JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 42.112.109.48

42.112.109.48 was found in our database!

This IP was reported 25 times. Confidence of Abuse is 95%: ?

95%

ISP	FPT Telecom
Usage Type	Fixed Line ISP
ASN	AS18403
Domain Name	fpttoanquoc.com
Country	🇻🇳 Viet Nam
City	Quang Ngai, Quang Ngai

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 42.112.109.48

Whois 42.112.109.48

IP Abuse Reports for 42.112.109.48:

This IP address has been reported a total of 25 times from 18 distinct sources. 42.112.109.48 was first reported on January 11th 2024, and the most recent report was 16 hours ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇩🇪 IloGus	2026-07-21 03:45:37 (16 hours ago)	WAF repeated trigger detected by Fail2Ban in plesk-modsecurity jail	Web App Attack
🇩🇪 big-cloud.nl	2026-07-20 12:46:52 (1 day ago)	Try to access /xmlrpc.php	Web App Attack
🇺🇸 TPI-Abuse	2026-07-20 11:15:49 (1 day ago)	(mod_security) mod_security (id:240335) triggered by 42.112.109.48 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:240335) triggered by 42.112.109.48 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jul 20 07:15:33.903426 2026] [security2:error] [pid 2896481:tid 2896481] [client 42.112.109.48:64138] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 42.112.109.48 (+1 hits since last alert)\|iconconstructors.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "iconconstructors.com"] [uri "/xmlrpc.php"] [unique_id "al4DVU4iVFzUqTSl-3y_ggAAAAA"] show less	Brute-Force Bad Web Bot Web App Attack
Anonymous	2026-07-20 10:15:05 (1 day ago)	(wordpress) Failed wordpress login from 42.112.109.48 (VN/Vietnam/-)	Brute-Force
🇫🇷 francoisunix	2026-07-20 09:12:03 (1 day ago)	42.112.109.48 - - [20/Jul/2026:09:11:16 +0000] "POST /xmlrpc.php HTTP/1.0" 401 415 "-" "WordPress.co ... show more 42.112.109.48 - - [20/Jul/2026:09:11:16 +0000] "POST /xmlrpc.php HTTP/1.0" 401 415 "-" "WordPress.com; https://wordpress.com" 42.112.109.48 - - [20/Jul/2026:09:11:26 +0000] "POST /xmlrpc.php HTTP/1.0" 401 415 "-" "WordPress.com; https://wordpress.com" 42.112.109.48 - - [20/Jul/2026:09:11:38 +0000] "POST /xmlrpc.php HTTP/1.0" 401 415 "-" "Jetpack by WordPress.com (Jetpack 12.5; WordPress 6.4)" 42.112.109.48 - - [20/Jul/2026:09:11:48 +0000] "POST /xmlrpc.php HTTP/1.0" 401 415 "-" "Jetpack/13.0; WordPress/6.2; http://site47380494.com" 42.112.109.48 - - [20/Jul/2026:09:11:59 +0000] "POST /xmlrpc.php HTTP/1.0" 401 415 "-" "Jetpack by WordPress.com (Jetpack 12.1; WordPress 6.3)" ... show less	Web App Attack
🇧🇬 HighWay	2026-07-20 09:11:35 (1 day ago)	42.112.109.48 - - [20/Jul/2026:09:11:12 +0000] "POST /xmlrpc.php HTTP/1.1" 200 4665 "-" "Jetpack by ... show more 42.112.109.48 - - [20/Jul/2026:09:11:12 +0000] "POST /xmlrpc.php HTTP/1.1" 200 4665 "-" "Jetpack by WordPress.com" 42.112.109.48 - - [20/Jul/2026:09:11:22 +0000] "POST /xmlrpc.php HTTP/1.1" 200 4663 "-" "WordPress.com; https://wordpress.com" 42.112.109.48 - - [20/Jul/2026:09:11:33 +0000] "POST /xmlrpc.php HTTP/1.1" 200 4663 "-" "WordPress.com; https://wordpress.com" ... show less	Port Scan Bad Web Bot Web App Attack
🇳🇱 Site.eu	2026-07-20 03:19:39 (1 day ago)	Repeated wp-login/xmlrpc attempts	Brute-Force SSH
🇦🇺 screwlooseit.com.au	2026-07-19 14:30:30 (2 days ago)	Blocked by CSF 13 firewall - Rule: XMLRPC VN/Vietnam/-	Web App Attack
🇫🇷 dynamix	2026-07-19 13:59:53 (2 days ago)	WordPress XMLRPC Brute Force Attack	Brute-Force Web App Attack
