JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 124.107.20.111

124.107.20.111 was found in our database!

This IP was reported 63 times. Confidence of Abuse is 61%: ?

61%

ISP	IPG
Usage Type	Fixed Line ISP
ASN	AS9299
Hostname(s)	124.107.20.111.pldt.net
Domain Name	pldthome.com
Country	🇵🇭 Philippines
City	Bacolod City, Western Visayas

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 124.107.20.111

Whois 124.107.20.111

IP Abuse Reports for 124.107.20.111:

This IP address has been reported a total of 63 times from 21 distinct sources. 124.107.20.111 was first reported on April 18th 2026, and the most recent report was 9 hours ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇫🇷 dynamix	2026-07-18 12:20:08 (9 hours ago)	WordPress XMLRPC Brute Force Attack	Brute-Force Web App Attack
🇺🇸 TPI-Abuse	2026-07-16 20:19:02 (2 days ago)	(mod_security) mod_security (id:240335) triggered by 124.107.20.111 (124.107.20.111.pldt.net): 1 in ... show more (mod_security) mod_security (id:240335) triggered by 124.107.20.111 (124.107.20.111.pldt.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jul 16 16:18:54.384190 2026] [security2:error] [pid 11979:tid 12049] [client 124.107.20.111:51338] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 124.107.20.111 (+1 hits since last alert)\|tradersofficepark.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "tradersofficepark.com"] [uri "/xmlrpc.php"] [unique_id "alk8rqUgNcXyKZ82ltgwNQAAAU0"] show less	Brute-Force Bad Web Bot Web App Attack
🇫🇷 dynamix	2026-07-14 18:03:01 (4 days ago)	WordPress XMLRPC Brute Force Attack	Brute-Force Web App Attack
Anonymous	2026-07-14 16:55:28 (4 days ago)	(wordpress) Failed wordpress login from 124.107.20.111 (PH/Philippines/Province of Pampanga/Santa An ... show more (wordpress) Failed wordpress login from 124.107.20.111 (PH/Philippines/Province of Pampanga/Santa Ana/124.107.20.111.pldt.net/[redacted]) show less	Brute-Force
Anonymous	2026-07-14 13:34:30 (4 days ago)	124.107.20.111 - - [14/Jul/2026:15:34:28 +0200] "POST /xmlrpc.php HTTP/1.1" 405 428 ...	Brute-Force Bad Web Bot
🇩🇪 pscriptos	2026-07-13 15:06:33 (5 days ago)	{"ClientAddr":"124.107.20.111:64167","ClientHost":"124.107.20.111","ClientPort":"64167","ClientUsern ... show more {"ClientAddr":"124.107.20.111:64167","ClientHost":"124.107.20.111","ClientPort":"64167","ClientUsername":"-","DownstreamContentSize":418,"DownstreamStatus":403,"Duration":137113446,"OriginContentSize":418,"OriginDuration":134224078,"OriginStatus":403,"Overhead":2889368,"RequestAddr":"www.cleveradmin.de","RequestContentSize":709,"RequestCount":1009309,"RequestHost":"www.cleveradmin.de","RequestMethod":"POST","RequestPath":"/xmlrpc.php","RequestPort":"-","RequestProtocol":"HTTP/1.1","RequestScheme":"https","RetryAttempts":0,"RouterName":"cleveradmin-www-websecure@file","ServiceAddr":"172.16.80.10:80","ServiceName":"cleveradmin-www@file","ServiceURL":"http://172.16.80.10:80","StartLocal":"2026-07-13T17:06:14.428839739+02:00","StartUTC":"2026-07-13T15:06:14.428839739Z","TLSCipher":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","TLSVersion":"1.2","entryPointName":"websecure","level":"info","msg":"","time":"2026-07-13T17:06:14+02:00"} {"ClientAddr":"124.107.20.111:64167","ClientHost":"124.107.20.11 ... show less	Brute-Force Web App Attack
