JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 154.208.48.138

154.208.48.138 was found in our database!

This IP was reported 91 times. Confidence of Abuse is 80%: ?

80%

ISP	IN CABLE INTERNET PRIVATE LIMITED
Usage Type	Fixed Line ISP
ASN	AS150750
Domain Name	incableinternet.com
Country	🇵🇰 Pakistan
City	Lahore, Punjab

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 154.208.48.138

Whois 154.208.48.138

IP Abuse Reports for 154.208.48.138:

This IP address has been reported a total of 91 times from 53 distinct sources. 154.208.48.138 was first reported on September 1st 2024, and the most recent report was 12 hours ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇺🇸 TPI-Abuse	2026-07-14 00:42:12 (12 hours ago)	(mod_security) mod_security (id:240335) triggered by 154.208.48.138 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:240335) triggered by 154.208.48.138 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jul 13 20:42:08.241778 2026] [security2:error] [pid 16499:tid 16499] [client 154.208.48.138:57845] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 154.208.48.138 (+1 hits since last alert)\|kadinisi.org\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "kadinisi.org"] [uri "/xmlrpc.php"] [unique_id "alWF4If1_wLR3qF0C7892gAAAAQ"] show less	Brute-Force Bad Web Bot Web App Attack
🇫🇷 applemooz	2026-07-14 00:10:41 (12 hours ago)	WordPress XMLRPC Brute Force Attacks ...	Brute-Force Web App Attack
Anonymous	2026-07-13 18:32:27 (18 hours ago)	[ssd5.kdns.gr] httpd-xmlrpc-post: sites=www.goingkoi.com.cy; logs=/var/log/httpd/domains/goingkoi.co ... show more [ssd5.kdns.gr] httpd-xmlrpc-post: sites=www.goingkoi.com.cy; logs=/var/log/httpd/domains/goingkoi.com.cy.log; samples=/xmlrpc.php show less	Brute-Force Web App Attack
🇩🇪 LRob	2026-07-13 15:26:20 (21 hours ago)	CrowdSec: crowdsecurity/http-bf-wordpress_bf_xmlrpc \| req: /xmlrpc.php \| UA: Jetpack by WordPress.co ... show more CrowdSec: crowdsecurity/http-bf-wordpress_bf_xmlrpc \| req: /xmlrpc.php \| UA: Jetpack by WordPress.com show less	Brute-Force Web App Attack
🇺🇸 TPI-Abuse	2026-07-13 14:56:57 (21 hours ago)	(mod_security) mod_security (id:240335) triggered by 154.208.48.138 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:240335) triggered by 154.208.48.138 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jul 13 10:56:51.024225 2026] [security2:error] [pid 15816:tid 15816] [client 154.208.48.138:64554] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 154.208.48.138 (+1 hits since last alert)\|ucommsi.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "ucommsi.com"] [uri "/xmlrpc.php"] [unique_id "alT8syhjyj2nn2n3BZiHRAAAAAA"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-07-13 14:26:55 (22 hours ago)	(mod_security) mod_security (id:240335) triggered by 154.208.48.138 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:240335) triggered by 154.208.48.138 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jul 13 10:26:49.825422 2026] [security2:error] [pid 28989:tid 28989] [client 154.208.48.138:53748] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5965"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 154.208.48.138 (+1 hits since last alert)\|consolidatedoperationsgroup.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "consolidatedoperationsgroup.com"] [uri "/xmlrpc.php"] [unique_id "alT1qZaM91OKRv-1gMcF9gAAAAo"] show less	Brute-Force Bad Web Bot Web App Attack
🇩🇪 HandyTreff.de	2026-07-13 14:20:23 (22 hours ago)	Bot/Spam/Scrapper attack detected on www.handytreff.de - Score: -72.123 (Bad < -10 / Very Bad < -20 ... show more Bot/Spam/Scrapper attack detected on www.handytreff.de - Score: -72.123 (Bad < -10 / Very Bad < -20 / Extreme < -35) \| UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Sa show less	Web App Attack Bad Web Bot
🇳🇱 Site.eu	2026-07-12 21:50:16 (1 day ago)	Repeated wp-login/xmlrpc attempts	Brute-Force SSH
🇩🇪 BlueWire Hosting	2026-07-12 19:05:51 (1 day ago)	Probing websites for vulnerabilities	Web App Attack
🇫🇷 dynamix	2026-07-12 13:25:33 (1 day ago)	WordPress XMLRPC Brute Force Attack	Brute-Force Web App Attack
🇩🇪 dbmwebdesign	2026-07-12 11:30:11 (2 days ago)	WordPress login brute-force detected by Fail2Ban in plesk-wordpress jail	Brute-Force Web App Attack
Anonymous	2026-07-06 18:32:44 (1 week ago)	[ns3.backorder.gr] httpd-xmlrpc-post: sites=www.backorder.gr; logs=/var/log/httpd/domains/backorder. ... show more [ns3.backorder.gr] httpd-xmlrpc-post: sites=www.backorder.gr; logs=/var/log/httpd/domains/backorder.gr.log; samples=/xmlrpc.php show less	Brute-Force Web App Attack
🇺🇸 TPI-Abuse	2026-07-03 20:44:43 (1 week ago)	(mod_security) mod_security (id:240335) triggered by 154.208.48.138 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:240335) triggered by 154.208.48.138 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jul 03 16:44:37.788194 2026] [security2:error] [pid 26392:tid 26392] [client 154.208.48.138:59815] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 154.208.48.138 (+1 hits since last alert)\|nolaanime.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "nolaanime.com"] [uri "/xmlrpc.php"] [unique_id "akgfNSnOy26SEnbeRvAvegAAAAw"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-07-03 19:40:08 (1 week ago)	(mod_security) mod_security (id:240335) triggered by 154.208.48.138 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:240335) triggered by 154.208.48.138 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jul 03 15:40:01.630207 2026] [security2:error] [pid 23552:tid 23996] [client 154.208.48.138:58810] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 154.208.48.138 (+1 hits since last alert)\|koalacogs.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "koalacogs.com"] [uri "/xmlrpc.php"] [unique_id "akgQEQhvhLjtzAAnK0LcNgAAAI8"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 nodepile	2026-07-02 08:28:16 (1 week ago)	Requests denied due to active blacklist hits (tenant=82 method=GET path=/catalogsearch/result/index/ ... show more Requests denied due to active blacklist hits (tenant=82 method=GET path=/catalogsearch/result/index/ ua='Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36') show less	Web App Attack Exploited Host

Showing 1 to 15 of 91 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇨🇳 42.51.33.162

🇺🇸 2607:f8b0:400e:c17::125

🇮🇳 2409:40d2:206c:4bcd:785b:53f0:c67b:20dd

🇩🇪 194.88.98.94

🇵🇱 176.53.159.197

🇩🇪 172.104.224.113

🇦🇪 152.32.180.86

🇮🇳 122.170.99.195

🇳🇬 102.88.21.136

🇹🇷 94.154.43.184

🇲🇦 80.250.47.1

🇧🇬 79.124.49.114

🇺🇸 44.219.241.135

🇺🇸 44.26.71.207

🇩🇪 2a09:bac5:27ba:1b4b::2b8:9b

🇨🇳 218.201.39.71

🇰🇷 211.43.22.205

🇳🇱 195.178.110.30

🇮🇩 182.10.131.102

🇦🇲 178.78.141.37