JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 103.138.173.137

103.138.173.137 was found in our database!

This IP was reported 152 times. Confidence of Abuse is 34%: ?

34%

ISP	Asia Pacific Network Information Centre
Usage Type	Fixed Line ISP
ASN	AS139029
Domain Name	apnic.net
Country	🇧🇩 Bangladesh
City	Madaripur, Dhaka Division

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 103.138.173.137

Whois 103.138.173.137

IP Abuse Reports for 103.138.173.137:

This IP address has been reported a total of 152 times from 105 distinct sources. 103.138.173.137 was first reported on September 17th 2023, and the most recent report was 4 days ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇩🇪 big-cloud.nl	2026-10-19 16:36:02 (4 days ago)	Try to access /xmlrpc.php	Web App Attack
🇨🇳 cybsecaoccol	2026-10-13 20:37:37 (1 week ago)	unauthorized connection or malicious port scan attempted on tcp port - njng	Port Scan Hacking
🇩🇪 LRob	2026-10-12 11:05:47 (1 week ago)	Web exploit attempt \| method: GET \| path: /wp-json/wp/v2/users \| ua: Mozilla/5.0 (Windows NT 10.0; W ... show more Web exploit attempt \| method: GET \| path: /wp-json/wp/v2/users \| ua: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36 show less	Hacking Web App Attack
🇺🇸 TPI-Abuse	2026-10-04 02:38:28 (2 weeks ago)	(mod_security) mod_security (id:210350) triggered by 103.138.173.137 (-): 1 in the last 300 secs; Po ... show more (mod_security) mod_security (id:210350) triggered by 103.138.173.137 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 03 22:38:22.502400 2026] [security2:error] [pid 16612:tid 16612] [client 103.138.173.137:58938] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close\|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close\|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found\|\|welchharriscpa.com\|F\|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "welchharriscpa.com"] [uri "/"] [unique_id "asG8HlMvuq3nliTsXuZhkAAAABE"], referer: https://socialbacklinks.online/dir/link-outreach-services-230689 show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 鬼影233	2026-09-26 14:14:37 (3 weeks ago)	Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Sa ... show more Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 show less	Bad Web Bot
🇺🇸 TPI-Abuse	2026-09-25 17:50:13 (3 weeks ago)	(mod_security) mod_security (id:210350) triggered by 103.138.173.137 (-): 1 in the last 300 secs; Po ... show more (mod_security) mod_security (id:210350) triggered by 103.138.173.137 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Sep 25 13:50:03.442729 2026] [security2:error] [pid 31414:tid 31414] [client 103.138.173.137:39488] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close\|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close\|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found\|\|robcruickshank.net\|F\|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "robcruickshank.net"] [uri "/"] [unique_id "ara0SyT112Ybsu34O4nKqwAAAAw"], referer: https://robcruickshank.com/ show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 鬼影233	2026-09-20 07:36:22 (1 month ago)	Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Sa ... show more Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36 show less	Bad Web Bot
🇫🇷 Tilellit.PRO	2026-09-07 03:31:32 (1 month ago)	WooCommerce YITH AJAX Filder product_cat filter flood attempt with taxonomies	DDoS Attack Bad Web Bot
🇺🇸 kosada.com	2026-08-27 05:18:45 (1 month ago)	Web bot: denial-of-service flood	DDoS Attack Bad Web Bot
🇺🇸 鬼影233	2026-08-24 23:17:06 (1 month ago)	Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Sa ... show more Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36 show less	Bad Web Bot
🇸🇬 garrymenata	2026-08-24 00:58:44 (1 month ago)	103.138.173.137 - - [24/Aug/2026:01:57:22 +0700] "GET / HTTP/1.1" 403 3258 "-" "Dalvik/2.1.0 (Linux; ... show more 103.138.173.137 - - [24/Aug/2026:01:57:22 +0700] "GET / HTTP/1.1" 403 3258 "-" "Dalvik/2.1.0 (Linux; U; Android 12; Dcolor GD2 Build/SGZ4.240805.001)" 103.138.173.137 - - [24/Aug/2026:01:57:25 +0700] "GET / HTTP/1.1" 403 3258 "-" "Dalvik/2.1.0 (Linux; U; Android 12; Dcolor GD2 Build/SGZ4.240805.001)" 103.138.173.137 - - [24/Aug/2026:01:57:26 +0700] "GET / HTTP/1.1" 403 3258 "-" "Dalvik/2.1.0 (Linux; U; Android 12; Dcolor GD2 Build/SGZ4.240805.001)" ... show less	DDoS Attack Bad Web Bot
🇫🇷 Zkillu	2026-08-20 15:42:20 (2 months ago)	DDoS flood attack against 46.232.235.0 (2026-08-20 15:37:20 -> 2026-08-20 15:52:20 UTC) targeting AS ... show more DDoS flood attack against 46.232.235.0 (2026-08-20 15:37:20 -> 2026-08-20 15:52:20 UTC) targeting AS215599. This IP (AS139029) sent ~1916 packets (2.72 MB) during the attack window. Likely a compromised device (botnet). show less	DDoS Attack Exploited Host
🇺🇸 ipblock.com	2026-07-23 16:36:00 (3 months ago)	IPBlock protected site ID [4055-d][s=01]. Persistent 404, vulnerability scanner	Hacking Bad Web Bot Web App Attack
🇯🇵 Short-legs-Spider	2026-07-21 08:52:41 (3 months ago)	Persistent request -- [21/Jul/2026:17:52:41 +0900] "GET /==1.htm HTTP/2.0" 403 76 "-" "Mozilla/5.0 ... show more Persistent request -- [21/Jul/2026:17:52:41 +0900] "GET /==1.htm HTTP/2.0" 403 76 "-" "Mozilla/5.0 (Linux; Android 6.0; Nexus 5 Build/MRA58N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/65.0.3325.181 Mobile Safari/537.36" show less	Bad Web Bot
🇫🇷 bigorre.org	2026-07-18 10:00:32 (3 months ago)	Unidentified crawling: not a self-announced bot in user-agent	Bad Web Bot

Showing 1 to 15 of 152 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇨🇳 220.168.118.133

🇺🇸 216.36.112.159

🇨🇭 209.99.190.186

🇹🇼 198.235.24.70

🇧🇷 187.94.255.203

🇨🇳 171.114.224.243

🇳🇱 85.11.167.72

🇸🇪 81.201.223.97

🇺🇸 74.235.187.50

🇺🇸 71.9.208.228

🇸🇬 47.84.22.152

🇺🇸 45.61.176.253

🇭🇰 223.197.145.33

🇰🇷 221.162.63.153

🇬🇧 217.154.38.181

🇰🇷 211.246.160.21

🇺🇦 185.254.196.141

🇨🇱 138.84.35.110

🇨🇳 116.135.67.93

🇺🇸 107.150.105.153