JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 120.56.98.171

120.56.98.171 was found in our database!

This IP was reported 23 times. Confidence of Abuse is 87%: ?

87%

ISP	Mahanagar Telephone Nigam Limited
Usage Type	Fixed Line ISP
ASN	AS9829
Domain Name	mtnl.net.in
Country	🇮🇳 India
City	Puducherry, Puducherry

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 120.56.98.171

Whois 120.56.98.171

IP Abuse Reports for 120.56.98.171:

This IP address has been reported a total of 23 times from 15 distinct sources. 120.56.98.171 was first reported on August 23rd 2026, and the most recent report was 2 days ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇫🇷 Yepngo	2026-08-24 11:38:17 (2 days ago)	120.56.98.171 - - [24/Aug/2026:13:38:07 +0200] "POST /xmlrpc.php HTTP/2.0" 200 410 "-" "Jetpack by W ... show more 120.56.98.171 - - [24/Aug/2026:13:38:07 +0200] "POST /xmlrpc.php HTTP/2.0" 200 410 "-" "Jetpack by WordPress.com (Jetpack 12.1; WordPress 6.1)" 120.56.98.171 - - [24/Aug/2026:13:38:16 +0200] "POST /xmlrpc.php HTTP/2.0" 200 410 "-" "Jetpack by WordPress.com" ... show less	Brute-Force Web App Attack
🇺🇸 TPI-Abuse	2026-08-24 10:09:09 (2 days ago)	(mod_security) mod_security (id:240335) triggered by 120.56.98.171 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:240335) triggered by 120.56.98.171 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Aug 24 06:09:01.312562 2026] [security2:error] [pid 1501:tid 1501] [client 120.56.98.171:54149] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 120.56.98.171 (+1 hits since last alert)\|aandbnaturalfoods.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "aandbnaturalfoods.com"] [uri "/xmlrpc.php"] [unique_id "aowYPSG0yPx9Az4Iw_JiKwAAAAw"] show less	Brute-Force Bad Web Bot Web App Attack
🇩🇪 LRob	2026-08-24 09:59:13 (2 days ago)	WordPress login brute-force \| path: /xmlrpc.php \| 2026-08-24 09:59 UTC	Brute-Force Web App Attack
🇫🇷 applemooz	2026-08-24 08:36:40 (2 days ago)	WordPress XMLRPC Brute Force Attacks ...	Brute-Force Web App Attack
Anonymous	2026-08-24 08:35:57 (2 days ago)	120.56.98.171 - - [24/Aug/2026:10:35:34 +0200] "POST /xmlrpc.php HTTP/1.1" 200 593 "-" "Jetpack by W ... show more 120.56.98.171 - - [24/Aug/2026:10:35:34 +0200] "POST /xmlrpc.php HTTP/1.1" 200 593 "-" "Jetpack by WordPress.com" 120.56.98.171 - - [24/Aug/2026:10:35:37 +0200] "POST /xmlrpc.php HTTP/1.1" 200 403 "-" "Jetpack by WordPress.com" 120.56.98.171 - - [24/Aug/2026:10:35:43 +0200] "POST /xmlrpc.php HTTP/1.1" 200 593 "-" "Jetpack by WordPress.com" 120.56.98.171 - - [24/Aug/2026:10:35:45 +0200] "POST /xmlrpc.php HTTP/1.1" 200 403 "-" "Jetpack by WordPress.com" 120.56.98.171 - - [24/Aug/2026:10:35:54 +0200] "POST /xmlrpc.php HTTP/1.1" 200 593 "-" "WordPress.com; https://wordpress.com" ... show less	Brute-Force Web App Attack
🇵🇱 Budyn	2026-08-24 07:46:12 (2 days ago)	Automated threat detected by Budyn Honeypot Sinkhole. Attack type: WP Path Scanning (Recon). Malicio ... show more Automated threat detected by Budyn Honeypot Sinkhole. Attack type: WP Path Scanning (Recon). Malicious scanner triggered a security trap targeting emulated vulnerabilities. Evidence: HOST: astropot.online \| URI: /xmlrpc.php \| UA: Jetpack/12.0; WordPress/6.3; http://site47821374.com \| BODY: <?xml version="1.0"?><methodCall><methodName>metaWeblog.newPost</methodName><params><param><value><string>1</string></value></param><param><value><string>65749</string></value></param><param><value><string>65749</string></value></param><param><value><struct><member><name>title</name><value><string>fehw95pu9n48y0</string></value></member><member><name>description</name><value><string>1lz7l9 show less	Bad Web Bot Web App Attack
🇩🇪 abdubhai	2026-08-24 05:08:22 (2 days ago)	120.56.98.171 - - [24/Aug/2026:1 ...	Brute-Force
