JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 103.172.72.82

103.172.72.82 was found in our database!

This IP was reported 29 times. Confidence of Abuse is 89%: ?

89%

ISP	SANTOSH COMMUNICATION
Usage Type	Fixed Line ISP
ASN	AS133982
Domain Name	santos.com
Country	🇮🇳 India
City	Delhi, Delhi

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 103.172.72.82

Whois 103.172.72.82

IP Abuse Reports for 103.172.72.82:

This IP address has been reported a total of 29 times from 16 distinct sources. 103.172.72.82 was first reported on June 23rd 2026, and the most recent report was 3 hours ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇩🇪 rh24	2026-06-28 13:01:56 (3 hours ago)	(wordpress) Failed wordpress login from 103.172.72.82 (IN/India/-): (CF_ENABLE)	Brute-Force
🇺🇸 TPI-Abuse	2026-06-27 12:14:30 (1 day ago)	(mod_security) mod_security (id:240335) triggered by 103.172.72.82 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:240335) triggered by 103.172.72.82 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Jun 27 08:14:25.143527 2026] [security2:error] [pid 7209:tid 7209] [client 103.172.72.82:62130] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 103.172.72.82 (+1 hits since last alert)\|medusakenya.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "medusakenya.com"] [uri "/xmlrpc.php"] [unique_id "aj--oa737D9MKTmIQdhIcAAAAAE"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-06-27 11:12:52 (1 day ago)	(mod_security) mod_security (id:240335) triggered by 103.172.72.82 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:240335) triggered by 103.172.72.82 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Jun 27 07:12:47.797446 2026] [security2:error] [pid 12046:tid 12046] [client 103.172.72.82:63413] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 103.172.72.82 (+1 hits since last alert)\|enriquejezik.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "enriquejezik.com"] [uri "/xmlrpc.php"] [unique_id "aj-wL4SUkvBSyAoqFokdhQAAAAo"] show less	Brute-Force Bad Web Bot Web App Attack
🇩🇪 pscriptos	2026-06-27 09:38:45 (1 day ago)	{"ClientAddr":"103.172.72.82:50543","ClientHost":"103.172.72.82","ClientPort":"50543","ClientUsernam ... show more {"ClientAddr":"103.172.72.82:50543","ClientHost":"103.172.72.82","ClientPort":"50543","ClientUsername":"-","DownstreamContentSize":418,"DownstreamStatus":403,"Duration":610714265,"OriginContentSize":418,"OriginDuration":606567531,"OriginStatus":403,"Overhead":4146734,"RequestAddr":"www.cleveradmin.de","RequestContentSize":714,"RequestCount":1567217,"RequestHost":"www.cleveradmin.de","RequestMethod":"POST","RequestPath":"/xmlrpc.php","RequestPort":"-","RequestProtocol":"HTTP/1.1","RequestScheme":"https","RetryAttempts":0,"RouterName":"cleveradmin-www-websecure@file","ServiceAddr":"172.16.80.10:80","ServiceName":"cleveradmin-www@file","ServiceURL":"http://172.16.80.10:80","StartLocal":"2026-06-27T11:38:36.049069384+02:00","StartUTC":"2026-06-27T09:38:36.049069384Z","TLSCipher":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","TLSVersion":"1.2","entryPointName":"websecure","level":"info","msg":"","time":"2026-06-27T11:38:36+02:00"} {"ClientAddr":"103.172.72.82:50543","ClientHost":"103.172.72.82"," ... show less	Brute-Force Web App Attack
🇺🇸 TPI-Abuse	2026-06-27 08:32:55 (1 day ago)	(mod_security) mod_security (id:240335) triggered by 103.172.72.82 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:240335) triggered by 103.172.72.82 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Jun 27 04:32:49.591782 2026] [security2:error] [pid 29189:tid 29189] [client 103.172.72.82:56352] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 103.172.72.82 (+1 hits since last alert)\|sneedvillefarmersmarket.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "sneedvillefarmersmarket.com"] [uri "/xmlrpc.php"] [unique_id "aj-KsbZ0dBajjcVkf9qj1wAAABQ"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-06-27 05:34:06 (1 day ago)	(mod_security) mod_security (id:240335) triggered by 103.172.72.82 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:240335) triggered by 103.172.72.82 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Jun 27 01:33:58.784100 2026] [security2:error] [pid 26950:tid 26950] [client 103.172.72.82:63070] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 103.172.72.82 (+1 hits since last alert)\|alejandrogorsse.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "alejandrogorsse.com"] [uri "/xmlrpc.php"] [unique_id "aj9gxrpIOBuwGdjGtk2LrQAAAA4"] show less	Brute-Force Bad Web Bot Web App Attack
