JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 103.39.128.144

103.39.128.144 was found in our database!

This IP was reported 18 times. Confidence of Abuse is 69%: ?

69%

ISP	Gtpl Broadband Pvt. Ltd.
Usage Type	Fixed Line ISP
ASN	AS45916
Domain Name	gtpl.net
Country	🇮🇳 India
City	Vadodara, Gujarat

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 103.39.128.144

Whois 103.39.128.144

IP Abuse Reports for 103.39.128.144:

This IP address has been reported a total of 18 times from 12 distinct sources. 103.39.128.144 was first reported on May 5th 2025, and the most recent report was 1 day ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇺🇸 BlueStem123	2026-08-25 00:00:17 (1 day ago)	Automated scanner targeting WordPress installations. Source produced sustained scanning activity exc ... show more Automated scanner targeting WordPress installations. Source produced sustained scanning activity exceeding 100 requests within a 60-minute window. show less	Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-08-24 17:45:41 (2 days ago)	(mod_security) mod_security (id:240335) triggered by 103.39.128.144 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:240335) triggered by 103.39.128.144 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Aug 24 13:45:37.584825 2026] [security2:error] [pid 25259:tid 25259] [client 103.39.128.144:41562] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 103.39.128.144 (+1 hits since last alert)\|barecreationsaz.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "barecreationsaz.com"] [uri "/xmlrpc.php"] [unique_id "aoyDQfVTOaaq4H9k0os14gAAAAM"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-08-24 13:17:21 (2 days ago)	(mod_security) mod_security (id:240335) triggered by 103.39.128.144 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:240335) triggered by 103.39.128.144 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Aug 24 09:17:17.194116 2026] [security2:error] [pid 15076:tid 15076] [client 103.39.128.144:42004] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 103.39.128.144 (+1 hits since last alert)\|saynotoofland.org\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "saynotoofland.org"] [uri "/xmlrpc.php"] [unique_id "aoxEXfpNCKT3siaYVULSswAAAAQ"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-08-24 11:45:50 (2 days ago)	(mod_security) mod_security (id:240335) triggered by 103.39.128.144 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:240335) triggered by 103.39.128.144 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Aug 24 07:45:41.886102 2026] [security2:error] [pid 17508:tid 17508] [client 103.39.128.144:42389] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 103.39.128.144 (+1 hits since last alert)\|mayiasteadman.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "mayiasteadman.com"] [uri "/xmlrpc.php"] [unique_id "aowu5Yylw9JQJhqqYCpRGAAAAAQ"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-08-24 11:13:52 (2 days ago)	(mod_security) mod_security (id:240335) triggered by 103.39.128.144 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:240335) triggered by 103.39.128.144 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Aug 24 07:13:44.575093 2026] [security2:error] [pid 31323:tid 31323] [client 103.39.128.144:52875] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 103.39.128.144 (+1 hits since last alert)\|femalegamblers.org\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "femalegamblers.org"] [uri "/xmlrpc.php"] [unique_id "aownaJfibNZePLhQB4RlrwAAAAQ"] show less	Brute-Force Bad Web Bot Web App Attack
🇳🇱 Site.eu	2026-08-24 10:11:23 (2 days ago)	Repeated wp-login/xmlrpc attempts	Brute-Force SSH
