JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 168.181.48.95

168.181.48.95 was found in our database!

This IP was reported 30 times. Confidence of Abuse is 82%: ?

82%

ISP	Ligga Telecomunicações S.A.
Usage Type	Fixed Line ISP
ASN	AS14868
Hostname(s)	95.48.181.168.rfc6598.dynamic.copelfibra.com.br
Domain Name	liggavc.com.br
Country	🇧🇷 Brazil
City	Curitiba, Parana

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 168.181.48.95

Whois 168.181.48.95

IP Abuse Reports for 168.181.48.95:

This IP address has been reported a total of 30 times from 18 distinct sources. 168.181.48.95 was first reported on January 28th 2025, and the most recent report was 6 hours ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇺🇸 TPI-Abuse	2026-07-15 15:47:54 (6 hours ago)	(mod_security) mod_security (id:240335) triggered by 168.181.48.95 (95.48.181.168.rfc6598.dynamic.co ... show more (mod_security) mod_security (id:240335) triggered by 168.181.48.95 (95.48.181.168.rfc6598.dynamic.copelfibra.com.br): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jul 15 11:47:46.504606 2026] [security2:error] [pid 24619:tid 24619] [client 168.181.48.95:8649] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 168.181.48.95 (+1 hits since last alert)\|rotentendales.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "rotentendales.com"] [uri "/xmlrpc.php"] [unique_id "alerokvM1M4xVHRsEp84DgAAAAc"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-07-15 04:51:39 (17 hours ago)	(mod_security) mod_security (id:240335) triggered by 168.181.48.95 (95.48.181.168.rfc6598.dynamic.co ... show more (mod_security) mod_security (id:240335) triggered by 168.181.48.95 (95.48.181.168.rfc6598.dynamic.copelfibra.com.br): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jul 15 00:51:33.833506 2026] [security2:error] [pid 4994:tid 4994] [client 168.181.48.95:18096] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 168.181.48.95 (+1 hits since last alert)\|disio.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "disio.com"] [uri "/xmlrpc.php"] [unique_id "alcR1Ya4uJsoiSkoKOSlAwAAAAU"] show less	Brute-Force Bad Web Bot Web App Attack
Anonymous	2026-07-15 03:46:12 (18 hours ago)	WordPress Brute Force	Brute-Force
🇺🇸 TPI-Abuse	2026-07-14 22:29:04 (23 hours ago)	(mod_security) mod_security (id:240335) triggered by 168.181.48.95 (95.48.181.168.rfc6598.dynamic.co ... show more (mod_security) mod_security (id:240335) triggered by 168.181.48.95 (95.48.181.168.rfc6598.dynamic.copelfibra.com.br): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jul 14 18:28:59.913322 2026] [security2:error] [pid 23683:tid 23683] [client 168.181.48.95:7654] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 168.181.48.95 (+1 hits since last alert)\|rodzillacharters.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "rodzillacharters.com"] [uri "/xmlrpc.php"] [unique_id "ala4K-OwWEfFTuLimwMYEwAAAAc"] show less	Brute-Force Bad Web Bot Web App Attack
🇳🇱 Site.eu	2026-07-14 21:56:48 (1 day ago)	Repeated wp-login/xmlrpc attempts	Brute-Force SSH
Anonymous	2026-07-14 18:53:08 (1 day ago)	Blocked by siteaihub.com: auto: matched wildcard:/xmlrpc.php	Web App Attack Hacking
🇺🇸 TPI-Abuse	2026-07-14 17:52:34 (1 day ago)	(mod_security) mod_security (id:240335) triggered by 168.181.48.95 (95.48.181.168.rfc6598.dynamic.co ... show more (mod_security) mod_security (id:240335) triggered by 168.181.48.95 (95.48.181.168.rfc6598.dynamic.copelfibra.com.br): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jul 14 13:52:29.962635 2026] [security2:error] [pid 31124:tid 31124] [client 168.181.48.95:16035] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 168.181.48.95 (+1 hits since last alert)\|arsenalfordemocracy.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "arsenalfordemocracy.com"] [uri "/xmlrpc.php"] [unique_id "alZ3Xfbff9XvzFDLLPxlhAAAABg"] show less	Brute-Force Bad Web Bot Web App Attack
