JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 103.154.64.138

103.154.64.138 was found in our database!

This IP was reported 28 times. Confidence of Abuse is 63%: ?

63%

ISP	Nasstec Airnet Networks Private Limited
Usage Type	Fixed Line ISP
ASN	AS150129
Domain Name	nasstecairnet.net.pk
Country	🇵🇰 Pakistan
City	Lahore, Punjab

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 103.154.64.138

Whois 103.154.64.138

IP Abuse Reports for 103.154.64.138:

This IP address has been reported a total of 28 times from 21 distinct sources. 103.154.64.138 was first reported on March 29th 2023, and the most recent report was 6 hours ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇫🇷 tecnicorioja	2026-07-21 22:00:27 (6 hours ago)	POST /xmlrpc.php [21/Jul/2026:12:34:52	Brute-Force Web App Attack
🇪🇸 alferez	2026-07-21 12:36:11 (16 hours ago)	xmlrpc.php attack DOS	Hacking Exploited Host Web App Attack
🇮🇹 CoreTech srl	2026-07-21 10:43:57 (17 hours ago)	cloudlinux2 fail2ban: 2026-07-21 12:38:58,929 fail2ban.filter [1927]: INFO [plesk-modsecu ... show more cloudlinux2 fail2ban: 2026-07-21 12:38:58,929 fail2ban.filter [1927]: INFO [plesk-modsecurity] Found 103.154.64.138 - 2026-07-21 12:38:58cloudlinux2 fail2ban: 2026-07-21 12:39:29,377 fail2ban.filter [1927]: INFO [plesk-modsecurity] Found 104.196.214.11 - 2026-07-21 12:39:29cloudlinux2 fail2ban: 2026-07-21 12:39:32,724 fail2ban.filter [1927]: INFO [plesk-modsecurity] Found 104.196.214.11 - 2026-07-21 12:39:32cloudlinux2 fail2ban: 2026-07-21 12:39:52,660 fail2ban.filter [1927]: INFO [plesk-modsecurity] Found 27.34.71.121 - 2026-07-21 12:39:52cloudlinux2 fail2ban: 2026-07-21 12:40:06,015 fail2ban.actions [1927]: NOTICE [plesk-modsecurity] Unban 210.1.101.50cloudlinux2 fail2ban: 2026-07-21 12:40:02,262 fail2ban.filter [1927]: INFO [plesk-modsecurity] Found 103.154.64.138 - 2026-07-21 12:40:02cloudlinux2 fail2ban: 2026-07-21 12:40:02,977 fail2ban.filter [1927]: INFO [recidive] Found 103.154.64.138 - 2026-07-21 12:40:02cloudlinux2 fail2ban: 2 show less	Brute-Force
Anonymous	2026-07-21 07:53:07 (20 hours ago)	[ssd5.kdns.gr] httpd-xmlrpc-post: sites=www.tentes-margaritis.gr; logs=/var/log/httpd/domains/tentes ... show more [ssd5.kdns.gr] httpd-xmlrpc-post: sites=www.tentes-margaritis.gr; logs=/var/log/httpd/domains/tentes-margaritis.gr.log; samples=/xmlrpc.php show less	Brute-Force Web App Attack
🇪🇸 masterguru	2026-07-14 10:11:24 (1 week ago)	(xmlrpc) Failed xmlrpc access from 103.154.64.138 (PK/Pakistan/-): 5 in the last 3600 secs (0-122)	Hacking
🇩🇪 LRob	2026-07-14 09:23:54 (1 week ago)	CrowdSec: crowdsecurity/http-bf-wordpress_bf_xmlrpc \| req: /xmlrpc.php \| UA: Jetpack by WordPress.co ... show more CrowdSec: crowdsecurity/http-bf-wordpress_bf_xmlrpc \| req: /xmlrpc.php \| UA: Jetpack by WordPress.com (Jetpack 13.0; WordPress 6.3) show less	Brute-Force Web App Attack
🇩🇪 LRob	2026-07-14 08:22:46 (1 week ago)	CrowdSec: crowdsecurity/http-bf-wordpress_bf_xmlrpc \| req: /xmlrpc.php \| UA: WordPress.com; https:// ... show more CrowdSec: crowdsecurity/http-bf-wordpress_bf_xmlrpc \| req: /xmlrpc.php \| UA: WordPress.com; https://wordpress.com show less	Brute-Force Web App Attack