Anonymous	2026-08-24 09:09:55 (2 days ago)	(wordpress) Failed wordpress login from 103.39.128.144 (IN/India/-)	Brute-Force
🇺🇸 integrantservices.com	2026-08-24 09:09:45 (2 days ago)	(wordpress) Failed wordpress login from 103.39.128.144 (IN/India/-)	Brute-Force
🇺🇸 TPI-Abuse	2026-08-24 04:13:36 (2 days ago)	(mod_security) mod_security (id:240335) triggered by 103.39.128.144 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:240335) triggered by 103.39.128.144 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Aug 24 00:13:29.251172 2026] [security2:error] [pid 32410:tid 32410] [client 103.39.128.144:41599] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 103.39.128.144 (+1 hits since last alert)\|michaelthompson.biz\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "michaelthompson.biz"] [uri "/xmlrpc.php"] [unique_id "aovE6WtrBsrh0w5PmotyqQAAAAQ"] show less	Brute-Force Bad Web Bot Web App Attack
🇧🇪 cmbplf	2026-08-24 02:30:27 (2 days ago)	3.418 requests with url.path */xmlrpc.php	Brute-Force Bad Web Bot
Anonymous	2026-08-24 02:28:12 (2 days ago)	[redacted] 103.39.128.144 - - [24/Aug/2026:04:27:29 +0200] "POST /xmlrpc.php HTTP/1.1" 405 428 "-" " ... show more [redacted] 103.39.128.144 - - [24/Aug/2026:04:27:29 +0200] "POST /xmlrpc.php HTTP/1.1" 405 428 "-" "Jetpack by WordPress.com" [redacted] 103.39.128.144 - - [24/Aug/2026:04:27:39 +0200] "POST /xmlrpc.php HTTP/1.1" 405 428 "-" "Jetpack by WordPress.com" [redacted] 103.39.128.144 - - [24/Aug/2026:04:27:50 +0200] "POST /xmlrpc.php HTTP/1.1" 405 428 "-" "Jetpack by WordPress.com" [redacted] 103.39.128.144 - - [24/Aug/2026:04:28:00 +0200] "POST /xmlrpc.php HTTP/1.1" 405 428 "-" "Jetpack/12.5; WordPress/6.4; http://site74344231.com" [redacted] 103.39.128.144 - - [24/Aug/2026:04:28:11 +0200] "POST /xmlrpc.php HTTP/1.1" 405 428 "-" "Jetpack/12.1; WordPress/6.1; http://site65013489.com" ... show less	Hacking Web App Attack
Anonymous	2026-08-24 01:57:04 (2 days ago)	Bot / scanning and/or hacking attempts: POST /xmlrpc.php HTTP/1.1	Hacking Web App Attack
🇺🇸 xmission.com	2026-08-24 01:26:15 (2 days ago)	103.39.128.144 - - [23/Aug/2026:19:26:15 -0600] "POST /xmlrpc.php HTTP/1.1" 200 415 "-" "WordPress.c ... show more 103.39.128.144 - - [23/Aug/2026:19:26:15 -0600] "POST /xmlrpc.php HTTP/1.1" 200 415 "-" "WordPress.com; https://wordpress.com" ... show less	Web App Attack
🇫🇷 masterguru	2026-08-23 23:55:41 (2 days ago)	(xmlrpc) Apache: Failed xmlrpc access from 103.39.128.144 (IN/India/-): 10 in the last 3600 secs (0- ... show more (xmlrpc) Apache: Failed xmlrpc access from 103.39.128.144 (IN/India/-): 10 in the last 3600 secs (0-201) show less	Hacking
🇺🇸 TPI-Abuse	2026-08-23 22:56:52 (2 days ago)	(mod_security) mod_security (id:240335) triggered by 103.39.128.144 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:240335) triggered by 103.39.128.144 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Aug 23 18:56:46.731373 2026] [security2:error] [pid 2432139:tid 2432155] [client 103.39.128.144:42076] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 103.39.128.144 (+1 hits since last alert)\|giere.us\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "giere.us"] [uri "/xmlrpc.php"] [unique_id "aot6rsdodmt1v-_MCm40fgAAAQ4"] show less	Brute-Force Bad Web Bot Web App Attack

Showing 1 to 15 of 18 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇨🇳 180.76.105.165

🇸🇬 165.232.164.223

🇺🇸 109.105.210.75

🇺🇸 216.25.89.90

🇳🇱 195.178.110.227

🇩🇪 130.12.180.107

🇯🇵 96.126.130.210

🇺🇸 20.172.182.212

🇺🇸 2603:300b:4a0:0:c803:3277:83d1:d678

🇺🇸 205.210.31.60

🇨🇳 182.43.235.75

🇮🇳 172.68.147.185

🇸🇬 118.194.233.182

🇷🇺 94.26.130.173

🇺🇸 71.185.255.106

🇺🇸 71.27.86.44

🇺🇸 52.249.217.235

🇺🇸 51.8.108.105

🇨🇦 20.48.179.39

🇫🇷 2400:cb00:987:1000:79fb:b6c7:24ff:c50d