JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 67.180.123.221

67.180.123.221 was found in our database!

This IP was reported 96 times. Confidence of Abuse is 75%: ?

75%

ISP	Comcast Cable Communications, Inc
Usage Type	Fixed Line ISP
ASN	AS33651
Hostname(s)	c-67-180-123-221.hsd1.ca.comcast.net
Domain Name	comcast.net
Country	🇺🇸 United States of America
City	Salinas, California

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 67.180.123.221

Whois 67.180.123.221

IP Abuse Reports for 67.180.123.221:

This IP address has been reported a total of 96 times from 59 distinct sources. 67.180.123.221 was first reported on June 28th 2022, and the most recent report was 4 hours ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇳🇱 Site.eu	2026-07-18 22:12:14 (4 hours ago)	Repeated wp-login/xmlrpc attempts	Brute-Force SSH
🇺🇸 TPI-Abuse	2026-07-18 20:53:08 (6 hours ago)	(mod_security) mod_security (id:240335) triggered by 67.180.123.221 (c-67-180-123-221.hsd1.ca.comcas ... show more (mod_security) mod_security (id:240335) triggered by 67.180.123.221 (c-67-180-123-221.hsd1.ca.comcast.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Jul 18 16:53:02.262104 2026] [security2:error] [pid 2797451:tid 2797451] [client 67.180.123.221:59709] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 67.180.123.221 (+1 hits since last alert)\|esysapps.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "esysapps.com"] [uri "/xmlrpc.php"] [unique_id "alvnriu5CTAHMx9A6WBbzAAAAB4"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-07-18 19:49:42 (7 hours ago)	(mod_security) mod_security (id:240335) triggered by 67.180.123.221 (c-67-180-123-221.hsd1.ca.comcas ... show more (mod_security) mod_security (id:240335) triggered by 67.180.123.221 (c-67-180-123-221.hsd1.ca.comcast.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Jul 18 15:49:38.473338 2026] [security2:error] [pid 1375364:tid 1375364] [client 67.180.123.221:55599] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 67.180.123.221 (+1 hits since last alert)\|incrp.org\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "incrp.org"] [uri "/xmlrpc.php"] [unique_id "alvY0iDTqEUCObyCjDalHAAAAAE"] show less	Brute-Force Bad Web Bot Web App Attack
🇳🇱 ConsulHosting	2026-07-18 19:33:29 (7 hours ago)	Excessive failed CAPTCHA attempts (CAPTCHA DoS)	Web App Attack
🇺🇸 TPI-Abuse	2026-07-18 09:55:18 (17 hours ago)	(mod_security) mod_security (id:240335) triggered by 67.180.123.221 (c-67-180-123-221.hsd1.ca.comcas ... show more (mod_security) mod_security (id:240335) triggered by 67.180.123.221 (c-67-180-123-221.hsd1.ca.comcast.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Jul 18 05:55:12.870090 2026] [security2:error] [pid 497160:tid 497160] [client 67.180.123.221:51595] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 67.180.123.221 (+1 hits since last alert)\|rotentendales.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "rotentendales.com"] [uri "/xmlrpc.php"] [unique_id "altNgEXvJwHlx2MAaxM1YwAAABQ"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-07-18 05:51:12 (21 hours ago)	(mod_security) mod_security (id:240335) triggered by 67.180.123.221 (c-67-180-123-221.hsd1.ca.comcas ... show more (mod_security) mod_security (id:240335) triggered by 67.180.123.221 (c-67-180-123-221.hsd1.ca.comcast.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Jul 18 01:51:06.684507 2026] [security2:error] [pid 1472898:tid 1472898] [client 67.180.123.221:56662] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 67.180.123.221 (+1 hits since last alert)\|helloauto.net\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "helloauto.net"] [uri "/xmlrpc.php"] [unique_id "alsUSo8gfm28JevPcenrGgAAABE"] show less	Brute-Force Bad Web Bot Web App Attack
