JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 103.206.97.149

103.206.97.149 was found in our database!

This IP was reported 32 times. Confidence of Abuse is 57%: ?

57%

ISP	Starnet Broaband Services private limited
Usage Type	Fixed Line ISP
ASN	AS137085
Domain Name	starnet.cz
Country	🇮🇳 India
City	Jind, Haryana

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 103.206.97.149

Whois 103.206.97.149

IP Abuse Reports for 103.206.97.149:

This IP address has been reported a total of 32 times from 22 distinct sources. 103.206.97.149 was first reported on January 29th 2021, and the most recent report was 18 hours ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇩🇪 YF	2026-06-19 14:10:48 (18 hours ago)	Attaque distribuée subnet	DDoS Attack Web App Attack
🇺🇸 xmission.com	2026-06-13 04:57:21 (1 week ago)	103.206.97.149 - - [12/Jun/2026:22:57:21 -0600] "POST /xmlrpc.php HTTP/1.1" 200 415 "-" "WordPress.c ... show more 103.206.97.149 - - [12/Jun/2026:22:57:21 -0600] "POST /xmlrpc.php HTTP/1.1" 200 415 "-" "WordPress.com; https://wordpress.com" ... show less	Web App Attack
🇺🇸 TPI-Abuse	2026-06-12 10:19:33 (1 week ago)	(mod_security) mod_security (id:240335) triggered by 103.206.97.149 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:240335) triggered by 103.206.97.149 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jun 12 06:19:15.383976 2026] [security2:error] [pid 27306:tid 27306] [client 103.206.97.149:51185] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 103.206.97.149 (+1 hits since last alert)\|pastorjohndunning.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "pastorjohndunning.com"] [uri "/xmlrpc.php"] [unique_id "aivdI4VY8ccAymf47S-T4wAAACM"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-06-12 07:53:37 (1 week ago)	(mod_security) mod_security (id:240335) triggered by 103.206.97.149 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:240335) triggered by 103.206.97.149 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jun 12 03:53:22.293987 2026] [security2:error] [pid 32108:tid 32108] [client 103.206.97.149:64561] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 103.206.97.149 (+1 hits since last alert)\|nypatriotcards.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "nypatriotcards.com"] [uri "/xmlrpc.php"] [unique_id "aiu68rH6s0YXKC6EuU_KBQAAAAI"] show less	Brute-Force Bad Web Bot Web App Attack
🇩🇪 dbmwebdesign	2026-06-12 04:30:18 (1 week ago)	WordPress login brute-force detected by Fail2Ban in plesk-wordpress jail	Brute-Force Web App Attack
🇩🇪 ger-stg-sifi1	2026-06-09 08:03:21 (1 week ago)	(wordpress) Failed wordpress login using wp-login.php or xmlrpc.php	Web App Attack
🇬🇧 PeravixGroup	2026-06-08 08:43:14 (1 week ago)	Honeypot detection: SMB / Windows file sharing exploitation attempt on port 445. Severity: HIGH. Aar ... show more Honeypot detection: SMB / Windows file sharing exploitation attempt on port 445. Severity: HIGH. Aaran.cloud show less	Hacking Exploited Host
Anonymous	2026-06-06 10:50:16 (1 week ago)	Attac	Brute-Force
🇩🇪 Martin Lundstrom	2026-06-05 10:19:46 (2 weeks ago)	https://www.eagleeye-intelligence.com — WordPress attack. Automatically detected and blocked.	Web App Attack
Anonymous	2026-06-03 04:17:12 (2 weeks ago)	Attac	Brute-Force
