JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 67.43.12.67

67.43.12.67 was found in our database!

This IP was reported 639 times. Confidence of Abuse is 100%: ?

100%

ISP	Liquid Web, L.L.C
Usage Type	Data Center/Web Hosting/Transit
ASN	AS32244
Hostname(s)	host.ellingtongroup.com
Domain Name	liquidweb.com
Country	🇺🇸 United States of America
City	Lansing, Michigan

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 67.43.12.67

Whois 67.43.12.67

IP Abuse Reports for 67.43.12.67:

This IP address has been reported a total of 639 times from 202 distinct sources. 67.43.12.67 was first reported on February 14th 2025, and the most recent report was 1 hour ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇺🇸 oralunal	2026-07-11 09:42:48 (1 hour ago)	IP banned by Fail2Ban in jail oral-suss access.log mvfnds ...	Bad Web Bot Web App Attack
🇫🇷 Yepngo	2026-07-11 09:04:51 (1 hour ago)	67.43.12.67 - - [11/Jul/2026:11:04:51 +0200] "POST /wp-login.php HTTP/2.0" 200 11374 "https://dev.ye ... show more 67.43.12.67 - - [11/Jul/2026:11:04:51 +0200] "POST /wp-login.php HTTP/2.0" 200 11374 "https://dev.yepngo.com/wp-login.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36" ... show less	Brute-Force Web App Attack
🇺🇸 TPI-Abuse	2026-07-11 08:34:58 (2 hours ago)	(mod_security) mod_security (id:225170) triggered by 67.43.12.67 (host.ellingtongroup.com): 1 in the ... show more (mod_security) mod_security (id:225170) triggered by 67.43.12.67 (host.ellingtongroup.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Jul 11 04:34:53.564952 2026] [security2:error] [pid 29536:tid 29536] [client 67.43.12.67:39490] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)\|\|www.webseographics.smogsandiego.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "www.webseographics.smogsandiego.com"] [uri "/wp-json/wp/v2/users/me"] [unique_id "alIALeCI47eImrUKfTvWkAAAAAU"] show less	Brute-Force Bad Web Bot Web App Attack
🇩🇪 Marc	2026-07-11 08:30:35 (2 hours ago)	67.43.12.67 - - [11/Jul/2026:09:53:34 +0200] "GET /wp-login.php HTTP/2.0" 200 3929 "-" "Mozilla/5.0 ... show more 67.43.12.67 - - [11/Jul/2026:09:53:34 +0200] "GET /wp-login.php HTTP/2.0" 200 3929 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36" 67.43.12.67 - - [11/Jul/2026:10:01:12 +0200] "GET /wp-login.php HTTP/2.0" 200 3460 "https://als-arnsberg.de/wp-login.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36" 67.43.12.67 - - [11/Jul/2026:10:01:13 +0200] "GET /wp-login.php HTTP/2.0" 200 3156 "https://als-arnsberg.de/wp-login.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36" 67.43.12.67 - - [11/Jul/2026:10:30:34 +0200] "GET /wp-login.php HTTP/2.0" 200 3905 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36" 67.43.12.67 - - [11/Jul/2026:10:30:35 +0200] "POST /wp-login.php HTTP/2.0" 403 10826 "https://saatschule.de/wp-login.php" "Mozilla/5.0 (Windows NT 10. show less	Brute-Force Web App Attack
🇩🇰 ScamAware	2026-07-11 08:04:50 (2 hours ago)	Detected by Cloudflare Security Events via WordPress automation. Detection: user_enumeration (WordPr ... show more Detected by Cloudflare Security Events via WordPress automation. Detection: user_enumeration (WordPress user enumeration). Hits from same IP in last 60 minutes: 1. Unique request paths counted internally: 1. Cloudflare action: block. Cloudflare source: firewallCustom. show less	Brute-Force Web App Attack
Anonymous	2026-07-11 08:01:10 (2 hours ago)	(PERMBLOCK) 67.43.12.67 (US/United States/host.ellingtongroup.com) has had more than 4 temp blocks	Hacking
