JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 122.54.198.52

122.54.198.52 was found in our database!

This IP was reported 273 times. Confidence of Abuse is 87%: ?

87%

ISP	SMEBDO2016100426182_N. T. SY & CO. CPA'S
Usage Type	Fixed Line ISP
ASN	AS9299
Hostname(s)	corporatehost.1.static.ntsy-estinar.com
Domain Name	ntsy-estinar.com
Country	🇵🇭 Philippines
City	Manila, National Capital Region

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 122.54.198.52

Whois 122.54.198.52

IP Abuse Reports for 122.54.198.52:

This IP address has been reported a total of 273 times from 103 distinct sources. 122.54.198.52 was first reported on December 18th 2020, and the most recent report was 1 day ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇺🇸 TPI-Abuse	2026-07-11 08:23:57 (1 day ago)	(mod_security) mod_security (id:240335) triggered by 122.54.198.52 (corporatehost.1.static.ntsy-esti ... show more (mod_security) mod_security (id:240335) triggered by 122.54.198.52 (corporatehost.1.static.ntsy-estinar.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Jul 11 04:23:52.382300 2026] [security2:error] [pid 16756:tid 16844] [client 122.54.198.52:56204] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 122.54.198.52 (+1 hits since last alert)\|darkestmoonart.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "darkestmoonart.com"] [uri "/xmlrpc.php"] [unique_id "alH9mHkoiTITp3ycXFoaZQAAAYc"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-07-11 06:12:31 (1 day ago)	(mod_security) mod_security (id:240335) triggered by 122.54.198.52 (corporatehost.1.static.ntsy-esti ... show more (mod_security) mod_security (id:240335) triggered by 122.54.198.52 (corporatehost.1.static.ntsy-estinar.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Jul 11 02:12:24.914433 2026] [security2:error] [pid 25587:tid 25587] [client 122.54.198.52:63799] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 122.54.198.52 (+1 hits since last alert)\|jennyfiore.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "jennyfiore.com"] [uri "/xmlrpc.php"] [unique_id "alHeyNz3eIz4szxxJSSO_wAAAAY"] show less	Brute-Force Bad Web Bot Web App Attack
Anonymous	2026-07-11 04:39:45 (1 day ago)	(wordpress) Failed wordpress login from 122.54.198.52 (PH/Philippines/corporatehost.1.static.ntsy-es ... show more (wordpress) Failed wordpress login from 122.54.198.52 (PH/Philippines/corporatehost.1.static.ntsy-estinar.com) show less	Brute-Force
🇺🇸 TPI-Abuse	2026-07-11 02:40:36 (1 day ago)	(mod_security) mod_security (id:240335) triggered by 122.54.198.52 (corporatehost.1.static.ntsy-esti ... show more (mod_security) mod_security (id:240335) triggered by 122.54.198.52 (corporatehost.1.static.ntsy-estinar.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jul 10 22:40:30.394417 2026] [security2:error] [pid 4021:tid 4021] [client 122.54.198.52:64593] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 122.54.198.52 (+1 hits since last alert)\|anthonyanimalclinic.net\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "anthonyanimalclinic.net"] [uri "/xmlrpc.php"] [unique_id "alGtHo0JDADefs7udVSo3wAAAAI"] show less	Brute-Force Bad Web Bot Web App Attack
🇩🇪 LRob	2026-07-10 23:53:51 (1 day ago)	CrowdSec: crowdsecurity/http-bf-wordpress_bf_xmlrpc \| req: ["/xmlrpc.php"] \| UA: ["Jetpack by WordPr ... show more CrowdSec: crowdsecurity/http-bf-wordpress_bf_xmlrpc \| req: ["/xmlrpc.php"] \| UA: ["Jetpack by WordPress.com (Jetpack 13.0; WordPress 6.4)","Jetpack by WordPress.com (Jetpack 12.1; WordPress 6.2)","Jetpack by WordPress.com","WordPre show less	Brute-Force Web App Attack
Anonymous	2026-07-10 23:53:38 (1 day ago)	Fail2ban filtered ...	Web App Attack
🇺🇸 TPI-Abuse	2026-07-10 02:20:55 (2 days ago)	(mod_security) mod_security (id:240335) triggered by 122.54.198.52 (corporatehost.1.static.ntsy-esti ... show more (mod_security) mod_security (id:240335) triggered by 122.54.198.52 (corporatehost.1.static.ntsy-estinar.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jul 09 22:20:49.580088 2026] [security2:error] [pid 20601:tid 20601] [client 122.54.198.52:63766] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 122.54.198.52 (+1 hits since last alert)\|casadelsolmexico.net\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "casadelsolmexico.net"] [uri "/xmlrpc.php"] [unique_id "alBXASkDKd-Fpvo26O3z6gAAAAQ"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-07-10 01:08:15 (2 days ago)	(mod_security) mod_security (id:240335) triggered by 122.54.198.52 (corporatehost.1.static.ntsy-esti ... show more (mod_security) mod_security (id:240335) triggered by 122.54.198.52 (corporatehost.1.static.ntsy-estinar.