Anonymous	2026-06-27 05:01:09 (1 day ago)	103.172.72.82 - - [27/Jun/2026:07:00:48 +0200] "POST /xmlrpc.php HTTP/1.1" 200 593 "-" "Jetpack by W ... show more 103.172.72.82 - - [27/Jun/2026:07:00:48 +0200] "POST /xmlrpc.php HTTP/1.1" 200 593 "-" "Jetpack by WordPress.com (Jetpack 12.0; WordPress 6.3)" 103.172.72.82 - - [27/Jun/2026:07:00:50 +0200] "POST /xmlrpc.php HTTP/1.1" 200 403 "-" "Jetpack by WordPress.com (Jetpack 12.0; WordPress 6.3)" 103.172.72.82 - - [27/Jun/2026:07:00:58 +0200] "POST /xmlrpc.php HTTP/1.1" 200 593 "-" "Jetpack/12.1; WordPress/6.3; http://site47183183.com" 103.172.72.82 - - [27/Jun/2026:07:00:58 +0200] "POST /xmlrpc.php HTTP/1.1" 200 403 "-" "Jetpack/12.1; WordPress/6.3; http://site47183183.com" 103.172.72.82 - - [27/Jun/2026:07:01:09 +0200] "POST /xmlrpc.php HTTP/1.1" 200 403 "-" "Jetpack by WordPress.com (Jetpack 12.0; WordPress 6.4)" ... show less	Brute-Force Web App Attack
🇺🇸 n2nguyenn2nguyen	2026-06-27 03:59:17 (1 day ago)	Blocked by YFC Security on https://fencingforward.com — type: xmlrpc_attempts	Brute-Force Web App Attack
🇺🇸 TPI-Abuse	2026-06-27 03:31:08 (1 day ago)	(mod_security) mod_security (id:240335) triggered by 103.172.72.82 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:240335) triggered by 103.172.72.82 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jun 26 23:31:05.205417 2026] [security2:error] [pid 12073:tid 12073] [client 103.172.72.82:64637] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 103.172.72.82 (+1 hits since last alert)\|kathydumesnilart.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "kathydumesnilart.com"] [uri "/xmlrpc.php"] [unique_id "aj9D-fVZlOE8fDCRUfGGYQAAAAY"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 integrantservices.com	2026-06-27 03:29:06 (1 day ago)	(wordpress) Failed wordpress login from 103.172.72.82 (IN/India/-)	Brute-Force
🇫🇷 applemooz	2026-06-26 11:38:33 (2 days ago)	WordPress XMLRPC Brute Force Attacks ...	Brute-Force Web App Attack
Anonymous	2026-06-26 08:25:09 (2 days ago)	Attac	Brute-Force
Anonymous	2026-06-26 07:22:18 (2 days ago)	[redacted] 103.172.72.82 - - [26/Jun/2026:09:21:36 +0200] "POST /xmlrpc.php HTTP/1.1" 405 428 "-" "J ... show more [redacted] 103.172.72.82 - - [26/Jun/2026:09:21:36 +0200] "POST /xmlrpc.php HTTP/1.1" 405 428 "-" "Jetpack/12.0; WordPress/6.3; http://site43777182.com" [redacted] 103.172.72.82 - - [26/Jun/2026:09:21:46 +0200] "POST /xmlrpc.php HTTP/1.1" 405 428 "-" "Jetpack/12.1; WordPress/6.2; http://site32528759.com" [redacted] 103.172.72.82 - - [26/Jun/2026:09:21:56 +0200] "POST /xmlrpc.php HTTP/1.1" 405 428 "-" "WordPress.com; https://wordpress.com" [redacted] 103.172.72.82 - - [26/Jun/2026:09:22:07 +0200] "POST /xmlrpc.php HTTP/1.1" 405 428 "-" "Jetpack by WordPress.com" [redacted] 103.172.72.82 - - [26/Jun/2026:09:22:17 +0200] "POST /xmlrpc.php HTTP/1.1" 405 428 "-" "Jetpack by WordPress.com" ... show less	Hacking Web App Attack
🇩🇪 pscriptos	2026-06-26 07:22:09 (2 days ago)	{"ClientAddr":"103.172.72.82:61767","ClientHost":"103.172.72.82","ClientPort":"61767","ClientUsernam ... show more {"ClientAddr":"103.172.72.82:61767","ClientHost":"103.172.72.82","ClientPort":"61767","ClientUsername":"-","DownstreamContentSize":418,"DownstreamStatus":403,"Duration":646396846,"OriginContentSize":418,"OriginDuration":642394153,"OriginStatus":403,"Overhead":4002693,"RequestAddr":"www.cleveradmin.de","RequestContentSize":717,"RequestCount":1491322,"RequestHost":"www.cleveradmin.de","RequestMethod":"POST","RequestPath":"/xmlrpc.php","RequestPort":"-","RequestProtocol":"HTTP/1.1","RequestScheme":"https","RetryAttempts":0,"RouterName":"cleveradmin-www-websecure@file","ServiceAddr":"172.16.80.10:80","ServiceName":"cleveradmin-www@file","ServiceURL":"http://172.16.80.10:80","StartLocal":"2026-06-26T09:21:48.360340473+02:00","StartUTC":"2026-06-26T07:21:48.360340473Z","TLSCipher":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","TLSVersion":"1.2","entryPointName":"websecure","level":"info","msg":"","time":"2026-06-26T09:21:49+02:00"} {"ClientAddr":"103.172.72.82:61767","ClientHost":"103.172.72.82"," ... show less	Brute-Force Web App Attack
🇧🇾 lns.bz	2026-06-26 06:21:03 (2 days ago)	Banned for trying to access xmlrpc [BY]	Web App Attack

Showing 1 to 15 of 29 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇮🇩 163.7.1.218

🇸🇬 159.138.123.238

🇧🇷 43.164.192.151

🇨🇳 223.108.185.250

🇨🇳 220.250.10.25

🇩🇪 212.132.120.41

🇧🇷 200.131.5.202

🇹🇷 94.154.43.181

🇱🇻 81.30.98.49

🇧🇬 79.124.56.146

🇮🇩 202.72.196.75

🇺🇸 143.198.225.197

🇺🇸 143.42.1.191

🇰🇷 118.33.113.4

🇵🇱 89.67.39.124

🇱🇻 81.30.98.158

🇺🇸 66.132.195.24

🇱🇹 62.60.130.219

🇹🇼 60.199.224.55

🇱🇹 45.227.254.170