🇩🇪 F242	2026-07-11 08:00:38 (2 hours ago)	Wordpress Login or XMLRPC abuse	Web App Attack
🇪🇸 SweetHoneyPress	2026-07-11 07:57:47 (2 hours ago)	WordPress honeypot: POST to /xmlrpc.php \| event_id=1027047 \| UA: Mozilla/5.0 (Windows NT 10.0; Win64 ... show more WordPress honeypot: POST to /xmlrpc.php \| event_id=1027047 \| UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36 show less	Web App Attack Brute-Force
🇬🇧 Mendip_Defender	2026-07-11 07:28:37 (3 hours ago)	67.43.12.67 - - [11/Jul/2026:08:28:26 +0100] "GET /wp-login.php HTTP/1.1" 200 7829 "https://wessex4x ... show more 67.43.12.67 - - [11/Jul/2026:08:28:26 +0100] "GET /wp-login.php HTTP/1.1" 200 7829 "https://wessex4x4response.org.uk/wp-login.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36" 67.43.12.67 - - [11/Jul/2026:08:28:27 +0100] "GET /wp-login.php HTTP/1.1" 200 7829 "https://wessex4x4response.org.uk/wp-login.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36" ... show less	Brute-Force
🇺🇸 TPI-Abuse	2026-07-11 07:12:18 (3 hours ago)	(mod_security) mod_security (id:225170) triggered by 67.43.12.67 (host.ellingtongroup.com): 1 in the ... show more (mod_security) mod_security (id:225170) triggered by 67.43.12.67 (host.ellingtongroup.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Jul 11 03:12:10.797022 2026] [security2:error] [pid 20658:tid 20658] [client 67.43.12.67:38950] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)\|\|dev.jazziientertainment.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "dev.jazziientertainment.com"] [uri "/wp-json/wp/v2/users/me"] [unique_id "alHsynUdnNbV-51BqHDiiAAAAAE"] show less	Brute-Force Bad Web Bot Web App Attack
Anonymous	2026-07-11 07:10:14 (3 hours ago)	[Sat Jul 11 09:10:12.875026 2026] [authz_core:error] [pid 1962:tid 2138] [client 67.43.12.67:58214] ... show more [Sat Jul 11 09:10:12.875026 2026] [authz_core:error] [pid 1962:tid 2138] [client 67.43.12.67:58214] AH01630: client denied by server configuration: /var/www/cimt-precision/wp-login.php ... show less	Brute-Force Web App Attack
🇺🇸 etu brutus	2026-07-11 06:55:55 (3 hours ago)	67.43.12.67 Blocked by [Attack Vector List] ...	Hacking Brute-Force Exploited Host
🇹🇷 ycoskun41	2026-07-11 06:48:45 (3 hours ago)	fail2ban: plesk-modsecurity jail on genckocaeli.com	Web App Attack
🇫🇷 Kenshin869	2026-07-11 06:43:54 (3 hours ago)	Wordpress unauthorized access attempt	Brute-Force
🇺🇸 TPI-Abuse	2026-07-11 06:36:05 (4 hours ago)	(mod_security) mod_security (id:225170) triggered by 67.43.12.67 (host.ellingtongroup.com): 1 in the ... show more (mod_security) mod_security (id:225170) triggered by 67.43.12.67 (host.ellingtongroup.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Jul 11 02:36:01.114715 2026] [security2:error] [pid 22890:tid 22890] [client 67.43.12.67:45974] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)\|\|starcrestsales.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "starcrestsales.com"] [uri "/wp-json/wp/v2/users/me"] [unique_id "alHkUZ5_1WINggkfXAqsaQAAAA0"] show less	Brute-Force Bad Web Bot Web App Attack

Showing 1 to 15 of 639 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇺🇸 2607:f8b0:4004:1000::121

🇺🇸 2600:1f28:365:80b0:f8a4:e764:d6bb:8e66

🇩🇪 213.209.159.225

🇺🇸 142.93.80.248

🇹🇷 94.154.43.230

🇨🇳 60.162.28.14

🇺🇸 49.51.72.129

🇵🇱 176.53.159.198

🇮🇳 122.185.44.206

🇳🇱 46.151.178.13

🇳🇱 45.148.10.152

🇺🇸 45.92.229.24

🇺🇸 44.229.83.213

🇬🇧 194.50.235.131

🇸🇬 68.183.236.1

🇺🇸 65.49.1.78

🇹🇼 61.221.52.10

🇺🇸 44.35.238.142

🇸🇬 8.219.165.42

🇺🇸 216.25.89.73