fixed Line ISP
ASN	AS17816
Domain Name	chinaunicom.cn
Country	🇨🇳 China
City	Shanghai, Shanghai

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 58.255.237.166

Whois 58.255.237.166

IP Abuse Reports for 58.255.237.166:

This IP address has been reported a total of 9 times from 3 distinct sources. 58.255.237.166 was first reported on September 16th 2023, and the most recent report was 8 hours ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇦🇺 paulshipley.com.au	2026-06-21 00:11:18 (8 hours ago)	[Sun Jun 21 10:11:17.851539 2026] [security2:error] [pid 858729] [client 58.255.237.166:4425] [clien ... show more [Sun Jun 21 10:11:17.851539 2026] [security2:error] [pid 858729] [client 58.255.237.166:4425] [client 58.255.237.166] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/modsecurity/crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.4"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "levellapromotions.com.au"] [uri "/"] [unique_id "ajcsJQh28-7iwHQRq82KpAAAACc"], referer: https://levellapromotions.com.au/ ... show less	Web App Attack
🇺🇸 TPI-Abuse	2026-06-19 22:07:02 (1 day ago)	(mod_security) mod_security (id:210831) triggered by 58.255.237.166 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210831) triggered by 58.255.237.166 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jun 19 18:06:56.718881 2026] [security2:error] [pid 27309:tid 27309] [client 58.255.237.166:4828] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url\|user-Agent\|www\\\\.weblogs\\\\.com\|(?:jakart\|vi)a\|(google\|i{0,1}explorer{0,1}\\\\.exe\|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)\|\\\\bdatacha0s\\\\b\|; widows\|\\\\\\\\r\|a(?: href=\|d(?:sarobot\|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler\|\|www.tulsatvmemories.com\|F\|4"] [data "User-Agent"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "www.tulsatvmemories.com"] [uri "/"] [unique_id "ajW9gOQaiHa_3A2zh3gQrwAAAAo"], referer: http://www.tulsatvmemories.com/ show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-06-18 19:49:32 (2 days ago)	(mod_security) mod_security (id:210831) triggered by 58.255.237.166 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210831) triggered by 58.255.237.166 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jun 18 15:49:26.292117 2026] [security2:error] [pid 29874:tid 29874] [client 58.255.237.166:5018] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url\|user-Agent\|www\\\\.weblogs\\\\.com\|(?:jakart\|vi)a\|(google\|i{0,1}explorer{0,1}\\\\.exe\|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)\|\\\\bdatacha0s\\\\b\|; widows\|\\\\\\\\r\|a(?: href=\|d(?:sarobot\|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler\|\|compassionfatigue.org\|F\|4"] [data "User-Agent"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "compassionfatigue.org"] [uri "/"] [unique_id "ajRLxspM5mkwr13CHYXgAAAAABk"], referer: http://compassionfatigue.org/ show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-05-13 19:03:09 (1 month ago)	(mod_security) mod_security (id:210831) triggered by 58.255.237.166 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210831) triggered by 58.255.237.166 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed May 13 15:03:00.362740 2026] [security2:error] [pid 8641:tid 8641] [client 58.255.237.166:8078] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url\|user-Agent\|www\\\\.weblogs\\\\.com\|(?:jakart\|vi)a\|(google\|i{0,1}explorer{0,1}\\\\.exe\|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)\|\\\\bdatacha0s\\\\b\|; widows\|\\\\\\\\r\|a(?: href=\|d(?:sarobot\|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler\|\|andrewmcgrath.com\|F\|4"] [data "User-Agent"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "andrewmcgrath.com"] [uri "/index.html"] [unique_id "agTK5E_QrqYJUBi2Ea3BNAAAABI"], referer: http://andrewmcgrath.com/index.html show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-05-12 20:49:31 (1 month ago)	(mod_security) mod_security (id:210831) triggered by 58.255.237.166 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210831) triggered by 58.255.237.166 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue May 12 16:49:27.370218 2026] [security2:error] [pid 10810:tid 10829] [client 58.255.237.166:7461] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url\|user-Agent\|www\\\\.weblogs\\\\.com\|(?:jakart\|vi)a\|(google\|i{0,1}explorer{0,1}\\\\.exe\|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)\|\\\\bdatacha0s\\\\b\|; widows\|\\\\\\\\r\|a(?: href=\|d(?:sarobot\|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler\|\|www.credit-card-cap.com\|F\|4"] [data "User-Agent"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "www.credit-card-cap.com"] [uri "/"] [unique_id "agOSV-2S6qHqbGO-w-5hhQAAAVA"], referer: https://www.credit-card-cap.com/ show less	Brute-Force Bad Web Bot Web App Attack
🇨🇳 ThreatBook.io	2026-05-10 00:34:47 (1 month ago)	ThreatBook Intelligence: Zombie,Spam more details on https://threatbook.io/ip/58.255.237.166 2026-05 ... show more ThreatBook Intelligence: Zombie,Spam more details on https://threatbook.io/ip/58.255.237.166 2026-05-09 18:46:17 /static/img/facio.ico show less	Web App Attack
🇨🇳 ThreatBook.io	2025-12-20 00:31:30 (6 months ago)	ThreatBook Intelligence: Zombie,Spam more details on https://threatbook.io/ip/58.255.237.166 2025-12 ... show more ThreatBook Intelligence: Zombie,Spam more details on https://threatbook.io/ip/58.255.237.166 2025-12-19 06:02:25 /img/favicon.ico show less	Web App Attack
🇨🇳 ThreatBook.io	2025-12-18 00:17:01 (6 months ago)	ThreatBook Intelligence: Zombie,Spam more details on https://threatbook.io/ip/58.255.237.166 2025-12 ... show more ThreatBook Intelligence: Zombie,Spam more details on https://threatbook.io/ip/58.255.237.166 2025-12-17 09:08:09 /sitemap.xml show less	Web App Attack
🇨🇳 ThreatBook.io	2023-09-16 01:54:17 (2 years ago)	ThreatBook Intelligence: Dynamic IP more details on http://threatbook.io/ip/58.255.237.166 2023-09-1 ... show more ThreatBook Intelligence: Dynamic IP more details on http://threatbook.io/ip/58.255.237.166 2023-09-15 11:31:14 /get?url=aHR0cDovL3d3dy5oZXNoYW4uZ292LmNuL3p3Z2sveHhnay9oc3NybHp5aHNoYnpqL3F0L2tsenAvY29udGVudC9wb3N0XzI4NzI0NDcuaHRtbA== 2023-09-15 09:19:31 /get?url=aHR0cDovL3d3dy5oZXNoYW4uZ292LmNuL3p3Z2sveHhnay9oc3NqeWovZ3pkdC90emdnL2NvbnRlbnQvcG9zdF8yODg3MjY4Lmh0bWw= 2023-09-15 11:50:14 /get?url=aHR0cDovL3d3dy5oZXNoYW4uZ292LmNuL3p3Z2sveHhnay9oc3NybHp5aHNoYnpqL3F0L2tsenAvY29udGVudC9wb3N0XzI4NTQwMjQuaHRtbA== 2023-09-15 09:22:12 /get?url=aHR0cDovL3d3dy5oZXNoYW4uZ292LmNuL3p3Z2sveHhnay9oc3NybHp5aHNoYnpqL3F0L2tsenAvY29udGVudC9wb3N0XzI4OTY3NDUuaHRtbA== 2023-09-15 09:15:04 /get?url=aHR0cDovL3d3dy5oZXNoYW4uZ292LmNuL3p3Z2sveHhnay9oc3NqeWovZ3pkdC90emdnL2NvbnRlbnQvcG9zdF8yODU0MjEzLmh0bWw= show less	Web App Attack

Showing 1 to 9 of 9 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇮🇳 2401:4900:8927:262a:bde0:5266:a1f3:97e7

🇮🇳 2401:4900:88f4:c0e:539:f498:c5d3:47d5

🇧🇷 177.92.255.198

🇺🇸 134.199.231.220

🇮🇳 103.240.233.151

🇮🇳 103.108.4.98

🇺🇸 66.132.195.104

🇺🇸 40.124.175.29

🇮🇩 34.128.77.56

🇷🇺 31.177.110.228

🇺🇸 172.104.5.239

🇫🇷 167.86.75.114

🇺🇸 155.103.69.40

🇺🇸 148.153.139.140

🇨🇦 146.190.255.215

🇧🇷 131.108.51.92

🇨🇳 121.237.11.60

🇺🇸 107.170.40.174

🇨🇳 106.58.220.34

🇵🇱 89.68.245.7