JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 112.203.56.85

112.203.56.85 was found in our database!

This IP was reported 38 times. Confidence of Abuse is 78%: ?

78%

ISP	IPG
Usage Type	Fixed Line ISP
ASN	AS9299
Hostname(s)	112.203.56.85.pldt.net
Domain Name	pldthome.com
Country	🇵🇭 Philippines
City	Quezon City, National Capital Region

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 112.203.56.85

Whois 112.203.56.85

IP Abuse Reports for 112.203.56.85:

This IP address has been reported a total of 38 times from 22 distinct sources. 112.203.56.85 was first reported on March 27th 2026, and the most recent report was 50 minutes ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇺🇸 kosada.com	2026-08-26 09:10:54 (50 minutes ago)	Web bot: denial-of-service flood	DDoS Attack Bad Web Bot
🇳🇱 Site.eu	2026-08-25 11:37:25 (22 hours ago)	Repeated wp-login/xmlrpc attempts	Brute-Force SSH
🇺🇸 kosada.com	2026-08-25 06:42:48 (1 day ago)	Web bot: denial-of-service flood	DDoS Attack Bad Web Bot
🇺🇸 TPI-Abuse	2026-08-24 14:53:09 (1 day ago)	(mod_security) mod_security (id:240335) triggered by 112.203.56.85 (112.203.56.85.pldt.net): 1 in th ... show more (mod_security) mod_security (id:240335) triggered by 112.203.56.85 (112.203.56.85.pldt.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Aug 24 10:53:02.286015 2026] [security2:error] [pid 18844:tid 18844] [client 112.203.56.85:58388] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 112.203.56.85 (+1 hits since last alert)\|usaenquirer.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "usaenquirer.com"] [uri "/xmlrpc.php"] [unique_id "aoxazo5Y7Yno77zcZXmacAAAABI"] show less	Brute-Force Bad Web Bot Web App Attack
Anonymous	2026-08-21 13:49:55 (4 days ago)	(wordpress) Failed wordpress login from 112.203.56.85 (PH/Philippines/112.203.56.85.pldt.net)	Brute-Force
🇲🇾 Rizzy	2026-08-20 09:26:33 (6 days ago)	Multiple WAF Violations	Brute-Force Web App Attack
🇺🇸 Lee Daniel	2026-08-20 03:16:51 (6 days ago)	[19/Aug/2026:23:16:00.324261 --0400] aoZxb0IHN8BgxLZsKP47-gAAAQQ 112.203.56.85 60404 127.0.0.1 7081 ... show more [19/Aug/2026:23:16:00.324261 --0400] aoZxb0IHN8BgxLZsKP47-gAAAQQ 112.203.56.85 60404 127.0.0.1 7081 [19/Aug/2026:23:16:11.305325 --0400] aoZxesvTfeDIV2Qu0ouR@gAAAJQ 112.203.56.85 56548 127.0.0.1 7081 [19/Aug/2026:23:16:22.250890 --0400] aoZxhcvTfeDIV2Qu0ouSHAAAAIc 112.203.56.85 53502 127.0.0.1 7081 [19/Aug/2026:23:16:34.370596 --0400] aoZxkcvTfeDIV2Qu0ouSPwAAAI0 112.203.56.85 37176 127.0.0.1 7081 [19/Aug/2026:23:16:50.839667 --0400] aoZxokIHN8BgxLZsKP48MAAAAQ4 112.203.56.85 34628 127.0.0.1 7081 ... show less	DDoS Attack Brute-Force
🇺🇸 integrantservices.com	2026-08-17 05:47:35 (1 week ago)	(wordpress) Failed wordpress login from 112.203.56.85 (PH/Philippines/-)	Brute-Force
🇩🇪 konseptit	2026-08-17 03:12:13 (1 week ago)	(wordpress) Failed wordpress login from 112.203.56.85 (PH/Philippines/-)	Brute-Force
