JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 103.120.70.137

103.120.70.137 was found in our database!

This IP was reported 10 times. Confidence of Abuse is 33%: ?

33%

ISP	TElCOMASTERS PVT. LTD.
Usage Type	Fixed Line ISP
ASN	AS137047
Hostname(s)	delta.yyii.telcomaster.com
Domain Name	telcomaster.com
Country	🇵🇰 Pakistan
City	Gujranwala, Punjab

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 103.120.70.137

Whois 103.120.70.137

IP Abuse Reports for 103.120.70.137:

This IP address has been reported a total of 10 times from 7 distinct sources. 103.120.70.137 was first reported on May 27th 2026, and the most recent report was 3 hours ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇺🇸 TPI-Abuse	2026-09-18 18:19:25 (3 hours ago)	(mod_security) mod_security (id:210350) triggered by 103.120.70.137 (delta.yyii.telcomaster.com): 1 ... show more (mod_security) mod_security (id:210350) triggered by 103.120.70.137 (delta.yyii.telcomaster.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Sep 18 14:19:19.191248 2026] [security2:error] [pid 8741:tid 8741] [client 103.120.70.137:43994] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close\|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close\|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found\|\|stat-alliance.com\|F\|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "stat-alliance.com"] [uri "/"] [unique_id "aq2Ap0lFWXtQ_dUu9PicRQAAAA4"], referer: https://bulkbacklinkanalysis.store/dir/seo-boosting-backlinks-197636 show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 ipblock.com	2026-09-11 22:33:00 (6 days ago)	IPBlock protected site ID [4055-d][s=06]. Persistent 404, vulnerability scanner	Hacking Bad Web Bot Web App Attack
🇺🇸 kosada.com	2026-09-10 08:21:54 (1 week ago)	Repeated requests classified as pathological web bot behavior, for example: /search?f%5B0%5D=key_ter ... show more Repeated requests classified as pathological web bot behavior, for example: /search?f%5B0%5D=key_terms%3A308&f%5B10%5D=key_terms%3A543&f%5B1%5D=key_terms%3A312&f%5B2%5D=key_terms%3A318&f%5B3%5D=key_terms%3A325&f%5B4%5D=key_terms%3A507&f%5B5%5D=key_terms%3A517&f%5B6%5D=key_terms%3A519&f%5B7%5D=key_terms%3A522&f%5B8%5D=key_terms%3A524&f%5B9%5D=key_terms%3A525 (HTTP/2.0 port 443, user agent: "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36") show less	DDoS Attack Bad Web Bot
🇫🇷 LRob	2026-09-04 12:25:31 (2 weeks ago)	Malicious web request: probing for secrets, traversal or a known exploit path \| method: POST \| path: ... show more Malicious web request: probing for secrets, traversal or a known exploit path \| method: POST \| path: /xmlrpc.php \| ua: WordPress/5.0; https://terageek.org \| 2026-09-04 12:25 UTC show less	Hacking Web App Attack
🇺🇸 gui-ying233	2026-08-29 12:31:30 (2 weeks ago)	Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0. ... show more Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 show less	Bad Web Bot
🇺🇸 gui-ying233	2026-08-27 07:11:18 (3 weeks ago)	Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Sa ... show more Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36 Edg/144.0.0.0 show less	Bad Web Bot
🇺🇸 kosada.com	2026-06-29 12:26:30 (2 months ago)	Web bot: denial-of-service flood	DDoS Attack Bad Web Bot
🇸🇮 extremevital	2026-06-26 16:50:07 (2 months ago)	...	Bad Web Bot
🇺🇸 TPI-Abuse	2026-06-22 09:52:10 (2 months ago)	(mod_security) mod_security (id:210730) triggered by 103.120.70.137 (delta.yyii.telcomaster.com): 1 ... show more (mod_security) mod_security (id:210730) triggered by 103.120.70.137 (delta.yyii.telcomaster.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jun 22 05:52:01.323639 2026] [security2:error] [pid 10887:tid 10887] [client 103.120.70.137:55340] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy\|\|timberwolf-construction.com\|F\|2"] [data ".com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "timberwolf-construction.com"] [uri "/mail to: [email protected]"] [unique_id "ajkFwY7jHce6WTdDoULR8wAAAAk"] show less	Brute-Force Bad Web Bot Web App Attack
🇩🇪 SMARTNET	2026-05-27 06:03:53 (3 months ago)	Aisuru(Mirai variant) DDoS \| Incident ID: 1175168a-7e6d-467e-bb9a-dd1cdfa3fb9e	DDoS Attack

Showing 1 to 10 of 10 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇨🇳 223.96.234.187

🇺🇸 159.223.158.149

🇺🇸 147.185.132.13

🇮🇳 66.116.251.11

🇲🇽 187.188.40.106

🇬🇧 185.247.137.156

🇮🇩 103.95.40.58

🇫🇷 91.196.152.124

🇳🇱 89.248.172.11

🇳🇱 45.198.224.140

🇺🇸 15.218.129.235

🇺🇸 217.177.128.229

🇹🇼 198.235.24.57

🇬🇧 195.96.139.52

🇺🇸 138.197.203.15

🇩🇪 107.150.117.219

🇺🇸 45.61.187.220

🇬🇧 35.203.210.10

🇧🇪 198.235.24.177

🇨🇦 192.99.145.154