JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 103.211.12.63

103.211.12.63 was found in our database!

This IP was reported 36 times. Confidence of Abuse is 83%: ?

83%

ISP	Jain Net Services
Usage Type	Fixed Line ISP
ASN	AS133982
Domain Name	excitel.com
Country	🇮🇳 India
City	Varanasi, Uttar Pradesh

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 103.211.12.63

Whois 103.211.12.63

IP Abuse Reports for 103.211.12.63:

This IP address has been reported a total of 36 times from 21 distinct sources. 103.211.12.63 was first reported on March 31st 2023, and the most recent report was 1 day ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇮🇹 CoreTech srl	2026-08-31 09:58:57 (1 day ago)	cloudlinux2 fail2ban: 2026-08-31 11:54:22,028 fail2ban.filter [1605]: INFO [plesk-wordpre ... show more cloudlinux2 fail2ban: 2026-08-31 11:54:22,028 fail2ban.filter [1605]: INFO [plesk-wordpress] Found 198.187.31.117 - 2026-08-31 11:54:21cloudlinux2 fail2ban: 2026-08-31 11:54:51,510 fail2ban.filter [1605]: INFO [plesk-wordpress] Found 46.225.123.58 - 2026-08-31 11:54:50cloudlinux2 fail2ban: 2026-08-31 11:54:55,458 fail2ban.filter [1605]: INFO [plesk-wordpress] Found 176.9.29.221 - 2026-08-31 11:54:54cloudlinux2 fail2ban: 2026-08-31 11:55:23,245 fail2ban.filter [1605]: INFO [plesk-modsecurity] Found 103.211.12.63 - 2026-08-31 11:55:22cloudlinux2 fail2ban: 2026-08-31 11:55:37,875 fail2ban.filter [1605]: INFO [plesk-wordpress] Found 45.83.104.209 - 2026-08-31 11:55:37cloudlinux2 fail2ban: 2026-08-31 11:56:26,833 fail2ban.filter [1605]: INFO [plesk-modsecurity] Found 103.211.12.63 - 2026-08-31 11:56:26cloudlinux2 fail2ban: 2026-08-31 11:56:37,823 fail2ban.actions [1605]: NOTICE [plesk-modsecurity] Ban 103.211.12.63cloudlinux2 fail2ban: 2026- show less	Web App Attack
Anonymous	2026-08-31 07:19:39 (1 day ago)	[redacted] 103.211.12.63 - - [31/Aug/2026:09:18:56 +0200] "POST /xmlrpc.php HTTP/1.1" 403 1682 "-" " ... show more [redacted] 103.211.12.63 - - [31/Aug/2026:09:18:56 +0200] "POST /xmlrpc.php HTTP/1.1" 403 1682 "-" "WordPress.com; https://wordpress.com" [redacted] 103.211.12.63 - - [31/Aug/2026:09:19:06 +0200] "POST /xmlrpc.php HTTP/1.1" 403 0 "-" "Jetpack/13.0; WordPress/6.4; http://site86352701.com" [redacted] 103.211.12.63 - - [31/Aug/2026:09:19:17 +0200] "POST /xmlrpc.php HTTP/1.1" 403 0 "-" "Jetpack by WordPress.com (Jetpack 12.0; WordPress 6.4)" [redacted] 103.211.12.63 - - [31/Aug/2026:09:19:28 +0200] "POST /xmlrpc.php HTTP/1.1" 403 0 "-" "WordPress.com; https://wordpress.com" [redacted] 103.211.12.63 - - [31/Aug/2026:09:19:39 +0200] "POST /xmlrpc.php HTTP/1.1" 403 0 "-" "Jetpack by WordPress.com (Jetpack 12.0; WordPress 6.1)" ... show less	Hacking Web App Attack
🇩🇪 abdubhai	2026-08-31 07:19:27 (1 day ago)	103.211.12.63 - - [31/Aug/2026:1 ...	Brute-Force
🇲🇾 Rizzy	2026-08-29 07:25:51 (3 days ago)	Multiple WAF Violations	Brute-Force Web App Attack
🇺🇸 integrantservices.com	2026-08-26 13:36:34 (6 days ago)	(wordpress) Failed wordpress login from 103.211.12.63 (IN/India/-)	Brute-Force
🇳🇱 Site.eu	2026-08-26 12:35:41 (6 days ago)	Repeated wp-login/xmlrpc attempts	Brute-Force SSH
Anonymous	2026-08-25 12:35:03 (1 week ago)	Bot / scanning and/or hacking attempts: POST /xmlrpc.php HTTP/1.1	Hacking Web App Attack
🇺🇸 TPI-Abuse	2026-08-25 12:10:56 (1 week ago)	(mod_security) mod_security (id:240335) triggered by 103.211.12.63 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:240335) triggered by 103.211.12.63 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Aug 25 08:10:50.622270 2026] [security2:error] [pid 15128:tid 15128] [client 103.211.12.63:64366] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 103.211.12.63 (+1 hits since last alert)\|infinityartistsgroup.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "infinityartistsgroup.com"] [uri "/xmlrpc.php"] [unique_id "ao2GSs2Yrnsri_02MoXsGAAAAAY"] show less	Brute-Force Bad Web Bot Web App Attack
