JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 130.131.200.48

130.131.200.48 was found in our database!

This IP was reported 36 times. Confidence of Abuse is 100%: ?

100%

ISP	Microsoft Limited
Usage Type	Data Center/Web Hosting/Transit
ASN	AS8075
Domain Name	microsoft.com
Country	🇺🇸 United States of America
City	Des Moines, Iowa

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 130.131.200.48

Whois 130.131.200.48

IP Abuse Reports for 130.131.200.48:

This IP address has been reported a total of 36 times from 24 distinct sources. 130.131.200.48 was first reported on July 2nd 2026, and the most recent report was 11 hours ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇫🇷 tecnicorioja	2026-07-02 22:01:22 (11 hours ago)	POST /xmlrpc.php [02/Jul/2026:20:47:07	Web App Attack Brute-Force
🇬🇷 setupgr	2026-07-02 21:59:52 (11 hours ago)	(XMLRPC) WP XMLRPC Attack 130.131.200.48 (US/United States/Iowa/Des Moines/-/[AS8075 MICROSOFT-CORP- ... show more (XMLRPC) WP XMLRPC Attack 130.131.200.48 (US/United States/Iowa/Des Moines/-/[AS8075 MICROSOFT-CORP-MSN-AS-BLOCK]): 1 in the last 86400 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: 130.131.200.48 - - [03/Jul/2026:00:49:25 +0300] "POST /xmlrpc.php HTTP/1.1" 503 7300 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36" show less	Port Scan
🇺🇸 TPI-Abuse	2026-07-02 21:59:01 (11 hours ago)	(mod_security) mod_security (id:225170) triggered by 130.131.200.48 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:225170) triggered by 130.131.200.48 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jul 02 17:58:56.928861 2026] [security2:error] [pid 18175:tid 18175] [client 130.131.200.48:9945] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)\|\|idahouspsa.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "idahouspsa.com"] [uri "/wp-json/wp/v2/users/"] [unique_id "akbfIBxSxH3acPFgpedr-QAAABE"] show less	Brute-Force Bad Web Bot Web App Attack
🇨🇭 4server	2026-07-02 21:45:41 (11 hours ago)	[ThuJul0223:45:35.2932632026][security2:error][pid3023858:tid3024530][client130.131.200.48:0]ModSecu ... show more [ThuJul0223:45:35.2932632026][security2:error][pid3023858:tid3024530][client130.131.200.48:0]ModSecurity:Accessdeniedwithcode403\(phase1\).Stringmatch\"/xmlrpc.php\"atREQUEST_URI.[file\"/etc/apache2/conf.d/modsec_custom_rules.conf\"][line\"368\"][id\"960024\"][msg\"XML-RPCdisabled\"][hostname\"mondo-it.ch\"][uri\"/xmlrpc.php\"][unique_id\"akbb_xUO75Km8RXL1JZqdgAAANc\"] show less	Hacking Web App Attack
🇺🇸 TPI-Abuse	2026-07-02 21:42:20 (12 hours ago)	(mod_security) mod_security (id:225170) triggered by 130.131.200.48 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:225170) triggered by 130.131.200.48 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jul 02 17:42:13.599325 2026] [security2:error] [pid 16647:tid 16647] [client 130.131.200.48:11113] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)\|\|winestoria.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "winestoria.com"] [uri "/wp-json/wp/v2/users/"] [unique_id "akbbNYLUdT8AVxNqHKQTjAAAABk"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TAY	2026-07-02 21:11:16 (12 hours ago)	130.131.200.48 - - [03/Jul/2026:05:11:14 +0800] "POST /xmlrpc.php HTTP/1.1" 200 6707 "-" "Mozilla/5. ... show more 130.131.200.48 - - [03/Jul/2026:05:11:14 +0800] "POST /xmlrpc.php HTTP/1.1" 200 6707 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36 Edg/125.0.0.0" 130.131.200.48 - - [03/Jul/2026:05:11:14 +0800] "POST /xmlrpc.php HTTP/1.1" 200 6257 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0" 130.131.200.48 - - [03/Jul/2026:05:11:15 +0800] "POST /xmlrpc.php HTTP/1.1" 200 6257 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36" ... show less	Brute-Force
