JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 103.138.189.194

103.138.189.194 was found in our database!

This IP was reported 32 times. Confidence of Abuse is 79%: ?

79%

ISP	WHG Hosting Services Ltd
Usage Type	Content Delivery Network
ASN	AS204800
Hostname(s)	s2961.sgp1.stableserver.net
Domain Name	hosting.com
Country	🇸🇬 Singapore
City	Singapore

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 103.138.189.194

Whois 103.138.189.194

IP Abuse Reports for 103.138.189.194:

This IP address has been reported a total of 32 times from 19 distinct sources. 103.138.189.194 was first reported on December 24th 2025, and the most recent report was 10 hours ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇩🇪 Ba-Yu	2026-07-02 11:34:16 (10 hours ago)	WordPress bruteforce	Web Spam Hacking Brute-Force Exploited Host Web App Attack
🇩🇪 Hazzard	2026-07-01 12:00:33 (1 day ago)	(wordpress) Failed wordpress login from 103.138.189.194 (SG/Singapore/-/Singapore/s2961.sgp1.stables ... show more (wordpress) Failed wordpress login from 103.138.189.194 (SG/Singapore/-/Singapore/s2961.sgp1.stableserver.net/[redacted]): (CF_ENABLE) show less	Brute-Force
Anonymous	2026-07-01 04:23:32 (1 day ago)	(wordpress) Failed login wp-login.php or xmlrpc.php	Web App Attack
🇲🇽 octageeks.com	2026-07-01 04:15:36 (1 day ago)	Wordpress malicious attack:[octawp]	Web App Attack
🇲🇹 Malta	2026-06-30 23:15:14 (1 day ago)	103.138.189.194 - - [01/Jul/2026:01:15:14 +0200] "POST /wp-login.php HTTP/1.1" "Mozilla/5.0 (X11; Ub ... show more 103.138.189.194 - - [01/Jul/2026:01:15:14 +0200] "POST /wp-login.php HTTP/1.1" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36" show less	Hacking Web App Attack VPN IP
🇦🇺 FSB.ru - Is it?	2026-06-30 04:50:58 (2 days ago)	Brute force login for honeypot user accounts	Brute-Force Web App Attack
🇺🇸 cwytech	2026-06-30 00:45:54 (2 days ago)	Fleet-wide ban from the Ghostfleet 👻. Triggered by scenario: cwy/wordpress-login-lockdown-high.	Bad Web Bot Web App Attack
🇩🇪 Hazzard	2026-06-29 22:40:37 (2 days ago)	(wordpress) Failed wordpress login from 103.138.189.194 (SG/Singapore/-/Singapore/s2961.sgp1.stables ... show more (wordpress) Failed wordpress login from 103.138.189.194 (SG/Singapore/-/Singapore/s2961.sgp1.stableserver.net/[redacted]): (CF_ENABLE) show less	Brute-Force
🇫🇷 ELYAZ	2026-06-29 19:46:18 (3 days ago)	(y4) Failed scan -byebye- from 103.138.189.194 (SG/Singapore/s2961.sgp1.stableserver.net): (CF_ENAB ... show more (y4) Failed scan -byebye- from 103.138.189.194 (SG/Singapore/s2961.sgp1.stableserver.net): (CF_ENABLE) show less	Hacking
🇺🇸 TPI-Abuse	2026-06-29 11:49:10 (3 days ago)	(mod_security) mod_security (id:225170) triggered by 103.138.189.194 (s2961.sgp1.stableserver.net): ... show more (mod_security) mod_security (id:225170) triggered by 103.138.189.194 (s2961.sgp1.stableserver.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jun 29 07:49:02.861067 2026] [security2:error] [pid 10210:tid 10210] [client 103.138.189.194:56452] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)\|\|frenchla.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "frenchla.com"] [uri "/wp-json/wp/v2/users"] [unique_id "akJbrqd742_y2Bju0ZEJ1gAAABE"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-06-29 10:29:11 (3 days ago)	(mod_security) mod_security (id:225170) triggered by 103.138.189.194 (s2961.sgp1.stableserver.net): ... show more (mod_security) mod_security (id:225170) triggered by 103.138.189.194 (s2961.sgp1.stableserver.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jun 29 06:29:05.248769 2026] [security2:error] [pid 14773:tid 14773] [client 103.138.189.194:42878] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)\|\|expresstires.us.jbcllcnet.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expresstires.us.jbcllcnet.com"] [uri "/wp-json/wp/v2/users"] [unique_id "akJI8dZROQ8JS3pDpMSN4gAAACY"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-06-29 09:34:02 (3 days ago)	(mod_security) mod_security (id:225170) triggered by 103.138.189.194 (s2961.sgp1.stableserver.net): ... show more (mod_security) mod_security (id:225170) triggered by 103.138.189.194 (s2961.sgp1.stableserver.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jun 29 05:33:55.401090 2026] [security2:error] [pid 17453:tid 17453] [client 103.138.189.194:45146] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)\|\|premierveterinarysurgery.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "premierveterinarysurgery.com"] [uri "/wp-json/wp/v2/users/4"] [unique_id "akI8A9-vHBEEarvVkWL0hQAAABE"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-06-28 19:40:02 (4 days ago)	(mod_security) mod_security (id:225170) triggered by 103.138.189.194 (s2961.sgp1.stableserver.net): ... show more (mod_security) mod_security (id:225170) triggered by 103.138.189.194 (s2961.sgp1.stableserver.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Jun 28 15:39:57.309949 2026] [security2:error] [pid 16589:tid 16589] [client 103.138.189.194:34054] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)\|\|ftiptondds.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "ftiptondds.com"] [uri "/wp-json/wp/v2/users"] [unique_id "akF4jZJG-qESRfTLoUzb1QAAABk"] show less	Brute-Force Bad Web Bot Web App Attack
🇩🇪 FeG Deutschland	2026-06-28 18:25:05 (4 days ago)	Looking for CMS/PHP/SQL vulnerablilities/excessive crawling - 2	Exploited Host Web App Attack
🇺🇸 mnsf	2026-06-28 18:05:41 (4 days ago)	Abuse Detected (1)	Brute-Force Web App Attack

Showing 1 to 15 of 32 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇧🇷 138.59.196.174

🇮🇳 136.232.11.10

🇨🇳 115.191.32.57

🇳🇵 36.253.9.128

🇨🇳 223.223.194.187

🇮🇷 217.18.94.226

🇩🇪 213.209.159.142

🇺🇸 192.241.179.235

🇫🇮 185.92.183.35

🇷🇺 185.76.242.57

🇨🇳 118.89.30.164

🇨🇳 106.75.189.251

🇸🇬 8.219.221.108

🇸🇾 5.0.4.250

🇨🇳 192.140.185.8

🇲🇽 187.190.35.163

🇵🇭 180.190.166.192

🇨🇳 106.55.180.195

🇸🇮 102.220.160.67

🇷🇺 79.104.0.82