Anonymous	2026-07-13 15:03:14 (5 days ago)	124.107.20.111 - - [13/Jul/2026:16:59:02 +0200] "POST /xmlrpc.php HTTP/1.1" 405 428 124.107.20.111 - ... show more 124.107.20.111 - - [13/Jul/2026:16:59:02 +0200] "POST /xmlrpc.php HTTP/1.1" 405 428 124.107.20.111 - - [13/Jul/2026:17:03:12 +0200] "POST /xmlrpc.php HTTP/1.1" 405 428 ... show less	Brute-Force Bad Web Bot
🇺🇸 WeekendWeb	2026-07-08 11:11:37 (1 week ago)	Wordpress Vunerability attack	Web App Attack
🇦🇺 screwlooseit.com.au	2026-06-29 10:51:59 (2 weeks ago)	Blocked by CSF 13 firewall - Rule: XMLRPC PH/Philippines/124.107.20.111.pldt.net	Web App Attack
🇪🇸 SweetHoneyPress	2026-06-28 15:57:58 (2 weeks ago)	WordPress honeypot: POST to /xmlrpc.php \| event_id=890147 \| UA: Jetpack by WordPress.com	Web App Attack Brute-Force
🇪🇸 SweetHoneyPress	2026-06-28 15:38:00 (2 weeks ago)	WordPress honeypot: POST to /xmlrpc.php \| event_id=881795 \| UA: Jetpack/12.5; WordPress/6.3; http:// ... show more WordPress honeypot: POST to /xmlrpc.php \| event_id=881795 \| UA: Jetpack/12.5; WordPress/6.3; http://site54898751.com show less	Web App Attack Brute-Force
🇩🇪 rh24	2026-06-27 20:31:25 (3 weeks ago)	(xmlrpc_405) XMLRPC-Bot 405 124.107.20.111 (PH/Philippines/124.107.20.111.pldt.net)	Hacking
🇫🇷 dynamix	2026-06-26 20:49:36 (3 weeks ago)	WordPress XMLRPC Brute Force Attack	Brute-Force Web App Attack
🇺🇸 TPI-Abuse	2026-06-26 12:58:43 (3 weeks ago)	(mod_security) mod_security (id:240335) triggered by 124.107.20.111 (124.107.20.111.pldt.net): 1 in ... show more (mod_security) mod_security (id:240335) triggered by 124.107.20.111 (124.107.20.111.pldt.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jun 26 08:58:37.510108 2026] [security2:error] [pid 30341:tid 30341] [client 124.107.20.111:61252] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5965"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 124.107.20.111 (+1 hits since last alert)\|drgtek.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "drgtek.com"] [uri "/xmlrpc.php"] [unique_id "aj53fdfew-WbRVn91hYgwAAAAAc"] show less	Brute-Force Bad Web Bot Web App Attack
🇫🇷 dynamix	2026-06-25 16:49:31 (3 weeks ago)	WordPress XMLRPC Brute Force Attack	Brute-Force Web App Attack

Showing 1 to 15 of 63 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇺🇸 66.132.172.193

🇺🇸 2606:c700:1:69:d8a2:1cac:fcc2:9b89

🇺🇸 2606:c700:1:69:c864:2ad4:eba6:46ad

🇨🇳 182.242.168.143

🇨🇳 175.19.74.156

🇸🇪 171.25.158.82

🇺🇸 162.216.150.99

🇨🇳 139.212.71.155

🇩🇪 78.111.67.61

🇩🇪 66.151.43.37

🇳🇱 45.148.17.22

🇨🇳 36.106.167.45

🇬🇧 35.203.211.80

🇬🇧 35.203.210.250

🇬🇧 35.203.210.55

🇷🇴 2.57.121.25

🇺🇸 2606:c700:1:69:b047:8390:4d9:de07

🇺🇸 2606:c700:1:69:7c61:fa35:b14:dd19

🇺🇸 2606:c700:1:69:6eb5:ceb2:672a:9847

🇧🇷 177.129.251.24