🇺🇸 TPI-Abuse	2026-08-24 04:43:05 (2 days ago)	(mod_security) mod_security (id:240335) triggered by 120.56.98.171 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:240335) triggered by 120.56.98.171 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Aug 24 00:42:58.358955 2026] [security2:error] [pid 28891:tid 28891] [client 120.56.98.171:58409] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 120.56.98.171 (+1 hits since last alert)\|losbarbarosdelnorte.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "losbarbarosdelnorte.com"] [uri "/xmlrpc.php"] [unique_id "aovL0tsSYmhKHpnbGRy7ZgAAAAg"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 cwytech	2026-08-24 02:03:18 (2 days ago)	Fleet-wide ban from the Ghostfleet 👻. Triggered by scenario: cwy/wp-us-login-only-high.	Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-08-24 00:52:22 (2 days ago)	(mod_security) mod_security (id:240335) triggered by 120.56.98.171 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:240335) triggered by 120.56.98.171 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Aug 23 20:52:16.653632 2026] [security2:error] [pid 16834:tid 16834] [client 120.56.98.171:62165] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 120.56.98.171 (+1 hits since last alert)\|mirai-labo.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "mirai-labo.com"] [uri "/xmlrpc.php"] [unique_id "aouVwFSG-jh_DGScMC_kxgAAAAI"] show less	Brute-Force Bad Web Bot Web App Attack
🇹🇭 thaizone.com	2026-08-23 22:50:09 (2 days ago)	Brute-forcing login against websites (D1-1) #1	Web App Attack Hacking
🇺🇸 TPI-Abuse	2026-08-23 22:19:16 (2 days ago)	(mod_security) mod_security (id:240335) triggered by 120.56.98.171 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:240335) triggered by 120.56.98.171 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Aug 23 18:19:07.891535 2026] [security2:error] [pid 9007:tid 9007] [client 120.56.98.171:51379] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 120.56.98.171 (+1 hits since last alert)\|johncyphers.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "johncyphers.com"] [uri "/xmlrpc.php"] [unique_id "aotx20MIVwwjrZ1ycsbZHAAAAAE"] show less	Brute-Force Bad Web Bot Web App Attack
🇫🇷 masterguru	2026-08-23 20:41:54 (2 days ago)	(xmlrpc) Apache: Failed xmlrpc access from 120.56.98.171 (IN/India/-): 10 in the last 3600 secs (0-2 ... show more (xmlrpc) Apache: Failed xmlrpc access from 120.56.98.171 (IN/India/-): 10 in the last 3600 secs (0-201) show less	Hacking
Anonymous	2026-08-23 20:04:31 (2 days ago)	[redacted] 120.56.98.171 - - [23/Aug/2026:22:03:48 +0200] "POST /xmlrpc.php HTTP/1.1" 405 428 "-" "J ... show more [redacted] 120.56.98.171 - - [23/Aug/2026:22:03:48 +0200] "POST /xmlrpc.php HTTP/1.1" 405 428 "-" "Jetpack by WordPress.com (Jetpack 12.0; WordPress 6.2)" [redacted] 120.56.98.171 - - [23/Aug/2026:22:03:58 +0200] "POST /xmlrpc.php HTTP/1.1" 405 428 "-" "Jetpack/13.0; WordPress/6.1; http://site84879312.com" [redacted] 120.56.98.171 - - [23/Aug/2026:22:04:09 +0200] "POST /xmlrpc.php HTTP/1.1" 405 428 "-" "Jetpack by WordPress.com (Jetpack 12.0; WordPress 6.3)" [redacted] 120.56.98.171 - - [23/Aug/2026:22:04:19 +0200] "POST /xmlrpc.php HTTP/1.1" 405 428 "-" "Jetpack/12.0; WordPress/6.4; http://site13849512.com" [redacted] 120.56.98.171 - - [23/Aug/2026:22:04:30 +0200] "POST /xmlrpc.php HTTP/1.1" 405 428 "-" "Jetpack/12.1; WordPress/6.3; http://site15977000.com" ... show less	Hacking Web App Attack
🇩🇪 Marc	2026-08-23 19:33:16 (2 days ago)	120.56.98.171 - - [23/Aug/2026:21:32:54 +0200] "POST /xmlrpc.php HTTP/1.1" 200 5094 "-" "Jetpack by ... show more 120.56.98.171 - - [23/Aug/2026:21:32:54 +0200] "POST /xmlrpc.php HTTP/1.1" 200 5094 "-" "Jetpack by WordPress.com (Jetpack 12.0; WordPress 6.2)" 120.56.98.171 - - [23/Aug/2026:21:33:04 +0200] "POST /xmlrpc.php HTTP/1.1" 200 5094 "-" "Jetpack/12.0; WordPress/6.4; http://site80353034.com" 120.56.98.171 - - [23/Aug/2026:21:33:14 +0200] "POST /xmlrpc.php HTTP/1.1" 200 5092 "-" "Jetpack by WordPress.com (Jetpack 12.1; WordPress 6.4)" show less	Brute-Force Web App Attack

Showing 1 to 15 of 23 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇮🇳 210.16.82.189

🇯🇵 162.159.110.136

🇺🇸 152.32.208.7

🇳🇴 109.247.190.45

🇨🇿 80.78.136.43

🇰🇷 64.110.90.250

🇵🇱 51.68.151.167

🇭🇳 45.170.32.138

🇺🇸 23.234.103.201

🇺🇸 3.80.160.167

🇺🇸 195.184.76.246

🇳🇱 172.235.181.217

🇻🇳 157.66.225.224

🇱🇺 64.89.161.219

🇸🇬 47.128.57.40

🇳🇱 45.198.224.8

🇦🇷 200.59.88.193

🇨🇳 180.102.110.146

🇺🇸 162.240.148.144

🇵🇰 138.252.175.148