JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 103.211.135.238

103.211.135.238 was found in our database!

This IP was reported 17 times. Confidence of Abuse is 64%: ?

64%

ISP	GTPL KCBPL BROADBAND PVT LTD
Usage Type	Fixed Line ISP
ASN	AS135872
Hostname(s)	238-135.211.103.static.gtplkcbpl.in
Domain Name	gtplkcbpl.net
Country	🇮🇳 India
City	Ranaghat, West Bengal

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 103.211.135.238

Whois 103.211.135.238

IP Abuse Reports for 103.211.135.238:

This IP address has been reported a total of 17 times from 12 distinct sources. 103.211.135.238 was first reported on January 5th 2024, and the most recent report was 7 hours ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇺🇸 TPI-Abuse	2026-07-30 06:46:13 (7 hours ago)	(mod_security) mod_security (id:240335) triggered by 103.211.135.238 (238-135.211.103.static.gtplkcb ... show more (mod_security) mod_security (id:240335) triggered by 103.211.135.238 (238-135.211.103.static.gtplkcbpl.in): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jul 30 02:46:05.764618 2026] [security2:error] [pid 2753759:tid 2753759] [client 103.211.135.238:61117] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 103.211.135.238 (+1 hits since last alert)\|shelbysmoak.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "shelbysmoak.com"] [uri "/xmlrpc.php"] [unique_id "amrzLQ57UGrBFiSain_HOQAAAAI"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-07-30 05:13:01 (9 hours ago)	(mod_security) mod_security (id:240335) triggered by 103.211.135.238 (238-135.211.103.static.gtplkcb ... show more (mod_security) mod_security (id:240335) triggered by 103.211.135.238 (238-135.211.103.static.gtplkcbpl.in): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jul 30 01:12:52.651512 2026] [security2:error] [pid 900827:tid 900827] [client 103.211.135.238:0] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 103.211.135.238 (+1 hits since last alert)\|avaliantlife.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "avaliantlife.com"] [uri "/xmlrpc.php"] [unique_id "amrdVOb3fhwGBx0tkbC6gAAAABk"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-07-30 02:57:46 (11 hours ago)	(mod_security) mod_security (id:240335) triggered by 103.211.135.238 (238-135.211.103.static.gtplkcb ... show more (mod_security) mod_security (id:240335) triggered by 103.211.135.238 (238-135.211.103.static.gtplkcbpl.in): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jul 29 22:57:41.800733 2026] [security2:error] [pid 349825:tid 349825] [client 103.211.135.238:60623] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 103.211.135.238 (+1 hits since last alert)\|rimaine.org\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "rimaine.org"] [uri "/xmlrpc.php"] [unique_id "amq9pbfXEs4VH-zoVEdMmQAAAAs"] show less	Brute-Force Bad Web Bot Web App Attack
🇫🇷 SpaceHost-Server	2026-07-29 17:20:00 (21 hours ago)	103.211.135.238 - - [29/Jul/2026:19:19:38 +0200] "POST /xmlrpc.php HTTP/1.1" 200 6358 "-" "Jetpack b ... show more 103.211.135.238 - - [29/Jul/2026:19:19:38 +0200] "POST /xmlrpc.php HTTP/1.1" 200 6358 "-" "Jetpack by WordPress.com (Jetpack 12.5; WordPress 6.3)" 103.211.135.238 - - [29/Jul/2026:19:19:48 +0200] "POST /xmlrpc.php HTTP/1.1" 200 6358 "-" "Jetpack by WordPress.com (Jetpack 12.5; WordPress 6.3)" 103.211.135.238 - - [29/Jul/2026:19:19:59 +0200] "POST /xmlrpc.php HTTP/1.1" 200 6358 "-" "Jetpack by WordPress.com (Jetpack 13.0; WordPress 6.4)" show less	Hacking Web App Attack
🇫🇷 SpaceHost-Server	2026-07-29 17:04:35 (21 hours ago)	103.211.135.238 - - [29/Jul/2026:19:04:14 +0200] "POST /xmlrpc.php HTTP/1.1" 200 6358 "-" "Jetpack b ... show more 103.211.135.238 - - [29/Jul/2026:19:04:14 +0200] "POST /xmlrpc.php HTTP/1.1" 200 6358 "-" "Jetpack by WordPress.com (Jetpack 12.1; WordPress 6.4)" 103.211.135.238 - - [29/Jul/2026:19:04:23 +0200] "POST /xmlrpc.php HTTP/1.1" 200 6358 "-" "Jetpack/12.0; WordPress/6.4; http://site70635056.com" 103.211.135.238 - - [29/Jul/2026:19:04:34 +0200] "POST /xmlrpc.php HTTP/1.1" 200 6358 "-" "Jetpack by WordPress.com" show less	Hacking Web App Attack