🇩🇪 FeG Deutschland	2026-07-02 21:07:42 (12 hours ago)	Looking for CMS/PHP/SQL vulnerablilities/excessive crawling - 27	Exploited Host Web App Attack
🇩🇪 ketovoila.pl	2026-07-02 21:06:34 (12 hours ago)	ketovoila.pl WordPress user/author enumeration: hits=1; unique_paths=1; sample_paths=/wp-json/wp/v2/ ... show more ketovoila.pl WordPress user/author enumeration: hits=1; unique_paths=1; sample_paths=/wp-json/wp/v2/users/; UA="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36 Vivaldi/6.7"; window=2026-07-02T21:06:34Z..2026-07-02T21:06:34Z show less	Web App Attack
🇳🇱 Site.eu	2026-07-02 21:04:02 (12 hours ago)	Repeated wp-login/xmlrpc attempts	Brute-Force SSH
🇺🇸 TPI-Abuse	2026-07-02 21:03:33 (12 hours ago)	(mod_security) mod_security (id:225170) triggered by 130.131.200.48 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:225170) triggered by 130.131.200.48 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jul 02 17:03:26.519538 2026] [security2:error] [pid 10867:tid 10867] [client 130.131.200.48:9649] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)\|\|canebrakes.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "canebrakes.com"] [uri "/wp-json/wp/v2/users/"] [unique_id "akbSHl0zFIbPurVmzjRbMAAAABk"] show less	Brute-Force Bad Web Bot Web App Attack
Anonymous	2026-07-02 20:54:04 (12 hours ago)	2026-07-02T22:54:03.182105+02:00 aion wordpress[1094238]: Blocked user enumeration attempt from 130. ... show more 2026-07-02T22:54:03.182105+02:00 aion wordpress[1094238]: Blocked user enumeration attempt from 130.131.200.48 ... show less	Hacking Brute-Force
🇺🇸 FreeMyIP	2026-07-02 20:49:36 (12 hours ago)	Automated fail2ban report: web application attack / scanning for exploitable paths.	Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-07-02 20:47:42 (12 hours ago)	(mod_security) mod_security (id:225170) triggered by 130.131.200.48 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:225170) triggered by 130.131.200.48 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jul 02 16:47:37.931126 2026] [security2:error] [pid 12840:tid 12840] [client 130.131.200.48:10820] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)\|\|aicoursefactory.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "aicoursefactory.com"] [uri "/wp-json/wp/v2/users/"] [unique_id "akbOaSwjMI7yftSHJZA9bQAAAAc"] show less	Brute-Force Bad Web Bot Web App Attack
🇩🇪 big-cloud.nl	2026-07-02 20:42:52 (12 hours ago)	Try to access /xmlrpc.php	Web App Attack
🇫🇷 dynamix	2026-07-02 20:21:49 (13 hours ago)	WordPress XMLRPC Brute Force Attack	Brute-Force Web App Attack

Showing 1 to 15 of 36 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇲🇽 189.173.38.123

🇩🇪 167.94.145.22

🇳🇵 113.199.250.127

🇺🇸 103.250.80.254

🇯🇵 47.245.38.88

🇧🇷 45.205.1.245

🇳🇱 45.148.10.157

🇩🇿 41.99.58.24

🇿🇦 197.89.34.160

🇨🇳 183.251.178.130

🇺🇸 154.197.57.208

🇨🇳 118.145.237.236

🇮🇩 103.98.176.164

🇸🇪 79.136.7.167

🇺🇸 74.82.47.11

🇭🇰 45.142.154.98

🇲🇦 41.141.24.200

🇧🇪 35.189.194.145

🇧🇪 34.77.240.224

🇭🇰 199.45.154.127