🇩🇪 pscriptos	2026-06-01 12:21:32 (2 weeks ago)	{"ClientAddr":"103.206.97.149:50147","ClientHost":"103.206.97.149","ClientPort":"50147","ClientUsern ... show more {"ClientAddr":"103.206.97.149:50147","ClientHost":"103.206.97.149","ClientPort":"50147","ClientUsername":"-","DownstreamContentSize":418,"DownstreamStatus":403,"Duration":180706779,"OriginContentSize":418,"OriginDuration":176321840,"OriginStatus":403,"Overhead":4384939,"RequestAddr":"www.cleveradmin.de","RequestContentSize":716,"RequestCount":1016555,"RequestHost":"www.cleveradmin.de","RequestMethod":"POST","RequestPath":"/xmlrpc.php","RequestPort":"-","RequestProtocol":"HTTP/1.1","RequestScheme":"https","RetryAttempts":0,"RouterName":"cleveradmin-www-websecure@file","ServiceAddr":"172.16.80.10:80","ServiceName":"cleveradmin-www@file","ServiceURL":"http://172.16.80.10:80","StartLocal":"2026-06-01T14:21:11.862770086+02:00","StartUTC":"2026-06-01T12:21:11.862770086Z","TLSCipher":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","TLSVersion":"1.2","entryPointName":"websecure","level":"info","msg":"","time":"2026-06-01T14:21:12+02:00"} {"ClientAddr":"103.206.97.149:50147","ClientHost":"103.206.97.14 ... show less	Brute-Force Web App Attack
Anonymous	2026-06-01 10:48:38 (2 weeks ago)	Attac	Brute-Force
Anonymous	2026-06-01 10:03:02 (2 weeks ago)	103.206.97.149 - - [01/Jun/2026:12:02:39 +0200] "POST /xmlrpc.php HTTP/1.1" 200 750 "-" "Jetpack by ... show more 103.206.97.149 - - [01/Jun/2026:12:02:39 +0200] "POST /xmlrpc.php HTTP/1.1" 200 750 "-" "Jetpack by WordPress.com" 103.206.97.149 - - [01/Jun/2026:12:02:41 +0200] "POST /xmlrpc.php HTTP/1.1" 200 403 "-" "Jetpack by WordPress.com" 103.206.97.149 - - [01/Jun/2026:12:02:52 +0200] "POST /xmlrpc.php HTTP/1.1" 200 403 "-" "WordPress.com; https://wordpress.com" 103.206.97.149 - - [01/Jun/2026:12:02:49 +0200] "POST /xmlrpc.php HTTP/1.1" 200 750 "-" "WordPress.com; https://wordpress.com" 103.206.97.149 - - [01/Jun/2026:12:03:00 +0200] "POST /xmlrpc.php HTTP/1.1" 200 750 "-" "WordPress.com; https://wordpress.com" ... show less	Brute-Force Web App Attack
🇮🇹 sssrit	2026-06-01 01:16:13 (2 weeks ago)	103.206.97.149 - - [01/Jun/2026:03:16:02 +0200] "POST /xmlrpc.php HTTP/1.1" 200 477 "-" "WordPress.c ... show more 103.206.97.149 - - [01/Jun/2026:03:16:02 +0200] "POST /xmlrpc.php HTTP/1.1" 200 477 "-" "WordPress.com; https://wordpress.com" 103.206.97.149 - - [01/Jun/2026:03:16:11 +0200] "POST /xmlrpc.php HTTP/1.1" 200 477 "-" "WordPress.com; https://wordpress.com" ... show less	Web App Attack
Anonymous	2026-05-30 08:47:18 (2 weeks ago)	103.206.97.149 - - [30/May/2026:10:46:57 +0200] "POST /xmlrpc.php HTTP/1.1" 200 593 "-" "WordPress.c ... show more 103.206.97.149 - - [30/May/2026:10:46:57 +0200] "POST /xmlrpc.php HTTP/1.1" 200 593 "-" "WordPress.com; https://wordpress.com" 103.206.97.149 - - [30/May/2026:10:46:58 +0200] "POST /xmlrpc.php HTTP/1.1" 200 403 "-" "WordPress.com; https://wordpress.com" 103.206.97.149 - - [30/May/2026:10:47:07 +0200] "POST /xmlrpc.php HTTP/1.1" 200 593 "-" "Jetpack/12.0; WordPress/6.4; http://site82967296.com" 103.206.97.149 - - [30/May/2026:10:47:07 +0200] "POST /xmlrpc.php HTTP/1.1" 200 403 "-" "Jetpack/12.0; WordPress/6.4; http://site82967296.com" 103.206.97.149 - - [30/May/2026:10:47:18 +0200] "POST /xmlrpc.php HTTP/1.1" 200 593 "-" "WordPress.com; https://wordpress.com" ... show less	Brute-Force Web App Attack

Showing 1 to 15 of 32 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇵🇱 157.22.46.92

🇧🇷 143.137.86.240

🇷🇴 141.98.83.240

🇫🇷 51.68.34.131

🇲🇾 49.124.153.4

🇳🇱 45.148.10.152

🇮🇹 217.216.60.15

🇩🇪 217.160.3.46

🇧🇷 179.48.229.117

🇧🇷 177.85.249.226

🇨🇳 115.210.52.47

🇺🇸 44.117.23.198

🇮🇳 2401:4900:8f72:4f8b:cc0:abfd:e03d:d66

🇺🇸 162.216.150.170

🇺🇸 44.73.153.84

🇨🇳 43.142.113.25

🇷🇴 2.57.122.177

🇫🇷 194.163.137.135

🇬🇧 188.240.59.15

🇳🇱 176.65.148.229