JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 103.138.189.49

103.138.189.49 was found in our database!

This IP was reported 171 times. Confidence of Abuse is 38%: ?

38%

ISP	WHG Hosting Services Ltd
Usage Type	Content Delivery Network
ASN	AS204800
Hostname(s)	s1324.sgp1.mysecurecloudhost.com
Domain Name	hosting.com
Country	🇸🇬 Singapore
City	Singapore

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 103.138.189.49

Whois 103.138.189.49

IP Abuse Reports for 103.138.189.49:

This IP address has been reported a total of 171 times from 60 distinct sources. 103.138.189.49 was first reported on December 10th 2025, and the most recent report was 58 minutes ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇭🇺 bcsaba	2026-07-25 00:11:28 (58 minutes ago)	CMS (WordPress or Joomla) login attempt. 103.138.189.49 - - [25/Jul/2026:02:11:26 +0200] "POST /wp-l ... show more CMS (WordPress or Joomla) login attempt. 103.138.189.49 - - [25/Jul/2026:02:11:26 +0200] "POST /wp-login.php HTTP/2.0" 200 4047 "https://REDACTED/wp-login.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36" show less	Hacking Brute-Force Web App Attack
🇩🇪 ger-stg-sifi1	2026-07-24 16:49:52 (8 hours ago)	(wordpress) Failed wordpress login using wp-login.php or xmlrpc.php	Web App Attack
🇩🇪 neckaralb-admin.de	2026-07-08 15:57:11 (2 weeks ago)	(wordpress) Failed login wp-login.php or xmlrpc.php	Web App Attack
🇩🇪 ger-stg-sifi1	2026-07-08 12:44:02 (2 weeks ago)	(wordpress) Failed wordpress login using wp-login.php or xmlrpc.php	Web App Attack
🇺🇸 TPI-Abuse	2026-07-04 01:14:57 (2 weeks ago)	(mod_security) mod_security (id:225170) triggered by 103.138.189.49 (s1324.sgp1.mysecurecloudhost.co ... show more (mod_security) mod_security (id:225170) triggered by 103.138.189.49 (s1324.sgp1.mysecurecloudhost.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jul 03 21:14:49.725678 2026] [security2:error] [pid 15849:tid 15849] [client 103.138.189.49:44988] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)\|\|doncody.disio.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "doncody.disio.com"] [uri "/wp-json/wp/v2/users"] [unique_id "akheiS5xCP0FFE1TEe3jxAAAAAo"] show less	Brute-Force Bad Web Bot Web App Attack
🇩🇪 FeG Deutschland	2026-07-03 16:34:22 (3 weeks ago)	Looking for CMS/PHP/SQL vulnerablilities/excessive crawling - 124	Exploited Host Web App Attack
🇺🇸 TPI-Abuse	2026-06-28 23:38:27 (3 weeks ago)	(mod_security) mod_security (id:225170) triggered by 103.138.189.49 (s1324.sgp1.mysecurecloudhost.co ... show more (mod_security) mod_security (id:225170) triggered by 103.138.189.49 (s1324.sgp1.mysecurecloudhost.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Jun 28 19:38:22.449133 2026] [security2:error] [pid 15053:tid 15053] [client 103.138.189.49:47888] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)\|\|rblep.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "rblep.com"] [uri "/wp-json/wp/v2/users/1"] [unique_id "akGwbk6EsbvhkO2Y77nbbwAAAHA"] show less	Brute-Force Bad Web Bot Web App Attack
🇩🇪 FeG Deutschland	2026-06-28 22:36:53 (3 weeks ago)	Looking for CMS/PHP/SQL vulnerablilities/excessive crawling - 124	Exploited Host Web App Attack
🇲🇽 octageeks.com	2026-06-05 04:29:36 (1 month ago)	Wordpress malicious attack:[octaflood]	Web App Attack
🇺🇸 xxkodedxx	2026-06-04 15:52:58 (1 month ago)	[Zorvexus edge-defense] GET .env / WordPress honeypot probe Trigger: 1× honeypot-get in 10m window. ... show more [Zorvexus edge-defense] GET .env / WordPress honeypot probe Trigger: 1× honeypot-get in 10m window. Active: 15:52:43 UTC Volume: 1 honeypot probe(s) Bait taken: /wp-login.php UA: "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" Auto-banned 30d. zorvexus-banner. show less	Bad Web Bot Web App Attack
🇲🇹 Malta	2026-06-04 15:42:15 (1 month ago)	103.138.189.49 - - [04/Jun/2026:17:42:14 +0200] "POST /xmlrpc.php HTTP/1.1" "Mozilla/5.0 (Windows NT ... show more 103.138.189.49 - - [04/Jun/2026:17:42:14 +0200] "POST /xmlrpc.php HTTP/1.1" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" Brute-force password attempt show less	Hacking Web App Attack Brute-Force
🇫🇷 masterguru	2026-06-01 08:11:13 (1 month ago)	(modsec_5040) ModSec 5040: API Basic Auth blocked from 103.138.189.49 (SG/Singapore/s1324.sgp1.mysec ... show more (modsec_5040) ModSec 5040: API Basic Auth blocked from 103.138.189.49 (SG/Singapore/s1324.sgp1.mysecurecloudhost.com): 1 in the last 3600 secs (0-197) show less	Hacking
🇺🇸 TPI-Abuse	2026-06-01 01:01:56 (1 month ago)	(mod_security) mod_security (id:225170) triggered by 103.138.189.49 (s1324.sgp1.mysecurecloudhost.co ... show more (mod_security) mod_security (id:225170) triggered by 103.138.189.49 (s1324.sgp1.mysecurecloudhost.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun May 31 21:01:49.459083 2026] [security2:error] [pid 28792:tid 28792] [client 103.138.189.49:53384] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)\|\|doctoredwinalvarez.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "doctoredwinalvarez.com"] [uri "/wp-json/wp/v2/users/me"] [unique_id "ahzZ_Ss68mvOM3Y7_PScSAAAAAQ"] show less	Brute-Force Bad Web Bot Web App Attack
🇷🇺 DZBOT	2026-05-31 09:01:53 (1 month ago)	DZBOT: Website Scanning / Scraping	Bad Web Bot Exploited Host Web App Attack
🇩🇪 FeG Deutschland	2026-05-30 15:18:24 (1 month ago)	Looking for CMS/PHP/SQL vulnerablilities/excessive crawling - 124	Exploited Host Web App Attack

Showing 1 to 15 of 171 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇺🇸 2607:f8b0:4001:c54::120

🇰🇷 211.178.247.182

🇨🇦 158.51.121.232

🇩🇪 152.53.191.99

🇷🇴 92.118.39.77

🇺🇸 66.132.186.195

🇧🇷 45.205.1.246

🇺🇸 20.163.15.238

🇺🇸 4.150.201.26

🇺🇸 205.210.31.85

🇳🇱 188.166.69.53

🇲🇽 187.154.144.166

🇮🇩 182.253.221.210

🇺🇸 173.172.254.48

🇺🇸 172.253.210.21

🇦🇷 168.121.208.238

🇦🇪 165.154.12.108

🇺🇸 151.240.109.33

🇬🇧 134.209.19.42

🇻🇳 103.200.25.79