🇪🇸 masterguru	2026-07-14 17:52:23 (1 day ago)	(xmlrpc) Failed xmlrpc access from 168.181.48.95 (BR/Brazil/95.48.181.168.rfc6598.dynamic.copelfibra ... show more (xmlrpc) Failed xmlrpc access from 168.181.48.95 (BR/Brazil/95.48.181.168.rfc6598.dynamic.copelfibra.com.br): 5 in the last 3600 secs (0-122) show less	Hacking
🇫🇷 dynamix	2026-07-14 16:06:10 (1 day ago)	WordPress XMLRPC Brute Force Attack	Brute-Force Web App Attack
🇺🇸 TPI-Abuse	2026-07-14 11:52:03 (1 day ago)	(mod_security) mod_security (id:240335) triggered by 168.181.48.95 (95.48.181.168.rfc6598.dynamic.co ... show more (mod_security) mod_security (id:240335) triggered by 168.181.48.95 (95.48.181.168.rfc6598.dynamic.copelfibra.com.br): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jul 14 07:51:55.525483 2026] [security2:error] [pid 9806:tid 9806] [client 168.181.48.95:17927] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 168.181.48.95 (+1 hits since last alert)\|tenmenband.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "tenmenband.com"] [uri "/xmlrpc.php"] [unique_id "alYi22ZCZAOO-G2StZswGAAAAAQ"] show less	Brute-Force Bad Web Bot Web App Attack
🇩🇪 ghostwarriors	2026-07-14 11:20:51 (1 day ago)	Webpage scraping	Brute-Force Bad Web Bot Web App Attack
Anonymous	2026-07-14 11:18:53 (1 day ago)	Fail2Ban: WordPress XML-RPC brute-force attack detected.	Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-07-14 09:38:05 (1 day ago)	(mod_security) mod_security (id:240335) triggered by 168.181.48.95 (95.48.181.168.rfc6598.dynamic.co ... show more (mod_security) mod_security (id:240335) triggered by 168.181.48.95 (95.48.181.168.rfc6598.dynamic.copelfibra.com.br): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jul 14 05:37:57.546848 2026] [security2:error] [pid 14530:tid 14530] [client 168.181.48.95:8280] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5965"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 168.181.48.95 (+1 hits since last alert)\|tomartsmedia.org\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "tomartsmedia.org"] [uri "/xmlrpc.php"] [unique_id "alYDdZy0jBMY9gRGz0bG3AAAAAA"] show less	Brute-Force Bad Web Bot Web App Attack
🇨🇭 4server	2026-07-14 07:23:32 (1 day ago)	[TueJul1409:23:26.6876082026][security2:error][pid1940848:tid1941048][client168.181.48.95:0]ModSecur ... show more [TueJul1409:23:26.6876082026][security2:error][pid1940848:tid1941048][client168.181.48.95:0]ModSecurity:Accessdeniedwithcode403\(phase1\).Stringmatch\"/xmlrpc.php\"atREQUEST_URI.[file\"/etc/apache2/conf.d/modsec_custom_rules.conf\"][line\"368\"][id\"960024\"][msg\"XML-RPCdisabled\"][hostname\"swiss-domain-name.ch\"][uri\"/xmlrpc.php\"][unique_id\"alXj7v5YqieB0Do-SOOLiwAAAUI\"] show less	Hacking Web App Attack
🇺🇸 TPI-Abuse	2026-07-14 05:10:37 (1 day ago)	(mod_security) mod_security (id:240335) triggered by 168.181.48.95 (95.48.181.168.rfc6598.dynamic.co ... show more (mod_security) mod_security (id:240335) triggered by 168.181.48.95 (95.48.181.168.rfc6598.dynamic.copelfibra.com.br): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jul 14 01:10:31.756689 2026] [security2:error] [pid 14054:tid 14054] [client 168.181.48.95:17043] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 168.181.48.95 (+1 hits since last alert)\|mosheimlib.org\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "mosheimlib.org"] [uri "/xmlrpc.php"] [unique_id "alXEx0o4AGK_t75WQjW7WgAAAAg"] show less	Brute-Force Bad Web Bot Web App Attack

Showing 1 to 15 of 30 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇫🇷 185.177.72.54

🇺🇸 45.56.100.180

🇻🇳 27.72.98.85

🇬🇧 217.154.38.181

🇫🇷 185.177.72.53

🇺🇸 143.198.148.126

🇮🇩 139.228.161.54

🇮🇩 103.165.206.238

🇫🇷 78.126.161.28

🇧🇷 45.164.39.253

🇹🇿 41.59.44.14

🇫🇷 178.33.43.145

🇧🇬 79.124.62.230

🇺🇸 54.156.248.117

🇳🇱 45.148.10.183

🇮🇳 34.14.214.227

🇺🇸 23.94.102.136

🇮🇳 4.213.167.22

🇳🇱 193.176.31.215

🇻🇪 186.167.4.50