JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 112.203.54.71

112.203.54.71 was found in our database!

This IP was reported 39 times. Confidence of Abuse is 80%: ?

80%

ISP	IPG
Usage Type	Fixed Line ISP
ASN	AS9299
Hostname(s)	112.203.54.71.pldt.net
Domain Name	pldthome.com
Country	🇵🇭 Philippines
City	Quezon City, National Capital Region

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 112.203.54.71

Whois 112.203.54.71

IP Abuse Reports for 112.203.54.71:

This IP address has been reported a total of 39 times from 24 distinct sources. 112.203.54.71 was first reported on December 24th 2025, and the most recent report was 17 hours ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇳🇱 Site.eu	2026-08-25 11:43:40 (17 hours ago)	Repeated wp-login/xmlrpc attempts	Brute-Force SSH
🇺🇸 TPI-Abuse	2026-08-24 14:44:57 (1 day ago)	(mod_security) mod_security (id:240335) triggered by 112.203.54.71 (112.203.54.71.pldt.net): 1 in th ... show more (mod_security) mod_security (id:240335) triggered by 112.203.54.71 (112.203.54.71.pldt.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Aug 24 10:44:48.597026 2026] [security2:error] [pid 8083:tid 8083] [client 112.203.54.71:53909] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 112.203.54.71 (+1 hits since last alert)\|usaenquirer.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "usaenquirer.com"] [uri "/xmlrpc.php"] [unique_id "aoxY4ASw32FBahvTqBkW4QAAABE"] show less	Brute-Force Bad Web Bot Web App Attack
🇲🇾 Rizzy	2026-08-20 09:31:38 (5 days ago)	Multiple WAF Violations	Brute-Force Web App Attack
🇺🇸 Lee Daniel	2026-08-20 03:20:22 (6 days ago)	[19/Aug/2026:23:19:25.933174 --0400] aoZyPYtcPPlRf4SOvzxnWgAAAEc 112.203.54.71 43190 127.0.0.1 7081 ... show more [19/Aug/2026:23:19:25.933174 --0400] aoZyPYtcPPlRf4SOvzxnWgAAAEc 112.203.54.71 43190 127.0.0.1 7081 [19/Aug/2026:23:19:37.643386 --0400] aoZySSXcieu8KAEYl-8@BwAAAAc 112.203.54.71 34538 127.0.0.1 7081 [19/Aug/2026:23:19:47.893397 --0400] aoZyUyuzwLaU2hoH8ABV3QAAAdI 112.203.54.71 41290 127.0.0.1 7081 [19/Aug/2026:23:20:00.313982 --0400] aoZyXyXcieu8KAEYl-8@RQAAABU 112.203.54.71 59482 127.0.0.1 7081 [19/Aug/2026:23:20:22.386459 --0400] aoZydbfLpVqitS5OoViM2wAAAgQ 112.203.54.71 33966 127.0.0.1 7081 ... show less	DDoS Attack Brute-Force
🇺🇸 integrantservices.com	2026-08-17 05:13:55 (1 week ago)	(wordpress) Failed wordpress login from 112.203.54.71 (PH/Philippines/-)	Brute-Force
🇩🇪 konseptit	2026-08-17 03:15:12 (1 week ago)	(wordpress) Failed wordpress login from 112.203.54.71 (PH/Philippines/-)	Brute-Force
🇺🇸 TPI-Abuse	2026-08-16 12:05:28 (1 week ago)	(mod_security) mod_security (id:240335) triggered by 112.203.54.71 (112.203.54.71.pldt.net): 1 in th ... show more (mod_security) mod_security (id:240335) triggered by 112.203.54.71 (112.203.54.71.pldt.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Aug 16 08:05:24.329324 2026] [security2:error] [pid 5108:tid 5108] [client 112.203.54.71:51681] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 112.203.54.71 (+1 hits since last alert)\|lumentravel.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "lumentravel.com"] [uri "/xmlrpc.php"] [unique_id "aoGnhI-iRt_2EJf9exW9EgAAAAo"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 WeekendWeb	2026-08-16 11:25:01 (1 week ago)	Wordpress Vunerability attack	Web App Attack
