JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 103.25.137.125

103.25.137.125 was found in our database!

This IP was reported 99 times. Confidence of Abuse is 79%: ?

79%

ISP	Satcomm (Pvt.) Ltd.
Usage Type	Fixed Line ISP
ASN	AS38713
Domain Name	satcomm.pk
Country	🇵🇰 Pakistan
City	Karachi, Sindh

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 103.25.137.125

Whois 103.25.137.125

IP Abuse Reports for 103.25.137.125:

This IP address has been reported a total of 99 times from 43 distinct sources. 103.25.137.125 was first reported on February 24th 2026, and the most recent report was 20 hours ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇫🇷 Kenshin869	2026-08-27 09:50:41 (20 hours ago)	Wordpress unauthorized access attempt	Brute-Force
🇫🇷 masterguru	2026-08-27 08:13:51 (21 hours ago)	(xmlrpc) Apache: Failed xmlrpc access from 103.25.137.125 (PK/Pakistan/-): 10 in the last 3600 secs ... show more (xmlrpc) Apache: Failed xmlrpc access from 103.25.137.125 (PK/Pakistan/-): 10 in the last 3600 secs (0-201) show less	Hacking
🇺🇸 TPI-Abuse	2026-08-25 12:19:23 (2 days ago)	(mod_security) mod_security (id:240335) triggered by 103.25.137.125 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:240335) triggered by 103.25.137.125 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Aug 25 08:19:18.193953 2026] [security2:error] [pid 9491:tid 9491] [client 103.25.137.125:50351] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5965"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 103.25.137.125 (+1 hits since last alert)\|kontikimotorcycles.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "kontikimotorcycles.com"] [uri "/xmlrpc.php"] [unique_id "ao2IRqgNedvQQr1mSpFhPQAAAAk"] show less	Brute-Force Bad Web Bot Web App Attack
🇹🇷 ycoskun41	2026-08-25 12:15:50 (2 days ago)	fail2ban: plesk-modsecurity jail on genckocaeli.com	Web App Attack
🇺🇸 TPI-Abuse	2026-08-25 07:03:03 (2 days ago)	(mod_security) mod_security (id:240335) triggered by 103.25.137.125 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:240335) triggered by 103.25.137.125 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Aug 25 03:02:54.346218 2026] [security2:error] [pid 18132:tid 18132] [client 103.25.137.125:58564] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5965"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 103.25.137.125 (+1 hits since last alert)\|whodatnation.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "whodatnation.com"] [uri "/xmlrpc.php"] [unique_id "ao0-Hm3tZe_kB0iEKmJbBAAAABM"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 cwytech	2026-08-24 11:51:05 (3 days ago)	Fleet-wide ban from the Ghostfleet 👻. Triggered by scenario: cwy/wp-us-login-only-high.	Bad Web Bot Web App Attack
🇳🇱 Site.eu	2026-08-24 07:41:36 (3 days ago)	Repeated wp-login/xmlrpc attempts	Brute-Force SSH
🇩🇪 ghostwarriors	2026-08-21 11:20:50 (6 days ago)	Webpage scraping	Brute-Force Bad Web Bot Web App Attack
🇳🇱 Site.eu	2026-08-21 09:16:08 (6 days ago)	Repeated wp-login/xmlrpc attempts	Brute-Force SSH
🇺🇸 TPI-Abuse	2026-08-21 05:11:28 (1 week ago)	(mod_security) mod_security (id:240335) triggered by 103.25.137.125 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:240335) triggered by 103.25.137.125 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Aug 21 01:11:19.140146 2026] [security2:error] [pid 22127:tid 22127] [client 103.25.137.125:64808] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 103.25.137.125 (+1 hits since last alert)\|buanamegah.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "buanamegah.com"] [uri "/xmlrpc.php"] [unique_id "aofd95K3Ipmfkn9292Gz4AAAAAQ"] show less	Brute-Force Bad Web Bot Web App Attack
Anonymous	2026-08-20 08:20:53 (1 week ago)	[redacted] 103.25.137.125 - - [20/Aug/2026:10:20:11 +0200] "POST /xmlrpc.php HTTP/1.1" 405 428 "-" " ... show more [redacted] 103.25.137.125 - - [20/Aug/2026:10:20:11 +0200] "POST /xmlrpc.php HTTP/1.1" 405 428 "-" "Jetpack/12.5; WordPress/6.2; http://site51849116.com" [redacted] 103.25.137.125 - - [20/Aug/2026:10:20:21 +0200] "POST /xmlrpc.php HTTP/1.1" 405 428 "-" "Jetpack by WordPress.com" [redacted] 103.25.137.125 - - [20/Aug/2026:10:20:32 +0200] "POST /xmlrpc.php HTTP/1.1" 405 428 "-" "WordPress.com; https://wordpress.com" [redacted] 103.25.137.125 - - [20/Aug/2026:10:20:42 +0200] "POST /xmlrpc.php HTTP/1.1" 405 428 "-" "WordPress.com; https://wordpress.com" [redacted] 103.25.137.125 - - [20/Aug/2026:10:20:53 +0200] "POST /xmlrpc.php HTTP/1.1" 405 428 "-" "WordPress.com; https://wordpress.com" ... show less	Hacking Web App Attack
🇫🇷 applemooz	2026-08-20 07:45:44 (1 week ago)	WordPress XMLRPC Brute Force Attacks ...	Brute-Force Web App Attack
🇺🇸 TPI-Abuse	2026-08-20 06:00:30 (1 week ago)	(mod_security) mod_security (id:240335) triggered by 103.25.137.125 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:240335) triggered by 103.25.137.125 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Aug 20 02:00:24.484966 2026] [security2:error] [pid 6822:tid 6822] [client 103.25.137.125:57373] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 103.25.137.125 (+1 hits since last alert)\|inverzona.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "inverzona.com"] [uri "/xmlrpc.php"] [unique_id "aoaX-B_YeTlAkH9Ufe2x2wAAAAE"] show less	Brute-Force Bad Web Bot Web App Attack
Anonymous	2026-08-18 10:15:21 (1 week ago)	(wordpress) Failed wordpress login from 103.25.137.125 (PK/Pakistan/-/-/-/[redacted])	Brute-Force
🇺🇸 integrantservices.com	2026-08-18 10:14:48 (1 week ago)	(wordpress) Failed wordpress login from 103.25.137.125 (PK/Pakistan/-)	Brute-Force

Showing 1 to 15 of 99 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇱🇹 213.176.26.69

🇲🇦 196.92.7.246

🇮🇳 122.160.85.144

🇨🇳 47.103.157.194

🇺🇸 40.77.179.83

🇺🇸 24.144.107.27

🇻🇪 201.249.87.203

🇭🇰 152.32.169.155

🇺🇸 147.185.132.138

🇺🇸 136.24.208.89

🇺🇸 104.236.19.165

🇮🇩 103.26.188.10

🇷🇴 92.118.39.77

🇪🇸 90.160.117.76

🇺🇸 71.6.147.254

🇫🇷 54.38.241.200

🇩🇪 51.224.232.24

🇺🇸 47.251.253.98

🇬🇧 35.203.211.39

🇺🇸 2001:470:1:c84::2a3