JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 110.38.243.38

110.38.243.38 was found in our database!

This IP was reported 10 times. Confidence of Abuse is 40%: ?

40%

ISP	National Wimax/IMS environment
Usage Type	Fixed Line ISP
ASN	AS139879
Hostname(s)	GPONUser38243-38.wateen.net
Domain Name	wateen.com
Country	🇵🇰 Pakistan
City	Karachi, Sindh

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 110.38.243.38

Whois 110.38.243.38

IP Abuse Reports for 110.38.243.38:

This IP address has been reported a total of 10 times from 6 distinct sources. 110.38.243.38 was first reported on July 12th 2026, and the most recent report was 7 hours ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇺🇸 TPI-Abuse	2026-07-22 21:46:52 (7 hours ago)	(mod_security) mod_security (id:240335) triggered by 110.38.243.38 (GPONUser38243-38.wateen.net): 1 ... show more (mod_security) mod_security (id:240335) triggered by 110.38.243.38 (GPONUser38243-38.wateen.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jul 22 17:46:48.502821 2026] [security2:error] [pid 1005088:tid 1005088] [client 110.38.243.38:31435] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 110.38.243.38 (+1 hits since last alert)\|kildarafarms.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "kildarafarms.com"] [uri "/xmlrpc.php"] [unique_id "amE6SBUmsHi-EO5lkbYbOAAAAAY"] show less	Brute-Force Bad Web Bot Web App Attack
Anonymous	2026-07-22 21:43:03 (7 hours ago)	Bot / scanning and/or hacking attempts: POST /xmlrpc.php HTTP/1.1	Hacking Web App Attack
🇺🇸 TPI-Abuse	2026-07-21 19:38:59 (1 day ago)	(mod_security) mod_security (id:240335) triggered by 110.38.243.38 (GPONUser38243-38.wateen.net): 1 ... show more (mod_security) mod_security (id:240335) triggered by 110.38.243.38 (GPONUser38243-38.wateen.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jul 21 15:38:54.289336 2026] [security2:error] [pid 13983:tid 13983] [client 110.38.243.38:31958] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 110.38.243.38 (+1 hits since last alert)\|stoneybluff.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "stoneybluff.com"] [uri "/xmlrpc.php"] [unique_id "al_Kzo3GIujh0FLaH5fwGgAAABk"] show less	Brute-Force Bad Web Bot Web App Attack
🇳🇱 tmiland	2026-07-21 19:33:49 (1 day ago)	(wordpress_xmlrpc) WordPress XMLPRC Attack 110.38.243.38 (PK/Pakistan/GPONUser38243-38.wateen.net): ... show more (wordpress_xmlrpc) WordPress XMLPRC Attack 110.38.243.38 (PK/Pakistan/GPONUser38243-38.wateen.net): 3 in the last 3600 secs; IP: 110.38.243.38; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: 110.38.243.38 - - [21/Jul/2026:21:33:26 +0200] "POST /xmlrpc.php HTTP/1.1" 200 415 "-" "Jetpack/13.0; WordPress/6.3; http://site34318611.com" 110.38.243.38 - - [21/Jul/2026:21:33:34 +0200] "POST /xmlrpc.php HTTP/1.1" 200 415 "-" "Jetpack by WordPress.com" 110.38.243.38 - - [21/Jul/2026:21:33:45 +0200] "POST /xmlrpc.php HTTP/1.1" 200 415 "-" "Jetpack by WordPress.com" show less	Brute-Force
🇺🇸 TPI-Abuse	2026-07-21 08:54:33 (1 day ago)	(mod_security) mod_security (id:240335) triggered by 110.38.243.38 (GPONUser38243-38.wateen.net): 1 ... show more (mod_security) mod_security (id:240335) triggered by 110.38.243.38 (GPONUser38243-38.wateen.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jul 21 04:54:28.234377 2026] [security2:error] [pid 2580:tid 2580] [client 110.38.243.38:32629] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 110.38.243.38 (+1 hits since last alert)\|coolcustomproducts.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "coolcustomproducts.com"] [uri "/xmlrpc.php"] [unique_id "al8zxExq6FNAbMiXj96QkwAAAA8"] show less	Brute-Force Bad Web Bot Web App Attack
🇦🇺 screwlooseit.com.au	2026-07-13 21:18:41 (1 week ago)	Blocked by CSF 13 firewall - Rule: XMLRPC PK/Pakistan/GPONUser38243-38.wateen.net	Web App Attack
🇩🇪 dbmwebdesign	2026-07-13 18:10:14 (1 week ago)	WordPress login brute-force detected by Fail2Ban in plesk-wordpress jail	Brute-Force Web App Attack
🇺🇸 integrantservices.com	2026-07-13 09:33:24 (1 week ago)	(wordpress) Failed wordpress login from 110.38.243.38 (PK/Pakistan/GPONUser38243-38.wateen.net)	Brute-Force
🇺🇸 TPI-Abuse	2026-07-13 09:30:13 (1 week ago)	(mod_security) mod_security (id:240335) triggered by 110.38.243.38 (GPONUser38243-38.wateen.net): 1 ... show more (mod_security) mod_security (id:240335) triggered by 110.38.243.38 (GPONUser38243-38.wateen.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jul 13 05:30:05.571212 2026] [security2:error] [pid 23729:tid 23746] [client 110.38.243.38:49236] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 110.38.243.38 (+1 hits since last alert)\|davidholls.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "davidholls.com"] [uri "/xmlrpc.php"] [unique_id "alSwHWT-50BkivZ4MOLiNQAAAQ8"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-07-12 20:38:14 (1 week ago)	(mod_security) mod_security (id:240335) triggered by 110.38.243.38 (GPONUser38243-38.wateen.net): 1 ... show more (mod_security) mod_security (id:240335) triggered by 110.38.243.38 (GPONUser38243-38.wateen.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Jul 12 16:38:05.775435 2026] [security2:error] [pid 2382:tid 2382] [client 110.38.243.38:49315] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 110.38.243.38 (+1 hits since last alert)\|localpetsitters.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "localpetsitters.com"] [uri "/xmlrpc.php"] [unique_id "alP7LW7ICZm-gnXyZH8IgQAAAAc"] show less	Brute-Force Bad Web Bot Web App Attack

Showing 1 to 10 of 10 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇨🇳 220.167.232.194

🇺🇸 216.180.246.234

🇺🇸 216.25.89.132

🇮🇩 182.1.214.97

🇻🇳 152.32.160.252

🇿🇦 102.254.1.18

🇩🇪 92.218.122.20

🇷🇴 92.118.39.234

🇳🇱 89.21.67.175

🇱🇹 81.30.98.47

🇷🇺 77.222.115.20

🇺🇸 66.207.178.5

🇺🇸 34.132.170.80

🇬🇧 188.240.59.38

🇺🇸 137.184.10.48

🇵🇰 124.29.226.106

🇨🇳 118.178.85.34

🇻🇳 113.172.102.20

🇷🇴 92.118.39.229

🇨🇦 85.217.149.61