JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 124.104.202.252

124.104.202.252 was found in our database!

This IP was reported 18 times. Confidence of Abuse is 74%: ?

74%

ISP	HOME_DSL
Usage Type	Fixed Line ISP
ASN	AS9299
Hostname(s)	124.104.202.252.pldt.net
Domain Name	pldthome.com
Country	🇵🇭 Philippines
City	Olongapo, Central Luzon

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 124.104.202.252

Whois 124.104.202.252

IP Abuse Reports for 124.104.202.252:

This IP address has been reported a total of 18 times from 13 distinct sources. 124.104.202.252 was first reported on July 3rd 2026, and the most recent report was 12 minutes ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇮🇩 Burayot	2026-07-16 22:42:34 (12 minutes ago)	LF_MODSEC: (mod_security) mod_security (id:1000001) triggered by 124.104.202.252 (PH/Philippines/124 ... show more LF_MODSEC: (mod_security) mod_security (id:1000001) triggered by 124.104.202.252 (PH/Philippines/124.104.202.252.pldt.net): 1 in the last 3600 secs show less	Web App Attack
🇨🇭 4server	2026-07-16 16:40:55 (6 hours ago)	[ThuJul1618:40:50.9740422026][security2:error][pid491614:tid491644][client124.104.202.252:0]ModSecur ... show more [ThuJul1618:40:50.9740422026][security2:error][pid491614:tid491644][client124.104.202.252:0]ModSecurity:Accessdeniedwithcode403\(phase1\).Stringmatch\"/xmlrpc.php\"atREQUEST_URI.[file\"/etc/apache2/conf.d/modsec_custom_rules.conf\"][line\"368\"][id\"960024\"][msg\"XML-RPCdisabled\"][hostname\"support-ticino.ch\"][uri\"/xmlrpc.php\"][unique_id\"alkJkuQd-1Bg9j9fmi3CAgAAAI8\"] show less	Hacking Web App Attack
🇩🇪 rh24	2026-07-16 14:58:41 (7 hours ago)	(xmlrpc_405) XMLRPC-Bot 405 124.104.202.252 (PH/Philippines/124.104.202.252.pldt.net)	Hacking
🇺🇸 TPI-Abuse	2026-07-15 19:26:17 (1 day ago)	(mod_security) mod_security (id:225170) triggered by 124.104.202.252 (124.104.202.252.pldt.net): 1 i ... show more (mod_security) mod_security (id:225170) triggered by 124.104.202.252 (124.104.202.252.pldt.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jul 15 15:26:11.932901 2026] [security2:error] [pid 13505:tid 13510] [client 124.104.202.252:61629] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)\|\|leadingedgesupply.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "leadingedgesupply.com"] [uri "/wp-json/wp/v2/users"] [unique_id "alfe0zU3VGRQN8JA0KumiAAAAIE"] show less	Brute-Force Bad Web Bot Web App Attack
🇩🇰 ScamAware	2026-07-15 18:26:35 (1 day ago)	Detected by Cloudflare Security Events via WordPress automation. Detection: bad_bot_scanner (Bad bot ... show more Detected by Cloudflare Security Events via WordPress automation. Detection: bad_bot_scanner (Bad bot / scanner behavior). Hits from same IP in last 60 minutes: 1. Unique request paths counted internally: 1. Cloudflare action: block. Cloudflare source: firewallCustom. show less	Bad Web Bot
🇺🇸 cwytech	2026-07-14 00:20:52 (2 days ago)	Fleet-wide ban from the Ghostfleet 👻. Triggered by scenario: cwy/wp-us-login-only-high.	Bad Web Bot Web App Attack
🇫🇷 SpaceHost-Server	2026-07-12 03:21:59 (4 days ago)	124.104.202.252 - - [12/Jul/2026:05:21:29 +0200] "POST /xmlrpc.php HTTP/1.1" 200 6398 "-" "Mozilla/5 ... show more 124.104.202.252 - - [12/Jul/2026:05:21:29 +0200] "POST /xmlrpc.php HTTP/1.1" 200 6398 "-" "Mozilla/5.0 (Windows NT 6.3; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.0.0 Safari/537.36" 124.104.202.252 - - [12/Jul/2026:05:21:40 +0200] "POST /xmlrpc.php HTTP/1.1" 200 6398 "-" "Mozilla/5.0 (Windows NT 6.2; arm64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36" 124.104.202.252 - - [12/Jul/2026:05:21:56 +0200] "POST /xmlrpc.php HTTP/1.1" 200 6398 "-" "Mozilla/5.0 (Linux; Android 10; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.0.0 Safari/537.36" show less	Hacking Web App Attack
🇫🇷 dynamix	2026-07-12 03:15:35 (4 days ago)	WordPress XMLRPC Brute Force Attack	Brute-Force Web App Attack