🇫🇷 masterguru	2026-07-14 07:13:35 (1 week ago)	(xmlrpc) Apache: Failed xmlrpc access from 103.154.64.138 (PK/Pakistan/-): 10 in the last 3600 secs ... show more (xmlrpc) Apache: Failed xmlrpc access from 103.154.64.138 (PK/Pakistan/-): 10 in the last 3600 secs (0-201) show less	Hacking
🇩🇪 Tha_14	2026-07-13 09:48:59 (1 week ago)	Limit on login attempts is reached	Brute-Force
🇫🇷 Lunix	2026-07-13 08:47:46 (1 week ago)		Brute-Force Web App Attack
Anonymous	2026-07-13 05:30:27 (1 week ago)	Large-scale coordinated botnet (530+k IPs). Attacker: mikhail-smirnov-79830323 (LinkedIn/profile ID) ... show more Large-scale coordinated botnet (530+k IPs). Attacker: mikhail-smirnov-79830323 (LinkedIn/profile ID) employed by Angara Technologies Group (Explicitly identified himself as enemy a week before attack began) \| Attack Signature Blocked: /brands/shopby/manufacturer-aastra-audiocodes-rcf-veeam-lsi-lenovo-xyz.html \| UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36 \| (Magento Site) show less	Hacking Bad Web Bot
🇺🇸 kosada.com	2026-06-29 14:22:38 (3 weeks ago)	Web bot: denial-of-service flood	DDoS Attack Bad Web Bot
🇨🇦 polycoda	2026-06-27 11:18:37 (3 weeks ago)	🥶 Part of massive botnet scraping campaign that nearly turned into a DDoS on 2025-11-27	DDoS Attack
🇺🇸 TPI-Abuse	2026-06-17 05:03:38 (1 month ago)	(mod_security) mod_security (id:240335) triggered by 103.154.64.138 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:240335) triggered by 103.154.64.138 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jun 17 01:03:31.587731 2026] [security2:error] [pid 12764:tid 12764] [client 103.154.64.138:63836] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 103.154.64.138 (+1 hits since last alert)\|starcrestsales.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "starcrestsales.com"] [uri "/xmlrpc.php"] [unique_id "ajIqo07kcm41iZzLxqIs3gAAAAY"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-06-16 20:40:35 (1 month ago)	(mod_security) mod_security (id:240335) triggered by 103.154.64.138 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:240335) triggered by 103.154.64.138 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jun 16 16:40:27.737595 2026] [security2:error] [pid 15961:tid 15961] [client 103.154.64.138:50348] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 103.154.64.138 (+1 hits since last alert)\|thehealthyplaceclayton.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "thehealthyplaceclayton.com"] [uri "/xmlrpc.php"] [unique_id "ajG0uxfb1FCBjOeE93VI0gAAAAc"] show less	Brute-Force Bad Web Bot Web App Attack

Showing 1 to 15 of 28 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇹🇷 185.67.33.201

🇷🇺 176.120.22.123

🇸🇬 168.144.134.137

🇳🇱 160.119.71.136

🇬🇧 154.16.44.177

🇬🇧 154.16.44.8

🇫🇮 147.185.133.240

🇸🇪 104.222.169.72

🇵🇰 103.26.82.45

🇩🇪 69.5.169.156

🇺🇸 64.62.197.10

🇺🇸 45.194.67.120

🇨🇳 14.103.112.5

🇬🇧 5.252.83.129

🇬🇧 2.57.17.77

🇳🇱 193.176.31.224

🇳🇱 185.223.235.54

🇫🇷 185.190.142.132

🇨🇳 114.92.166.55

🇳🇱 89.21.67.172