Anonymous	2026-07-19 10:57:06 (2 days ago)	[osotir.org] httpd-xmlrpc-post: sites=www.logosparakliseos.gr; logs=/var/log/httpd/domains/logospara ... show more [osotir.org] httpd-xmlrpc-post: sites=www.logosparakliseos.gr; logs=/var/log/httpd/domains/logosparakliseos.gr.log; samples=/xmlrpc.php show less	Brute-Force Web App Attack
🇩🇪 wlt-blocker	2026-07-19 08:21:40 (2 days ago)	Unauthorized access to webpage admin	Web App Attack
🇺🇸 TPI-Abuse	2026-07-19 07:52:52 (2 days ago)	(mod_security) mod_security (id:240335) triggered by 42.112.109.48 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:240335) triggered by 42.112.109.48 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Jul 19 03:52:38.540892 2026] [security2:error] [pid 32202:tid 32202] [client 42.112.109.48:64571] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 42.112.109.48 (+1 hits since last alert)\|jazziiafoundation.org\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "jazziiafoundation.org"] [uri "/xmlrpc.php"] [unique_id "alyCRn6FhwvY7bL3rDqZTgAAAAU"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-07-19 05:08:17 (2 days ago)	(mod_security) mod_security (id:240335) triggered by 42.112.109.48 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:240335) triggered by 42.112.109.48 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Jul 19 01:08:00.398445 2026] [security2:error] [pid 2672:tid 2672] [client 42.112.109.48:59976] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 42.112.109.48 (+1 hits since last alert)\|bigholegolf.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "bigholegolf.com"] [uri "/xmlrpc.php"] [unique_id "alxbsJb9E55mG2OCEsdsKgAAAAk"] show less	Brute-Force Bad Web Bot Web App Attack
🇮🇹 CoreTech srl	2026-07-19 03:43:57 (2 days ago)	cloudlinux2 fail2ban: 2026-07-19 05:39:10,203 fail2ban.filter [1918]: INFO [plesk-modsecu ... show more cloudlinux2 fail2ban: 2026-07-19 05:39:10,203 fail2ban.filter [1918]: INFO [plesk-modsecurity] Found 42.112.109.48 - 2026-07-19 05:39:10cloudlinux2 fail2ban: 2026-07-19 05:39:18,225 fail2ban.filter [1918]: INFO [plesk-modsecurity] Found 185.77.220.210 - 2026-07-19 05:39:18cloudlinux2 fail2ban: 2026-07-19 05:40:12,166 fail2ban.filter [1918]: INFO [plesk-wordpress] Found 172.98.32.23 - 2026-07-19 05:40:11cloudlinux2 fail2ban: 2026-07-19 05:40:14,309 fail2ban.filter [1918]: INFO [plesk-modsecurity] Found 42.112.109.48 - 2026-07-19 05:40:14cloudlinux2 fail2ban: 2026-07-19 05:40:46,514 fail2ban.actions [1918]: NOTICE [plesk-modsecurity] Ban 42.112.109.48cloudlinux2 fail2ban: 2026-07-19 05:40:46,394 fail2ban.filter [1918]: INFO [plesk-modsecurity] Found 42.112.109.48 - 2026-07-19 05:40:46cloudlinux2 fail2ban: 2026-07-19 05:40:46,520 fail2ban.filter [1918]: INFO [recidive] Found 42.112.109.48 - 2026-07-19 05:40:46cloudlinux2 fail2ban: 2026-07- show less	Web App Attack
Anonymous	2026-07-17 14:24:27 (4 days ago)	(wordpress) Failed wordpress login from 42.112.109.48 (VN/Vietnam/-)	Brute-Force

Showing 1 to 15 of 25 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇧🇷 189.89.13.31

🇭🇰 118.193.37.50

🇺🇸 34.24.50.0

🇧🇷 205.210.31.197

🇳🇱 195.178.110.30

🇧🇷 191.205.210.9

🇹🇷 146.19.125.84

🇺🇸 129.213.142.121

🇭🇰 118.193.45.134

🇮🇩 103.105.197.2

🇮🇳 103.54.190.222

🇺🇸 91.230.168.173

🇧🇪 198.235.24.196

🇺🇸 162.216.149.209

🇸🇪 155.4.244.169

🇨🇳 140.246.92.60

🇮🇳 45.113.224.69

🇳🇱 193.110.157.47

🇫🇮 147.185.133.203

🇲🇦 102.98.40.179