JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 104.129.48.67

104.129.48.67 was found in our database!

This IP was reported 265 times. Confidence of Abuse is 0%: ?

ISP	HostPapa
Usage Type	Data Center/Web Hosting/Transit
ASN	AS203020
Domain Name	hostpapa.com
Country	🇧🇷 Brazil
City	Guarulhos, Sao Paulo

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 104.129.48.67

Whois 104.129.48.67

IP Abuse Reports for 104.129.48.67:

This IP address has been reported a total of 265 times from 60 distinct sources. 104.129.48.67 was first reported on June 24th 2023, and the most recent report was 2 years ago.

Old Reports: The most recent abuse report for this IP address is from 2 years ago . It is possible that this IP is no longer involved in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇺🇸 rsiddall	2024-02-09 00:59:02 (2 years ago)	104.129.48.67 - - [08/Feb/2024:19:57:10 -0500] "POST /xmlrpc.php HTTP/1.1" 403 212 "-" "Mozilla/5.0 ... show more 104.129.48.67 - - [08/Feb/2024:19:57:10 -0500] "POST /xmlrpc.php HTTP/1.1" 403 212 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36" 104.129.48.67 - - [08/Feb/2024:19:59:01 -0500] "POST /xmlrpc.php HTTP/1.1" 403 212 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36" ... show less	Brute-Force
🇺🇸 MortimerCat	2024-02-09 00:55:07 (2 years ago)	Attempting to exploit via a http POST	Web App Attack
🇺🇸 decisionconcepts	2024-02-09 00:54:49 (2 years ago)	GX620: Fail2Ban detected 2 attempts against wordpress from: 104.129.48.67	Brute-Force Web App Attack
🇺🇸 TPI-Abuse	2024-02-01 14:37:13 (2 years ago)	(mod_security) mod_security (id:240335) triggered by 104.129.48.67 (104.129.48.67.static.quadranet.c ... show more (mod_security) mod_security (id:240335) triggered by 104.129.48.67 (104.129.48.67.static.quadranet.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Feb 01 09:37:05.338998 2024] [security2:error] [pid 26943] [client 104.129.48.67:41574] [client 104.129.48.67] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 104.129.48.67 (+1 hits since last alert)\|engineeringarts.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "engineeringarts.com"] [uri "/xmlrpc.php"] [unique_id "ZbuskV3lr07IaGetkUo-TAAAACE"] show less	Brute-Force Bad Web Bot Web App Attack
🇩🇪 corthorn	2024-02-01 14:33:55 (2 years ago)	104.129.48.67 - - [01/Feb/2024:15:33:55 +0100] "POST /xmlrpc.php HTTP/1.1" 200 5946 "-" "Mozilla/5.0 ... show more 104.129.48.67 - - [01/Feb/2024:15:33:55 +0100] "POST /xmlrpc.php HTTP/1.1" 200 5946 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36" ... show less	Brute-Force
🇬🇧 Swiptly	2024-02-01 14:33:04 (2 years ago)	WordPress xmlrpc spam or enumeration ...	Web Spam Bad Web Bot Web App Attack
🇲🇹 Malta	2024-02-01 14:28:42 (2 years ago)	104.129.48.67 - - [01/Feb/2024:15:28:42 +0100] "POST /xmlrpc.php HTTP/1.1" "Mozilla/5.0 (Windows NT ... show more 104.129.48.67 - - [01/Feb/2024:15:28:42 +0100] "POST /xmlrpc.php HTTP/1.1" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36" Brute-force password attempt show less	Hacking Brute-Force Web App Attack
🇩🇪 ger-stg-sifi1	2024-02-01 14:23:26 (2 years ago)	(wordpress) Failed wordpress login using wp-login.php or xmlrpc.php	Web App Attack
🇺🇸 TPI-Abuse	2024-01-31 14:17:50 (2 years ago)	(mod_security) mod_security (id:240335) triggered by 104.129.48.67 (104.129.48.67.static.quadranet.c ... show more (mod_security) mod_security (id:240335) triggered by 104.129.48.67 (104.129.48.67.static.quadranet.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jan 31 09:17:44.733317 2024] [security2:error] [pid 16896] [client 104.129.48.67:38078] [client 104.129.48.67] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 104.129.48.67 (+1 hits since last alert)\|maartendouwebredero.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "maartendouwebredero.com"] [uri "/xmlrpc.php"] [unique_id "ZbpWiL0Qw8Irzem7ChJLbQAAAAg"] show less	Brute-Force Bad Web Bot Web App Attack
🇩🇪 corthorn	2024-01-31 14:11:22 (2 years ago)	104.129.48.67 - - [31/Jan/2024:15:11:21 +0100] "POST /xmlrpc.php HTTP/1.1" 200 5944 "-" "Mozilla/5.0 ... show more 104.129.48.67 - - [31/Jan/2024:15:11:21 +0100] "POST /xmlrpc.php HTTP/1.1" 200 5944 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36" ... show less	Brute-Force
🇺🇸 MortimerCat	2024-01-31 06:51:29 (2 years ago)	Attempting to exploit via a http POST	Web App Attack
🇩🇰 wnbhosting.dk	2024-01-31 05:57:22 (2 years ago)	WP xmlrpc [2024-01-31T06:57:22+01:00]	Hacking Web App Attack
🇩🇪 corthorn	2024-01-23 02:04:45 (2 years ago)	104.129.48.67 - - [23/Jan/2024:03:04:44 +0100] "POST /xmlrpc.php HTTP/1.1" 200 5948 "-" "Mozilla/5.0 ... show more 104.129.48.67 - - [23/Jan/2024:03:04:44 +0100] "POST /xmlrpc.php HTTP/1.1" 200 5948 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36" ... show less	Brute-Force
🇩🇪 rh24	2024-01-23 02:04:42 (2 years ago)	(wordpress) Failed wordpress login from 104.129.48.67 (US/United States/104.129.48.67.static.quadran ... show more (wordpress) Failed wordpress login from 104.129.48.67 (US/United States/104.129.48.67.static.quadranet.com): (CF_ENABLE) show less	Brute-Force
🇺🇸 TPI-Abuse	2024-01-23 02:02:37 (2 years ago)	(mod_security) mod_security (id:240335) triggered by 104.129.48.67 (104.129.48.67.static.quadranet.c ... show more (mod_security) mod_security (id:240335) triggered by 104.129.48.67 (104.129.48.67.static.quadranet.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jan 22 21:02:32.117585 2024] [security2:error] [pid 7282] [client 104.129.48.67:39794] [client 104.129.48.67] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 104.129.48.67 (+1 hits since last alert)\|havenlaneministries.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "havenlaneministries.com"] [uri "/xmlrpc.php"] [unique_id "Za8eODHvQcGepKiWEA2uzQAAAAA"] show less	Brute-Force Bad Web Bot Web App Attack

Showing 1 to 15 of 265 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇦🇷 200.112.132.70

🇲🇽 158.173.164.80

🇧🇷 20.226.5.174

🇨🇦 20.104.22.47

🇺🇸 2604:a880:2:d1:0:1:51e3:3001

🇨🇭 209.99.190.200

🇺🇸 208.75.123.134

🇧🇾 194.158.223.74

🇦🇴 193.163.125.41

🇧🇷 177.135.115.99

🇺🇸 174.163.176.212

🇺🇸 155.94.233.59

🇭🇰 152.32.185.141

🇰🇷 121.177.56.177

🇰🇷 112.184.38.109

🇧🇩 103.31.154.134

🇭🇰 101.36.110.41

🇳🇱 91.92.40.24

🇸🇪 78.66.86.90

🇧🇷 45.205.1.241