🇺🇸 TPI-Abuse	2026-08-16 11:57:08 (1 week ago)	(mod_security) mod_security (id:240335) triggered by 112.203.56.85 (112.203.56.85.pldt.net): 1 in th ... show more (mod_security) mod_security (id:240335) triggered by 112.203.56.85 (112.203.56.85.pldt.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Aug 16 07:57:02.666548 2026] [security2:error] [pid 9594:tid 9594] [client 112.203.56.85:60712] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 112.203.56.85 (+1 hits since last alert)\|lumentravel.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "lumentravel.com"] [uri "/xmlrpc.php"] [unique_id "aoGljk3ouuAwz6nUYW6rbAAAAAM"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 WeekendWeb	2026-08-16 11:23:20 (1 week ago)	Wordpress Vunerability attack	Web App Attack
🇫🇮 bittiguru.fi	2026-08-15 02:05:18 (1 week ago)	112.203.56.85 - [15/Aug/2026:05:05:08 +0300] "POST /xmlrpc.php HTTP/1.1" 403 428 "-" "Jetpack/12.5; ... show more 112.203.56.85 - [15/Aug/2026:05:05:08 +0300] "POST /xmlrpc.php HTTP/1.1" 403 428 "-" "Jetpack/12.5; WordPress/6.4; http://site68887612.com" "-" 112.203.56.85 - [15/Aug/2026:05:05:17 +0300] "POST /xmlrpc.php HTTP/1.1" 403 428 "-" "Jetpack by WordPress.com" "-" ... show less	Hacking Brute-Force Web App Attack
🇫🇮 bittiguru.fi	2026-08-15 01:49:57 (1 week ago)	112.203.56.85 - [15/Aug/2026:04:49:46 +0300] "POST /xmlrpc.php HTTP/1.1" 403 428 "-" "Jetpack by Wor ... show more 112.203.56.85 - [15/Aug/2026:04:49:46 +0300] "POST /xmlrpc.php HTTP/1.1" 403 428 "-" "Jetpack by WordPress.com" "-" 112.203.56.85 - [15/Aug/2026:04:49:56 +0300] "POST /xmlrpc.php HTTP/1.1" 403 428 "-" "Jetpack/12.0; WordPress/6.3; http://site78431721.com" "-" ... show less	Hacking Brute-Force Web App Attack
🇺🇸 TPI-Abuse	2026-08-12 02:02:56 (2 weeks ago)	(mod_security) mod_security (id:240335) triggered by 112.203.56.85 (112.203.56.85.pldt.net): 1 in th ... show more (mod_security) mod_security (id:240335) triggered by 112.203.56.85 (112.203.56.85.pldt.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Aug 11 22:02:48.173386 2026] [security2:error] [pid 26240:tid 26240] [client 112.203.56.85:61446] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5965"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 112.203.56.85 (+1 hits since last alert)\|accommodation-perthairport.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "accommodation-perthairport.com"] [uri "/xmlrpc.php"] [unique_id "anvUSIq3DrA0BfuiVZItuQAAAA0"] show less	Brute-Force Bad Web Bot Web App Attack
🇲🇾 Rizzy	2026-08-12 01:00:30 (2 weeks ago)	Multiple WAF Violations	Brute-Force Web App Attack

Showing 1 to 15 of 38 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇩🇪 139.19.117.197

🇨🇳 223.85.251.61

🇮🇷 212.33.195.84

🇩🇪 167.94.146.73

🇮🇳 117.242.44.142

🇩🇪 104.248.248.85

🇺🇸 104.23.160.137

🇺🇸 104.23.160.132

🇺🇸 104.23.160.15

🇮🇷 94.182.157.184

🇱🇧 45.142.137.33

🇺🇸 18.211.245.221

🇺🇸 9.142.33.107

🇷🇸 217.16.136.169

🇺🇸 205.210.31.24

🇨🇱 190.20.37.98

🇳🇱 185.242.226.104

🇷🇺 95.24.129.20

🇹🇷 94.102.4.88

🇪🇸 77.227.4.199