🇫🇷 SpaceHost-Server	2026-07-12 03:06:11 (4 days ago)	124.104.202.252 - - [12/Jul/2026:05:05:24 +0200] "POST /xmlrpc.php HTTP/1.1" 200 6398 "-" "Mozilla/5 ... show more 124.104.202.252 - - [12/Jul/2026:05:05:24 +0200] "POST /xmlrpc.php HTTP/1.1" 200 6398 "-" "Mozilla/5.0 (Windows NT 6.2; x86) AppleWebKit/537.36 (KHTML, like Gecko) Opera/60.0.0.0 Safari/537.36" 124.104.202.252 - - [12/Jul/2026:05:05:48 +0200] "POST /xmlrpc.php HTTP/1.1" 200 6398 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; arm64) AppleWebKit/537.36 (KHTML, like Gecko) Edge/92.0.0.0 Safari/537.36" 124.104.202.252 - - [12/Jul/2026:05:06:10 +0200] "POST /xmlrpc.php HTTP/1.1" 200 6398 "-" "Mozilla/5.0 (Linux; Android 10; arm64) AppleWebKit/537.36 (KHTML, like Gecko) Edge/81.0.0.0 Safari/537.36" show less	Hacking Web App Attack
🇫🇮 inlink.ltd	2026-07-12 01:34:19 (4 days ago)	Known malicious PHP file or CMS probe	Web App Attack
🇺🇸 TPI-Abuse	2026-07-10 20:28:45 (6 days ago)	(mod_security) mod_security (id:225170) triggered by 124.104.202.252 (124.104.202.252.pldt.net): 1 i ... show more (mod_security) mod_security (id:225170) triggered by 124.104.202.252 (124.104.202.252.pldt.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jul 10 16:28:42.139355 2026] [security2:error] [pid 7646:tid 7646] [client 124.104.202.252:63900] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)\|\|aandbnaturalfoods.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "aandbnaturalfoods.com"] [uri "/wp-json/wp/v2/users"] [unique_id "alFV-n4Z-9ihhreyGbnjhQAAAAk"] show less	Brute-Force Bad Web Bot Web App Attack
🇦🇺 screwlooseit.com.au	2026-07-09 23:19:22 (6 days ago)	Blocked by CSF 13 firewall - Rule: XMLRPC PH/Philippines/124.104.202.252.pldt.net	Web App Attack
🇺🇸 TPI-Abuse	2026-07-09 20:20:07 (1 week ago)	(mod_security) mod_security (id:225170) triggered by 124.104.202.252 (124.104.202.252.pldt.net): 1 i ... show more (mod_security) mod_security (id:225170) triggered by 124.104.202.252 (124.104.202.252.pldt.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jul 09 16:19:58.790172 2026] [security2:error] [pid 14787:tid 14787] [client 124.104.202.252:63618] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)\|\|owldreamllc.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "owldreamllc.com"] [uri "/wp-json/wp/v2/users"] [unique_id "alACbpbJv_KVyf1xuu4wlAAAAAk"] show less	Brute-Force Bad Web Bot Web App Attack
Anonymous	2026-07-09 20:12:14 (1 week ago)	124.104.202.252 - - [09/Jul/2026:20:12:12 +0000] "POST /xmlrpc.php HTTP/1.1" 404 50067 "-" "Mozilla/ ... show more 124.104.202.252 - - [09/Jul/2026:20:12:12 +0000] "POST /xmlrpc.php HTTP/1.1" 404 50067 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; x86) AppleWebKit/537.36 (KHTML, like Gecko) Safari/14.0.0.0 Safari/537.36" ... show less	Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-07-09 13:43:16 (1 week ago)	(mod_security) mod_security (id:225170) triggered by 124.104.202.252 (124.104.202.252.pldt.net): 1 i ... show more (mod_security) mod_security (id:225170) triggered by 124.104.202.252 (124.104.202.252.pldt.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jul 09 09:43:11.752351 2026] [security2:error] [pid 29432:tid 29432] [client 124.104.202.252:61409] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)\|\|lacycustombuilt.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "lacycustombuilt.com"] [uri "/wp-json/wp/v2/users"] [unique_id "ak-lb_fYkSJyTYFrzARp1wAAAAw"] show less	Brute-Force Bad Web Bot Web App Attack

Showing 1 to 15 of 18 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇳🇱 91.92.40.15

🇺🇸 2602:fa59:10:cb9::1

🇹🇼 198.235.24.125

🇵🇱 176.53.159.197

🇵🇰 175.107.237.243

🇰🇷 121.173.173.48

🇺🇸 100.58.179.89

🇩🇪 82.82.143.196

🇩🇪 46.101.235.18

🇩🇪 43.228.157.200

🇻🇳 14.225.253.26

🇮🇷 2.182.119.204

🇲🇽 187.171.55.218

🇷🇴 80.94.92.234

🇺🇸 66.132.195.22

🇨🇳 49.72.111.25

🇰🇷 222.239.251.12

🇨🇳 116.26.10.54

🇰🇷 115.140.161.61

🇮🇹 83.224.148.56