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jul 09 21:08:10.954461 2026] [security2:error] [pid 2012:tid 2012] [client 122.54.198.52:62192] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 122.54.198.52 (+1 hits since last alert)\|savingspools.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "savingspools.com"] [uri "/xmlrpc.php"] [unique_id "alBF-rYSplIU-C58JePgzQAAABw"] show less	Brute-Force Bad Web Bot Web App Attack
Anonymous	2026-07-09 06:52:51 (3 days ago)	(wordpress) Failed wordpress login from 122.54.198.52 (PH/Philippines/corporatehost.1.static.ntsy-es ... show more (wordpress) Failed wordpress login from 122.54.198.52 (PH/Philippines/corporatehost.1.static.ntsy-estinar.com) show less	Brute-Force
🇺🇸 TPI-Abuse	2026-07-09 05:22:28 (3 days ago)	(mod_security) mod_security (id:240335) triggered by 122.54.198.52 (corporatehost.1.static.ntsy-esti ... show more (mod_security) mod_security (id:240335) triggered by 122.54.198.52 (corporatehost.1.static.ntsy-estinar.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jul 09 01:22:20.456464 2026] [security2:error] [pid 16418:tid 16418] [client 122.54.198.52:53917] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5965"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 122.54.198.52 (+1 hits since last alert)\|orcastrong.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "orcastrong.com"] [uri "/xmlrpc.php"] [unique_id "ak8wDAiztOQCPZg_ZQ_jewAAAAI"] show less	Brute-Force Bad Web Bot Web App Attack
🇫🇷 LRob	2026-07-07 03:17:20 (5 days ago)	CrowdSec: crowdsecurity/http-bf-wordpress_bf_xmlrpc \| req: ["/xmlrpc.php"] \| UA: ["Jetpack/13.0; Wor ... show more CrowdSec: crowdsecurity/http-bf-wordpress_bf_xmlrpc \| req: ["/xmlrpc.php"] \| UA: ["Jetpack/13.0; WordPress/6.2; http://site73392912.com","Jetpack by WordPress.com","Jetpack by WordPress.com (Jetpack 12.5; WordPress 6.2)","Jetpack b show less	Brute-Force Web App Attack
🇲🇾 Rizzy	2026-07-07 00:32:36 (5 days ago)	Multiple WAF Violations	Brute-Force Web App Attack
🇳🇱 Site.eu	2026-07-06 00:03:35 (6 days ago)	Repeated wp-login/xmlrpc attempts	Brute-Force SSH
🇺🇸 TAY	2026-07-03 07:10:24 (1 week ago)	122.54.198.52 - - [03/Jul/2026:15:10:02 +0800] "POST /xmlrpc.php HTTP/1.1" 200 5893 "-" "Jetpack by ... show more 122.54.198.52 - - [03/Jul/2026:15:10:02 +0800] "POST /xmlrpc.php HTTP/1.1" 200 5893 "-" "Jetpack by WordPress.com (Jetpack 12.0; WordPress 6.3)" 122.54.198.52 - - [03/Jul/2026:15:10:13 +0800] "POST /xmlrpc.php HTTP/1.1" 200 5893 "-" "Jetpack by WordPress.com" 122.54.198.52 - - [03/Jul/2026:15:10:23 +0800] "POST /xmlrpc.php HTTP/1.1" 200 5893 "-" "Jetpack/12.0; WordPress/6.4; http://site56848383.com" ... show less	Brute-Force
Anonymous	2026-07-03 02:33:58 (1 week ago)	122.54.198.52 - - [03/Jul/2026:04:33:36 +0200] "POST /xmlrpc.php HTTP/1.1" 200 593 "-" "Jetpack by W ... show more 122.54.198.52 - - [03/Jul/2026:04:33:36 +0200] "POST /xmlrpc.php HTTP/1.1" 200 593 "-" "Jetpack by WordPress.com (Jetpack 12.1; WordPress 6.4)" 122.54.198.52 - - [03/Jul/2026:04:33:37 +0200] "POST /xmlrpc.php HTTP/1.1" 200 403 "-" "Jetpack by WordPress.com (Jetpack 12.1; WordPress 6.4)" 122.54.198.52 - - [03/Jul/2026:04:33:45 +0200] "POST /xmlrpc.php HTTP/1.1" 200 593 "-" "Jetpack by WordPress.com (Jetpack 12.0; WordPress 6.3)" 122.54.198.52 - - [03/Jul/2026:04:33:47 +0200] "POST /xmlrpc.php HTTP/1.1" 200 403 "-" "Jetpack by WordPress.com (Jetpack 12.0; WordPress 6.3)" 122.54.198.52 - - [03/Jul/2026:04:33:56 +0200] "POST /xmlrpc.php HTTP/1.1" 200 593 "-" "Jetpack by WordPress.com" ... show less	Brute-Force Web App Attack

Showing 1 to 15 of 273 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇺🇸 108.178.17.26

🇺🇸 104.23.178.252

🇻🇳 103.98.151.100

🇺🇸 84.37.179.196

🇩🇪 80.253.251.6

🇺🇸 66.132.195.53

🇲🇾 49.124.147.109

🇨🇦 45.56.217.116

🇨🇳 8.134.111.31

🇺🇸 2a09:bac5:9444:3af::5e:5b

🇲🇾 2a02:4780:5e:1cec::1

🇰🇷 210.126.94.78

🇮🇳 183.82.124.235

🇳🇱 176.65.131.147

🇹🇭 150.95.66.172

🇺🇸 146.190.151.141

🇺🇸 136.144.43.86

🇩🇪 104.248.139.216

🇺🇸 104.23.178.136

🇦🇺 101.162.66.108