🇺🇸 TPI-Abuse	2026-07-29 14:55:29 (23 hours ago)	(mod_security) mod_security (id:240335) triggered by 103.211.135.238 (238-135.211.103.static.gtplkcb ... show more (mod_security) mod_security (id:240335) triggered by 103.211.135.238 (238-135.211.103.static.gtplkcbpl.in): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jul 29 10:55:21.970578 2026] [security2:error] [pid 3406955:tid 3406955] [client 103.211.135.238:60475] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 103.211.135.238 (+1 hits since last alert)\|plazahacienda.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "plazahacienda.com"] [uri "/xmlrpc.php"] [unique_id "amoUWVUGAUKQtrPYd2zPrgAAAAs"] show less	Brute-Force Bad Web Bot Web App Attack
Anonymous	2026-07-29 14:54:04 (23 hours ago)	Bot / scanning and/or hacking attempts: POST /xmlrpc.php HTTP/1.1	Hacking Web App Attack
🇪🇸 masterguru	2026-07-29 11:08:40 (1 day ago)	(xmlrpc) Failed xmlrpc access from 103.211.135.238 (IN/India/238-135.211.103.static.gtplkcbpl.in): 5 ... show more (xmlrpc) Failed xmlrpc access from 103.211.135.238 (IN/India/238-135.211.103.static.gtplkcbpl.in): 5 in the last 3600 secs (0-122) show less	Hacking
Anonymous	2026-07-29 07:00:00 (1 day ago)	Automated Apache web application probing in selected 24h window; attempts=38, unique_paths=1, error_ ... show more Automated Apache web application probing in selected 24h window; attempts=38, unique_paths=1, error_responses=14; targets include WordPress, .env/.git, phpMyAdmin, autodiscover, wpad.dat and related probe paths. show less	Web App Attack
Anonymous	2026-07-29 07:00:00 (1 day ago)	Apache probe; attempts=38; exact paths: /xmlrpc.php	Web App Attack
🇺🇸 integrantservices.com	2026-07-28 10:47:03 (2 days ago)	(wordpress) Failed wordpress login from 103.211.135.238 (IN/India/238-135.211.103.static.gtplkcbpl.i ... show more (wordpress) Failed wordpress login from 103.211.135.238 (IN/India/238-135.211.103.static.gtplkcbpl.in) show less	Brute-Force
🇲🇾 Rizzy	2026-07-28 09:14:44 (2 days ago)	Multiple WAF Violations	Brute-Force Web App Attack
🇮🇹 CoreTech srl	2026-07-28 06:38:56 (2 days ago)	cloudlinux2 fail2ban: 2026-07-28 08:34:31,890 fail2ban.filter [1917]: INFO [plesk-wordpre ... show more cloudlinux2 fail2ban: 2026-07-28 08:34:31,890 fail2ban.filter [1917]: INFO [plesk-wordpress] Found 136.144.33.99 - 2026-07-28 08:34:30cloudlinux2 fail2ban: 2026-07-28 08:34:34,533 fail2ban.actions [1917]: NOTICE [plesk-modsecurity] Unban 223.185.62.250cloudlinux2 fail2ban: 2026-07-28 08:34:54,848 fail2ban.filter [1917]: INFO [plesk-modsecurity] Found 124.217.120.84 - 2026-07-28 08:34:54cloudlinux2 fail2ban: 2026-07-28 08:35:30,245 fail2ban.filter [1917]: INFO [plesk-modsecurity] Found 49.37.251.131 - 2026-07-28 08:35:30cloudlinux2 fail2ban: 2026-07-28 08:35:43,823 fail2ban.filter [1917]: INFO [plesk-modsecurity] Found 103.211.135.238 - 2026-07-28 08:35:43cloudlinux2 fail2ban: 2026-07-28 08:35:58,454 fail2ban.filter [1917]: INFO [plesk-modsecurity] Found 91.75.24.226 - 2026-07-28 08:35:58cloudlinux2 fail2ban: 2026-07-28 08:36:01,843 fail2ban.filter [1917]: INFO [plesk-modsecurity] Found 49.37.251.131 - 2026-07-28 08:36:01cloudlinux2 fail show less	Web App Attack
🇩🇪 ghostwarriors	2026-07-28 04:20:28 (2 days ago)	Webpage scraping	Brute-Force Bad Web Bot Web App Attack
Anonymous	2026-07-28 04:17:22 (2 days ago)	Fail2Ban: WordPress XML-RPC brute-force attack detected.	Bad Web Bot Web App Attack

Showing 1 to 15 of 17 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇳🇱 178.173.255.106

🇺🇸 146.190.63.59

🇨🇳 175.17.176.7

🇩🇴 148.101.25.8

🇵🇰 103.194.93.254

🇷🇴 92.118.39.145

🇺🇸 71.90.30.53

🇩🇪 43.228.157.8

🇷🇴 2.57.121.25

🇧🇷 177.44.191.61

🇸🇬 159.65.2.17

🇮🇳 103.204.167.40

🇬🇧 86.139.140.88

🇺🇸 47.251.73.89

🇰🇷 222.239.251.12

🇺🇸 208.109.38.65

🇫🇮 193.168.198.33

🇺🇦 176.101.194.30

🇫🇷 155.117.197.132

🇻🇳 103.176.20.115