JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 103.239.138.71

103.239.138.71 was found in our database!

This IP was reported 48 times. Confidence of Abuse is 100%: ?

100%

ISP	Cloud Operation Pvt Ltd
Usage Type	Data Center/Web Hosting/Transit
ASN	AS17439
Hostname(s)	lserver071-mum.megavelocity.net
Domain Name	cloudops.in
Country	🇮🇳 India
City	Mumbai, Maharashtra

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 103.239.138.71

Whois 103.239.138.71

IP Abuse Reports for 103.239.138.71:

This IP address has been reported a total of 48 times from 32 distinct sources. 103.239.138.71 was first reported on August 28th 2026, and the most recent report was 10 minutes ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇫🇷 Yepngo	2026-08-28 19:06:22 (10 minutes ago)	103.239.138.71 - - [28/Aug/2026:20:27:31 +0200] "POST /wp-login.php HTTP/2.0" 200 12503 "https://dev ... show more 103.239.138.71 - - [28/Aug/2026:20:27:31 +0200] "POST /wp-login.php HTTP/2.0" 200 12503 "https://dev.yepngo.com/wp-login.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36" 103.239.138.71 - - [28/Aug/2026:21:06:21 +0200] "POST /wp-login.php HTTP/2.0" 200 12510 "https://blog.yepngo.com/wp-login.php" "Mozilla/5.0 (X11; Linux i686) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36" ... show less	Brute-Force Web App Attack
🇮🇹 VHosting	2026-08-28 19:00:05 (16 minutes ago)	Detected WordPress attack from different servers	Brute-Force Web App Attack
🇨🇿 ptlab	2026-08-28 18:45:28 (31 minutes ago)	Detected wp_login attack from WP-host.	Hacking Web App Attack
🇺🇸 xxkodedxx	2026-08-28 18:45:04 (31 minutes ago)	[Zorvexus edge-defense] GET .env / WordPress honeypot probe Trigger: 1× honeypot-get in 10m window. ... show more [Zorvexus edge-defense] GET .env / WordPress honeypot probe Trigger: 1× honeypot-get in 10m window. Active: 18:44:29 UTC Volume: 1 honeypot probe(s) Bait taken: /wp-json/wp/v2/users?_fields=slug&per_page=100&page=1 UA: "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36" Auto-banned 30d. zorvexus-banner. show less	Bad Web Bot Web App Attack
🇳🇱 BlueWire Hosting	2026-08-28 18:24:30 (52 minutes ago)	Probing websites for vulnerabilities	Web App Attack SQL Injection
🇩🇪 stinpriza	2026-08-28 18:03:38 (1 hour ago)	Web App Attack	Web App Attack
🇩🇪 ger-stg-sifi1	2026-08-28 18:03:21 (1 hour ago)	(wordpress) Failed wordpress login using wp-login.php or xmlrpc.php	Web App Attack
🇺🇸 TPI-Abuse	2026-08-28 17:58:46 (1 hour ago)	(mod_security) mod_security (id:225170) triggered by 103.239.138.71 (lserver071-mum.megavelocity.net ... show more (mod_security) mod_security (id:225170) triggered by 103.239.138.71 (lserver071-mum.megavelocity.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Aug 28 13:58:41.085051 2026] [security2:error] [pid 13457:tid 13457] [client 103.239.138.71:51642] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)\|\|frenchla.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "frenchla.com"] [uri "/wp-json/wp/v2/users"] [unique_id "apHMURFDvMWWHzWvmLmJVgAAABk"] show less	Brute-Force Bad Web Bot Web App Attack
Anonymous	2026-08-28 17:32:11 (1 hour ago)	(wordpress) Failed login wp-login.php or xmlrpc.php	Web App Attack