🇫🇷 Sklurk	2026-08-15 07:00:59 (1 week ago)	Web App Attack	Web App Attack
🇫🇮 bittiguru.fi	2026-08-15 02:06:01 (1 week ago)	112.203.54.71 - [15/Aug/2026:05:05:50 +0300] "POST /xmlrpc.php HTTP/1.1" 403 428 "-" "WordPress.com; ... show more 112.203.54.71 - [15/Aug/2026:05:05:50 +0300] "POST /xmlrpc.php HTTP/1.1" 403 428 "-" "WordPress.com; https://wordpress.com" "-" 112.203.54.71 - [15/Aug/2026:05:06:01 +0300] "POST /xmlrpc.php HTTP/1.1" 403 428 "-" "Jetpack by WordPress.com" "-" ... show less	Hacking Brute-Force Web App Attack
🇫🇮 bittiguru.fi	2026-08-15 01:50:29 (1 week ago)	112.203.54.71 - [15/Aug/2026:04:50:18 +0300] "POST /xmlrpc.php HTTP/1.1" 403 428 "-" "WordPress.com; ... show more 112.203.54.71 - [15/Aug/2026:04:50:18 +0300] "POST /xmlrpc.php HTTP/1.1" 403 428 "-" "WordPress.com; https://wordpress.com" "-" 112.203.54.71 - [15/Aug/2026:04:50:28 +0300] "POST /xmlrpc.php HTTP/1.1" 403 428 "-" "Jetpack by WordPress.com (Jetpack 12.5; WordPress 6.1)" "-" ... show less	Hacking Brute-Force Web App Attack
🇺🇸 TPI-Abuse	2026-08-12 02:07:13 (2 weeks ago)	(mod_security) mod_security (id:240335) triggered by 112.203.54.71 (112.203.54.71.pldt.net): 1 in th ... show more (mod_security) mod_security (id:240335) triggered by 112.203.54.71 (112.203.54.71.pldt.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Aug 11 22:07:06.421939 2026] [security2:error] [pid 1677:tid 1677] [client 112.203.54.71:57604] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5965"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 112.203.54.71 (+1 hits since last alert)\|accommodation-perthairport.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "accommodation-perthairport.com"] [uri "/xmlrpc.php"] [unique_id "anvVSpoJ0BplhKAuU3IkuAAAAB4"] show less	Brute-Force Bad Web Bot Web App Attack
🇲🇾 Rizzy	2026-08-12 00:57:29 (2 weeks ago)	Multiple WAF Violations	Brute-Force Web App Attack
🇺🇸 IndigoRidge	2026-08-09 06:09:33 (2 weeks ago)	112.203.54.71 - - [09/Aug/2026:02:06:59 -0400] "POST /xmlrpc.php HTTP/1.1" 200 5072 "-" "WordPress.c ... show more 112.203.54.71 - - [09/Aug/2026:02:06:59 -0400] "POST /xmlrpc.php HTTP/1.1" 200 5072 "-" "WordPress.com; https://wordpress.com" 112.203.54.71 - - [09/Aug/2026:02:07:32 -0400] "POST /xmlrpc.php HTTP/1.1" 200 5072 "-" "WordPress.com; https://wordpress.com" 112.203.54.71 - - [09/Aug/2026:02:08:15 -0400] "POST /xmlrpc.php HTTP/1.1" 200 5072 "-" "WordPress.com; https://wordpress.com" 112.203.54.71 - - [09/Aug/2026:02:08:26 -0400] "POST /xmlrpc.php HTTP/1.1" 200 5072 "-" "WordPress.com; https://wordpress.com" 112.203.54.71 - - [09/Aug/2026:02:09:32 -0400] "POST /xmlrpc.php HTTP/1.1" 200 5072 "-" "WordPress.com; https://wordpress.com" ... show less	Web App Attack
🇳🇱 Site.eu	2026-08-07 04:24:09 (2 weeks ago)	Repeated wp-login/xmlrpc attempts	Brute-Force SSH

Showing 1 to 15 of 39 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇮🇷 217.60.255.130

🇰🇷 175.195.238.137

🇿🇦 102.64.34.138

🇺🇸 66.132.172.245

🇵🇰 202.47.51.204

🇬🇧 193.163.125.42

🇲🇽 187.190.132.92

🇧🇷 186.238.210.226

🇺🇸 172.110.223.82

🇳🇱 45.148.10.151

🇰🇭 45.119.135.7

🇧🇪 35.240.17.233

🇺🇸 17.253.31.139

🇱🇹 213.176.26.54

🇺🇬 196.0.54.114

🇦🇹 194.182.172.95

🇨🇳 182.46.252.6

🇬🇧 154.16.44.114

🇺🇸 148.74.12.227

🇺🇸 136.70.89.107