JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 203.161.56.113

203.161.56.113 was found in our database!

This IP was reported 14 times. Confidence of Abuse is 61%: ?

61%

ISP	Namecheap, Inc.
Usage Type	Data Center/Web Hosting/Transit
ASN	AS22612
Hostname(s)	server1.www.americastechnicianservices.com
Domain Name	namecheap.com
Country	🇺🇸 United States of America
City	Los Angeles, California

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 203.161.56.113

Whois 203.161.56.113

IP Abuse Reports for 203.161.56.113:

This IP address has been reported a total of 14 times from 11 distinct sources. 203.161.56.113 was first reported on June 13th 2026, and the most recent report was 7 hours ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇨🇿 ptlab	2026-06-13 12:45:25 (7 hours ago)	Detected wp_login attack from WP-host.	Hacking Web App Attack
🇺🇸 TPI-Abuse	2026-06-13 12:20:38 (8 hours ago)	(mod_security) mod_security (id:225170) triggered by 203.161.56.113 (server1.www.americastechnicians ... show more (mod_security) mod_security (id:225170) triggered by 203.161.56.113 (server1.www.americastechnicianservices.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Jun 13 08:20:34.450361 2026] [security2:error] [pid 24623:tid 24623] [client 203.161.56.113:37072] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)\|\|exhaustthelimits.org\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "exhaustthelimits.org"] [uri "/wp-json/wp/v2/users/me"] [unique_id "ai1LEuP4j-y9AztN5pQ6AwAAAA4"] show less	Brute-Force Bad Web Bot Web App Attack
Anonymous	2026-06-13 12:15:06 (8 hours ago)	Bot / scanning and/or hacking attempts: [0/0] init, [2/2] done, GET /wp-login.php HTTP/2.0, POST /wp ... show more Bot / scanning and/or hacking attempts: [0/0] init, [2/2] done, GET /wp-login.php HTTP/2.0, POST /wp-login.php HTTP/2.0, [1/1] done, POST /xmlrpc.php HTTP/2.0 show less	Hacking Web App Attack
🇩🇪 brechtr	2026-06-13 12:09:01 (8 hours ago)	[Press84-BanHammer] bad username — Sourced from: www.langsvlaamsewegen.be — Request: POST /wp-login. ... show more [Press84-BanHammer] bad username — Sourced from: www.langsvlaamsewegen.be — Request: POST /wp-login.php show less	Brute-Force
🇺🇸 TPI-Abuse	2026-06-13 11:57:58 (8 hours ago)	(mod_security) mod_security (id:225170) triggered by 203.161.56.113 (server1.www.americastechnicians ... show more (mod_security) mod_security (id:225170) triggered by 203.161.56.113 (server1.www.americastechnicianservices.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Jun 13 07:57:52.489828 2026] [security2:error] [pid 9339:tid 9359] [client 203.161.56.113:0] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)\|\|www.mindgardens.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "www.mindgardens.com"] [uri "/wp-json/wp/v2/users/me"] [unique_id "ai1FwFLzgjNqs6bZMWgS6gAAAZA"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 integrantservices.com	2026-06-13 11:30:33 (9 hours ago)	(wordpress) Failed wordpress login from 203.161.56.113 (US/United States/server1.www.americastechnic ... show more (wordpress) Failed wordpress login from 203.161.56.113 (US/United States/server1.www.americastechnicianservices.com) show less	Brute-Force
🇩🇪 FeG Deutschland	2026-06-13 11:25:33 (9 hours ago)	Looking for CMS/PHP/SQL vulnerablilities/excessive crawling - 2	Exploited Host Web App Attack
