JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 103.252.216.225

103.252.216.225 was found in our database!

This IP was reported 11 times. Confidence of Abuse is 48%: ?

48%

ISP	GURGAON CONSULTANCY
Usage Type	Fixed Line ISP
ASN	AS132453
Hostname(s)	216.252.103.in-addr.tripleplay.in
Domain Name	tripleplay.in
Country	🇮🇳 India
City	Gurugram, Haryana

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 103.252.216.225

Whois 103.252.216.225

IP Abuse Reports for 103.252.216.225:

This IP address has been reported a total of 11 times from 10 distinct sources. 103.252.216.225 was first reported on February 23rd 2025, and the most recent report was 2 hours ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇺🇸 TPI-Abuse	2026-07-17 03:58:43 (2 hours ago)	(mod_security) mod_security (id:240335) triggered by 103.252.216.225 (216.252.103.in-addr.tripleplay ... show more (mod_security) mod_security (id:240335) triggered by 103.252.216.225 (216.252.103.in-addr.tripleplay.in): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jul 16 23:58:37.447118 2026] [security2:error] [pid 3993010:tid 3993010] [client 103.252.216.225:8993] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 103.252.216.225 (+1 hits since last alert)\|denkyusalesca.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "denkyusalesca.com"] [uri "/xmlrpc.php"] [unique_id "almobePEJCzbYE1zps-wxwAAAAg"] show less	Brute-Force Bad Web Bot Web App Attack
Anonymous	2026-07-17 03:21:07 (2 hours ago)	Bot / scanning and/or hacking attempts: POST /xmlrpc.php HTTP/1.1	Hacking Web App Attack
🇺🇸 Dolphi	2026-07-17 03:00:05 (3 hours ago)	Excessive POST /xmlrpc.php requests	Brute-Force Web App Attack
🇺🇸 IndigoRidge	2026-07-17 02:52:37 (3 hours ago)	103.252.216.225 - - [16/Jul/2026:22:50:40 -0400] "POST /xmlrpc.php HTTP/1.0" 200 5266 "-" "WordPress ... show more 103.252.216.225 - - [16/Jul/2026:22:50:40 -0400] "POST /xmlrpc.php HTTP/1.0" 200 5266 "-" "WordPress.com; https://wordpress.com" 103.252.216.225 - - [16/Jul/2026:22:51:01 -0400] "POST /xmlrpc.php HTTP/1.0" 200 5266 "-" "WordPress.com; https://wordpress.com" 103.252.216.225 - - [16/Jul/2026:22:51:43 -0400] "POST /xmlrpc.php HTTP/1.0" 200 5266 "-" "WordPress.com; https://wordpress.com" 103.252.216.225 - - [16/Jul/2026:22:52:15 -0400] "POST /xmlrpc.php HTTP/1.0" 200 5266 "-" "WordPress.com; https://wordpress.com" 103.252.216.225 - - [16/Jul/2026:22:52:36 -0400] "POST /xmlrpc.php HTTP/1.0" 200 5266 "-" "WordPress.com; https://wordpress.com" ... show less	Web App Attack
🇺🇸 TPI-Abuse	2026-07-17 02:12:26 (4 hours ago)	(mod_security) mod_security (id:240335) triggered by 103.252.216.225 (216.252.103.in-addr.tripleplay ... show more (mod_security) mod_security (id:240335) triggered by 103.252.216.225 (216.252.103.in-addr.tripleplay.in): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jul 16 22:12:18.232120 2026] [security2:error] [pid 29943:tid 29943] [client 103.252.216.225:7101] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 103.252.216.225 (+1 hits since last alert)\|thorndikestudio.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "thorndikestudio.com"] [uri "/xmlrpc.php"] [unique_id "almPgqjYGG02HTcj85eThgAAAAY"] show less	Brute-Force Bad Web Bot Web App Attack
🇫🇷 dynamix	2026-07-04 00:33:53 (1 week ago)	WordPress XMLRPC Brute Force Attack	Brute-Force Web App Attack
🇧🇪 cmbplf	2026-07-03 23:34:18 (1 week ago)	11.935 requests with url.path */xmlrpc.php	Brute-Force Bad Web Bot
🇲🇾 Rizzy	2026-07-03 22:47:58 (1 week ago)	Multiple WAF Violations	Brute-Force Web App Attack
🇫🇷 tecnicorioja	2026-07-03 22:00:20 (1 week ago)	POST /xmlrpc.php [03/Jul/2026:13:42:28	Brute-Force Web App Attack
🇺🇸 TTWebhosting	2025-08-28 08:30:06 (10 months ago)	(ftpd) Failed FTP login from 103.252.216.225 (IN/India/Haryana/Gurugram/216.252.103.in-addr.triplepl ... show more (ftpd) Failed FTP login from 103.252.216.225 (IN/India/Haryana/Gurugram/216.252.103.in-addr.tripleplay.in/[AS132453 TRIPLE PLAY BROADBAND PRIVATE LIMITED]): 1 in the last 3600 secs show less	FTP Brute-Force Port Scan Hacking Brute-Force
Anonymous	2025-02-23 02:02:53 (1 year ago)	At 2025-02-23T02:02:52Z UTC, there were denied connections from IP 103.252.216.225 to port(s) 61536. ... show more At 2025-02-23T02:02:52Z UTC, there were denied connections from IP 103.252.216.225 to port(s) 61536. Action performed: deny. Assigned categories: 15. show less	Hacking

Showing 1 to 11 of 11 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇬🇧 185.216.145.173

🇵🇱 176.53.159.198

🇱🇹 141.98.11.129

🇲🇦 81.192.46.49

🇺🇸 31.59.13.152

🇺🇸 198.199.94.79

🇬🇧 193.32.209.230

🇸🇬 157.52.92.25

🇺🇸 143.198.181.124

🇨🇳 118.123.116.93

🇫🇷 91.231.89.155

🇩🇪 69.5.169.196

🇺🇸 64.62.156.145

🇲🇩 45.15.226.100

🇸🇾 5.0.12.119

🇺🇿 213.230.111.14

🇹🇼 198.235.24.105

🇺🇸 195.184.76.12

🇬🇧 193.176.29.9

🇫🇮 147.185.133.117