🇪🇸 alferez	2026-07-18 05:06:17 (21 hours ago)	xmlrpc.php attack DOS	Hacking Exploited Host Web App Attack
🇩🇪 konseptit	2026-07-18 04:47:57 (22 hours ago)	(wordpress) Failed wordpress login from 67.180.123.221 (US/United States/c-67-180-123-221.hsd1.ca.co ... show more (wordpress) Failed wordpress login from 67.180.123.221 (US/United States/c-67-180-123-221.hsd1.ca.comcast.net) show less	Brute-Force
🇫🇷 dynamix	2026-07-07 00:39:39 (1 week ago)	WordPress XMLRPC Brute Force Attack	Brute-Force Web App Attack
Anonymous	2026-07-06 23:59:49 (1 week ago)	Fail2Ban WordPress login brute-force detected	Brute-Force Web App Attack
🇺🇸 WeekendWeb	2026-07-06 22:26:17 (1 week ago)	Wordpress Vunerability attack	Web App Attack
🇮🇹 sssrit	2026-07-06 19:52:06 (1 week ago)	67.180.123.221 - - [06/Jul/2026:21:51:56 +0200] "POST /xmlrpc.php HTTP/1.1" 200 477 "-" "Jetpack by ... show more 67.180.123.221 - - [06/Jul/2026:21:51:56 +0200] "POST /xmlrpc.php HTTP/1.1" 200 477 "-" "Jetpack by WordPress.com (Jetpack 12.0; WordPress 6.2)" 67.180.123.221 - - [06/Jul/2026:21:52:05 +0200] "POST /xmlrpc.php HTTP/1.1" 200 477 "-" "Jetpack/12.1; WordPress/6.3; http://site43310860.com" ... show less	Web App Attack
🇺🇸 TPI-Abuse	2026-07-06 12:25:15 (1 week ago)	(mod_security) mod_security (id:240335) triggered by 67.180.123.221 (c-67-180-123-221.hsd1.ca.comcas ... show more (mod_security) mod_security (id:240335) triggered by 67.180.123.221 (c-67-180-123-221.hsd1.ca.comcast.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jul 06 08:25:08.109430 2026] [security2:error] [pid 6292:tid 6292] [client 67.180.123.221:55932] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5965"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 67.180.123.221 (+1 hits since last alert)\|whodatnation.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "whodatnation.com"] [uri "/xmlrpc.php"] [unique_id "akuepAyDCorgxsasjWHqewAAAAY"] show less	Brute-Force Bad Web Bot Web App Attack
🇦🇺 clapper	2026-07-06 09:47:29 (1 week ago)	(mod_security) mod_security (id:350202) triggered by 67.180.123.221 (US/United States/c-67-180-123-2 ... show more (mod_security) mod_security (id:350202) triggered by 67.180.123.221 (US/United States/c-67-180-123-221.hsd1.ca.comcast.net): 5 in the last 600 secs; ID: rub show less	Brute-Force Bad Web Bot
🇲🇹 Malta	2026-07-05 21:28:13 (1 week ago)	67.180.123.221 - - [05/Jul/2026:23:28:12 +0200] "POST /xmlrpc.php HTTP/1.1" "Jetpack by WordPress.co ... show more 67.180.123.221 - - [05/Jul/2026:23:28:12 +0200] "POST /xmlrpc.php HTTP/1.1" "Jetpack by WordPress.com (Jetpack 13.0; WordPress 6.3)" show less	Hacking Web App Attack

Showing 1 to 15 of 96 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇧🇷 205.210.31.251

🇬🇧 193.163.125.227

🇬🇧 192.248.150.180

🇺🇸 167.172.138.229

🇩🇪 167.94.145.19

🇺🇸 165.154.173.104

🇺🇸 161.35.230.3

🇵🇰 119.73.7.98

🇬🇧 89.37.172.131

🇳🇱 5.187.35.142

🇺🇸 2001:470:1:c84::1f9

🇧🇷 170.81.191.85

🇨🇳 112.231.92.115

🇳🇱 45.153.34.158

🇳🇱 45.148.10.183

🇺🇸 45.39.4.247

🇬🇧 35.203.211.192

🇺🇸 3.129.187.38

🇳🇱 209.38.39.197

🇨🇦 146.190.241.17