🇺🇸 TPI-Abuse	2026-06-13 11:21:16 (9 hours ago)	(mod_security) mod_security (id:225170) triggered by 203.161.56.113 (server1.www.americastechnicians ... show more (mod_security) mod_security (id:225170) triggered by 203.161.56.113 (server1.www.americastechnicianservices.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Jun 13 07:21:09.256736 2026] [security2:error] [pid 6616:tid 6616] [client 203.161.56.113:55720] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)\|\|tcjohnston.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "tcjohnston.com"] [uri "/wp-json/wp/v2/users/me"] [unique_id "ai09JWyGayQI8EzvTm5o8AAAACM"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 lostswordfish.com	2026-06-13 11:16:05 (9 hours ago)	Wordfence waf block on registrymatters	Web App Attack
🇫🇷 masterguru	2026-06-13 11:03:41 (9 hours ago)	(modsec_5040) ModSec 5040: API Basic Auth blocked from 203.161.56.113 (US/United States/server1.www. ... show more (modsec_5040) ModSec 5040: API Basic Auth blocked from 203.161.56.113 (US/United States/server1.www.americastechnicianservices.com): 1 in the last 3600 secs (0-195) show less	Hacking
🇺🇸 TAY	2026-06-13 10:59:33 (9 hours ago)	203.161.56.113 - - [13/Jun/2026:18:56:34 +0800] "POST /xmlrpc.php HTTP/1.1" 200 4833 "-" "Mozilla/5. ... show more 203.161.56.113 - - [13/Jun/2026:18:56:34 +0800] "POST /xmlrpc.php HTTP/1.1" 200 4833 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:133.0) Gecko/20100101 Firefox/133.0" 203.161.56.113 - - [13/Jun/2026:18:56:42 +0800] "POST /xmlrpc.php HTTP/1.1" 200 6263 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.3 Safari/605.1.15" 203.161.56.113 - - [13/Jun/2026:18:59:33 +0800] "POST /wp-login.php HTTP/1.1" 200 2676 "https://www.littleprairie.com.my/wp-login.php" "Mozilla/5.0 (Macintosh; Intel Mac OS X 11_7_10) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36" ... show less	Brute-Force
🇳🇴 jad@	2026-06-13 10:59:05 (9 hours ago)	ThreatFeed automated detection: malicious HTTP scanning / exploit attempts. Signatures: wp_login. Ob ... show more ThreatFeed automated detection: malicious HTTP scanning / exploit attempts. Signatures: wp_login. Observed by 1 sensor(s); 2 hits. show less	Brute-Force Web App Attack
🇺🇸 TPI-Abuse	2026-06-13 10:56:14 (9 hours ago)	(mod_security) mod_security (id:225170) triggered by 203.161.56.113 (server1.www.americastechnicians ... show more (mod_security) mod_security (id:225170) triggered by 203.161.56.113 (server1.www.americastechnicianservices.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Jun 13 06:56:07.941769 2026] [security2:error] [pid 28476:tid 28476] [client 203.161.56.113:59634] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)\|\|grexicon.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "grexicon.com"] [uri "/wp-json/wp/v2/users/me"] [unique_id "ai03R4hjeBmlxSetKtj8GgAAABg"] show less	Brute-Force Bad Web Bot Web App Attack
🇲🇹 Malta	2026-06-13 10:54:23 (9 hours ago)	203.161.56.113 - - [13/Jun/2026:12:54:22 +0200] "POST /wp-login.php HTTP/1.1" "Mozilla/5.0 (X11; Ubu ... show more 203.161.56.113 - - [13/Jun/2026:12:54:22 +0200] "POST /wp-login.php HTTP/1.1" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36" Brute-force password attempt show less	Hacking Web App Attack Brute-Force

Showing 1 to 14 of 14 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇭🇰 199.45.154.115

🇵🇱 194.165.16.161

🇨🇳 101.26.28.235

🇷🇺 94.230.136.33

🇧🇾 93.84.97.4

🇸🇬 47.82.11.171

🇸🇬 47.82.11.170

🇱🇹 45.227.254.170

🇨🇳 42.6.35.105

🇮🇳 40.81.233.86

🇺🇸 20.64.105.82

🇧🇷 205.210.31.171

🇳🇱 195.178.110.30

🇧🇷 187.121.211.14

🇺🇸 147.185.132.155

🇰🇷 125.138.175.113

🇨🇳 120.48.14.72

🇨🇳 111.160.156.98

🇺🇸 70.37.89.177

🇰🇷 59.21.37.60