JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 103.116.49.116

103.116.49.116 was found in our database!

This IP was reported 18 times. Confidence of Abuse is 50%: ?

50%

ISP	PT Arsya Media Data Group
Usage Type	Fixed Line ISP
ASN	AS136873
Domain Name	arsyamediadata.net
Country	🇮🇩 Indonesia
City	Wonosobo, Central Java

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 103.116.49.116

Whois 103.116.49.116

IP Abuse Reports for 103.116.49.116:

This IP address has been reported a total of 18 times from 13 distinct sources. 103.116.49.116 was first reported on June 2nd 2026, and the most recent report was 12 hours ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇫🇷 masterguru	2026-10-22 03:20:46 (12 hours ago)	WordPress: User enumeration. Pattern match "(author\\\\= (88030-197)	Hacking
🇩🇰 ScamAware	2026-10-21 13:37:35 (1 day ago)	Detected by Cloudflare Security Events via WordPress automation. Detection: user_enumeration (WordPr ... show more Detected by Cloudflare Security Events via WordPress automation. Detection: user_enumeration (WordPress user enumeration). Hits from same IP in last 60 minutes: 1. Unique request paths counted internally: 1. Cloudflare action: block. Cloudflare source: firewallCustom. show less	Brute-Force Web App Attack
🇩🇪 LRob	2026-10-20 02:24:42 (2 days ago)	WordPress attack-tool calls \| method: POST \| path: /xmlrpc.php \| ua: Mozilla/5.0 (Macintosh; Intel M ... show more WordPress attack-tool calls \| method: POST \| path: /xmlrpc.php \| ua: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36 show less	Web App Attack Hacking
🇲🇹 Malta	2026-10-20 02:22:24 (2 days ago)	103.116.49.116 - - [20/Oct/2026:04:22:24 +0200] "POST /wp-login.php HTTP/1.1" "Mozilla/5.0 (Windows ... show more 103.116.49.116 - - [20/Oct/2026:04:22:24 +0200] "POST /wp-login.php HTTP/1.1" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36" Brute-force password attempt show less	Hacking Web App Attack Brute-Force
Anonymous	2026-10-18 08:31:55 (4 days ago)	Attempt to POST to xmlrpc.php at 2026-10-18T08:31:55+00:00	Brute-Force Web App Attack
🇺🇸 TPI-Abuse	2026-10-17 04:03:04 (5 days ago)	(mod_security) mod_security (id:225170) triggered by 103.116.49.116 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:225170) triggered by 103.116.49.116 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 17 00:02:56.872920 2026] [security2:error] [pid 9962:tid 9962] [client 103.116.49.116:50166] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)\|\|trinitydent.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "trinitydent.com"] [uri "/wp-json/wp/v2/users/me"] [unique_id "atLzcEbTSC32UtX-A64-ZwAAAAM"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 mnsf	2026-10-15 00:05:54 (1 week ago)	Too many Status 40X (11)	Brute-Force Web App Attack
🇺🇸 TPI-Abuse	2026-10-14 23:32:31 (1 week ago)	(mod_security) mod_security (id:225170) triggered by 103.116.49.116 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:225170) triggered by 103.116.49.116 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 14 19:32:23.679499 2026] [security2:error] [pid 23774:tid 23774] [client 103.116.49.116:59982] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)\|\|fantasyfootballing.chavarri.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "fantasyfootballing.chavarri.com"] [uri "/wp-json/wp/v2/users/me"] [unique_id "atARB6o1Wf6rW0Ytk4UQPQAAABk"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-10-14 14:16:11 (1 week ago)	(mod_security) mod_security (id:225170) triggered by 103.116.49.116 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:225170) triggered by 103.116.49.116 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 14 10:16:07.652511 2026] [security2:error] [pid 6123:tid 6123] [client 103.116.49.116:55306] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)\|\|crittergetterpestcontrol.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "crittergetterpestcontrol.com"] [uri "/wp-json/wp/v2/users"] [unique_id "as-Op0XOCAeKD0lWgF8HUwAAAAg"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-10-14 05:16:31 (1 week ago)	(mod_security) mod_security (id:225170) triggered by 103.116.49.116 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:225170) triggered by 103.116.49.116 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 14 01:16:23.746319 2026] [security2:error] [pid 17177:tid 17177] [client 103.116.49.116:59686] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)\|\|lambert-heating-and-air.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "lambert-heating-and-air.com"] [uri "/wp-json/wp/v2/users/me"] [unique_id "as8QJ3f824ohZ2kKqDl6CQAAAAI"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-10-13 08:27:23 (1 week ago)	(mod_security) mod_security (id:225170) triggered by 103.116.49.116 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:225170) triggered by 103.116.49.116 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 13 04:27:17.632861 2026] [security2:error] [pid 31003:tid 31003] [client 103.116.49.116:33248] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)\|\|thefrontporchoffering.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "thefrontporchoffering.com"] [uri "/wp-json/wp/v2/users/me"] [unique_id "as3rZfQQr1to4xH3H9sf6AAAABA"] show less	Brute-Force Bad Web Bot Web App Attack
Anonymous	2026-08-26 04:50:18 (1 month ago)	\| [Dangerous/Indonesia] Aggressive IP 103.116.49.116 (~30 hits). Type: DoS Defender- Web server 400 ... show more \| [Dangerous/Indonesia] Aggressive IP 103.116.49.116 (~30 hits). Type: DoS Defender- Web server 400 error code show less	Web App Attack Hacking SQL Injection
🇺🇸 kosada.com	2026-08-25 07:41:09 (1 month ago)	Web bot: denial-of-service flood	DDoS Attack Bad Web Bot
🇫🇷 Tilellit.PRO	2026-08-07 12:34:55 (2 months ago)	WooCommerce YITH AJAX Filder product_cat filter flood attempt with taxonomies	DDoS Attack Bad Web Bot
🇳🇱 DrLex0	2026-07-15 14:55:39 (3 months ago)	BnL006: Obvious dumb distributed botnet crawler stepping into honeypot trap despite it clearly being ... show more BnL006: Obvious dumb distributed botnet crawler stepping into honeypot trap despite it clearly being a burning bag of dog poop. 103.116.49.116 443 - [15/Jul/2026:14:55:39 +0000] "GET [redacted] HTTP/1.1" 503 6141 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36" show less	Bad Web Bot Exploited Host

Showing 1 to 15 of 18 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇬🇧 200.138.46.201

🇧🇷 177.126.90.4

🇺🇸 146.70.172.38

🇮🇳 103.69.10.90

🇩🇪 93.241.232.14

🇹🇷 88.228.64.165

🇸🇦 79.170.53.30

🇮🇳 223.184.176.179

🇰🇿 185.206.32.100

🇩🇪 167.94.145.16

🇺🇸 147.185.132.211

🇺🇸 98.46.110.224

🇮🇱 37.142.147.59

🇧🇪 34.78.214.62

🇳🇱 2a02:a46a:6be3:0:edf7:a9f7:2a2:2efa

🇺🇸 216.180.246.227

🇧🇷 177.172.67.177

🇺🇸 172.208.106.233

🇺🇸 136.69.198.59

🇹🇼 111.70.3.106