🇫🇷 dynamix	2026-08-25 11:39:49 (1 week ago)	WordPress XMLRPC Brute Force Attack	Brute-Force Web App Attack
🇺🇸 TPI-Abuse	2026-08-24 11:57:45 (1 week ago)	(mod_security) mod_security (id:240335) triggered by 103.211.12.63 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:240335) triggered by 103.211.12.63 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Aug 24 07:57:40.069026 2026] [security2:error] [pid 14788:tid 14793] [client 103.211.12.63:64735] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 103.211.12.63 (+1 hits since last alert)\|vinylnotespodcast.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "vinylnotespodcast.com"] [uri "/xmlrpc.php"] [unique_id "aowxtCVnwE_1iCrWbqTW_QAAAAM"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-08-24 10:42:51 (1 week ago)	(mod_security) mod_security (id:240335) triggered by 103.211.12.63 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:240335) triggered by 103.211.12.63 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Aug 24 06:42:44.240974 2026] [security2:error] [pid 21649:tid 21649] [client 103.211.12.63:18926] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 103.211.12.63 (+1 hits since last alert)\|mrflatpeople.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "mrflatpeople.com"] [uri "/xmlrpc.php"] [unique_id "aowgJP-REVwVdas75gJeEAAAACY"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-08-24 07:53:31 (1 week ago)	(mod_security) mod_security (id:240335) triggered by 103.211.12.63 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:240335) triggered by 103.211.12.63 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Aug 24 03:53:26.053546 2026] [security2:error] [pid 3469354:tid 3469376] [client 103.211.12.63:1614] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 103.211.12.63 (+1 hits since last alert)\|munatseng.org\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "munatseng.org"] [uri "/xmlrpc.php"] [unique_id "aov4dqHYVLHWkbSGNzxqbwAAAJQ"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-08-24 07:19:57 (1 week ago)	(mod_security) mod_security (id:240335) triggered by 103.211.12.63 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:240335) triggered by 103.211.12.63 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Aug 24 03:19:54.140298 2026] [security2:error] [pid 5944:tid 5944] [client 103.211.12.63:64535] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 103.211.12.63 (+1 hits since last alert)\|integrabroadcast.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "integrabroadcast.com"] [uri "/xmlrpc.php"] [unique_id "aovwmtUUE7UNgZt2iWBxKgAAAAA"] show less	Brute-Force Bad Web Bot Web App Attack
🇩🇪 abdubhai	2026-08-24 07:18:24 (1 week ago)	103.211.12.63 - - [24/Aug/2026:1 ...	Brute-Force
🇩🇪 ghostwarriors	2026-08-22 11:50:36 (1 week ago)	Webpage scraping	Brute-Force Bad Web Bot Web App Attack

Showing 1 to 15 of 36 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇳🇱 193.176.31.157

🇨🇳 123.8.82.40

🇨🇳 120.48.136.241

🇫🇷 91.231.89.13

🇫🇷 91.196.152.119

🇫🇷 91.196.152.3

🇩🇪 69.5.169.182

🇩🇪 69.5.169.86

🇺🇸 64.62.156.177

🇹🇳 197.5.145.114

🇺🇸 195.184.76.68

🇺🇦 185.208.231.100

🇺🇸 185.98.168.4

🇯🇵 172.238.31.241

🇮🇳 157.49.179.162

🇩🇪 130.12.182.194

🇵🇰 111.92.145.204

🇺🇸 97.93.43.157

🇪🇪 94.183.170.120

🇫🇷 82.102.18.180