🇩🇪 neckaralb-admin.de	2026-08-28 17:21:10 (1 hour ago)	(wordpress) Failed login wp-login.php or xmlrpc.php	Web App Attack
🇦🇺 2000cn.com.au	2026-08-28 17:13:46 (2 hours ago)	This IP was detected by CrowdSec triggering crowdsecurity/http-cve-probing	Web App Attack Hacking
🇮🇹 CoreTech srl	2026-08-28 17:03:56 (2 hours ago)	cloudlinux2 fail2ban: 2026-08-28 18:59:19,154 fail2ban.filter [1478]: INFO [plesk-modsecu ... show more cloudlinux2 fail2ban: 2026-08-28 18:59:19,154 fail2ban.filter [1478]: INFO [plesk-modsecurity] Found 212.227.154.251 - 2026-08-28 18:59:19cloudlinux2 fail2ban: 2026-08-28 18:59:27,273 fail2ban.actions [1478]: NOTICE [plesk-modsecurity] Unban 8.231.230.97cloudlinux2 fail2ban: 2026-08-28 18:59:32,277 fail2ban.filter [1478]: INFO [plesk-modsecurity] Found 103.239.138.71 - 2026-08-28 18:59:32cloudlinux2 fail2ban: 2026-08-28 18:59:47,811 fail2ban.filter [1478]: INFO [plesk-modsecurity] Found 8.228.108.49 - 2026-08-28 18:59:47cloudlinux2 fail2ban: 2026-08-28 19:00:44,135 fail2ban.filter [1478]: INFO [plesk-modsecurity] Found 153.67.129.155 - 2026-08-28 19:00:44cloudlinux2 fail2ban: 2026-08-28 19:02:14,345 fail2ban.filter [1478]: INFO [plesk-modsecurity] Found 153.67.129.155 - 2026-08-28 19:02:14cloudlinux2 fail2ban: 2026-08-28 19:02:25,494 fail2ban.actions [1478]: NOTICE [plesk-modsecurity] Ban 153.67.129.155cloudlinux2 fail2ban: 2026-08-28 19:0 show less	Brute-Force
🇺🇸 TPI-Abuse	2026-08-28 17:01:29 (2 hours ago)	(mod_security) mod_security (id:225170) triggered by 103.239.138.71 (lserver071-mum.megavelocity.net ... show more (mod_security) mod_security (id:225170) triggered by 103.239.138.71 (lserver071-mum.megavelocity.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Aug 28 13:01:21.530640 2026] [security2:error] [pid 24101:tid 24101] [client 103.239.138.71:60294] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)\|\|67ronin.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "67ronin.com"] [uri "/wp-json/wp/v2/users"] [unique_id "apG-4cIWUV6EXYlyvQawmwAAAA0"] show less	Brute-Force Bad Web Bot Web App Attack
🇩🇪 Marc	2026-08-28 16:38:55 (2 hours ago)	103.239.138.71 - - [28/Aug/2026:18:38:08 +0200] "GET /wp-json/wp/v2/users?_fields=slug&per_page=100& ... show more 103.239.138.71 - - [28/Aug/2026:18:38:08 +0200] "GET /wp-json/wp/v2/users?_fields=slug&per_page=100&page=1 HTTP/2.0" 404 483 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36" 103.239.138.71 - - [28/Aug/2026:18:38:31 +0200] "GET /author-sitemap.xml HTTP/2.0" 404 483 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36" 103.239.138.71 - - [28/Aug/2026:18:38:55 +0200] "POST /xmlrpc.php HTTP/2.0" 404 254 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36" show less	Brute-Force
🇮🇪 Coolnagour	2026-08-28 16:19:18 (2 hours ago)	http-probing: /wp-json/ldlms/v1/users	Web App Attack

Showing 1 to 15 of 48 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇦🇷 200.105.94.68

🇳🇱 195.178.110.217

🇳🇱 195.178.110.30

🇺🇸 91.230.168.232

🇳🇱 45.148.10.141

🇸🇬 157.245.144.157

🇮🇷 152.89.12.101

🇺🇸 146.190.175.10

🇺🇸 146.70.211.45

🇵🇰 103.55.70.54

🇳🇬 102.140.97.134

🇩🇪 69.5.169.187

🇨🇭 45.59.117.74

🇺🇸 216.25.89.70

🇫🇮 178.20.210.151

🇺🇸 135.119.92.120

🇮🇳 125.18.219.234

🇫🇷 92.154.95.236

🇷🇺 85.95.166.40

🇷🇴 80.94.92.234