JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 61.0.231.161

61.0.231.161 was found in our database!

This IP was reported 14 times. Confidence of Abuse is 63%: ?

63%

ISP	National Internet Backbone
Usage Type	Fixed Line ISP
ASN	AS9829
Domain Name	bsnl.co.in
Country	🇮🇳 India
City	Vijayawada, Andhra Pradesh

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 61.0.231.161

Whois 61.0.231.161

IP Abuse Reports for 61.0.231.161:

This IP address has been reported a total of 14 times from 10 distinct sources. 61.0.231.161 was first reported on July 7th 2026, and the most recent report was 11 hours ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇺🇸 cwytech	2026-07-10 06:11:23 (11 hours ago)	Fleet-wide ban from the Ghostfleet 👻. Triggered by scenario: cwy/wp-us-login-only-high.	Bad Web Bot Web App Attack
🇫🇮 YF	2026-07-10 02:00:33 (15 hours ago)	xmlrpc.php Potential DDoS or brute force	DDoS Attack Brute-Force
🇺🇸 TPI-Abuse	2026-07-09 22:40:16 (18 hours ago)	(mod_security) mod_security (id:240335) triggered by 61.0.231.161 (-): 1 in the last 300 secs; Ports ... show more (mod_security) mod_security (id:240335) triggered by 61.0.231.161 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jul 09 18:40:11.201929 2026] [security2:error] [pid 22966:tid 22966] [client 61.0.231.161:52356] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 61.0.231.161 (+1 hits since last alert)\|kh6jim.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "kh6jim.com"] [uri "/xmlrpc.php"] [unique_id "alAjS_NTMaMnY6xG8tVHSwAAAAo"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-07-09 21:39:56 (19 hours ago)	(mod_security) mod_security (id:240335) triggered by 61.0.231.161 (-): 1 in the last 300 secs; Ports ... show more (mod_security) mod_security (id:240335) triggered by 61.0.231.161 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jul 09 17:39:50.170931 2026] [security2:error] [pid 11631:tid 11631] [client 61.0.231.161:63372] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 61.0.231.161 (+1 hits since last alert)\|apexandroids.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "apexandroids.com"] [uri "/xmlrpc.php"] [unique_id "alAVJk8RPMZ3tsEXvgRNvwAAAAE"] show less	Brute-Force Bad Web Bot Web App Attack
🇫🇷 Kenshin869	2026-07-09 20:35:40 (20 hours ago)	Wordpress unauthorized access attempt	Brute-Force
🇺🇸 TPI-Abuse	2026-07-09 00:24:23 (1 day ago)	(mod_security) mod_security (id:240335) triggered by 61.0.231.161 (-): 1 in the last 300 secs; Ports ... show more (mod_security) mod_security (id:240335) triggered by 61.0.231.161 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jul 08 20:24:19.139421 2026] [security2:error] [pid 1484:tid 1484] [client 61.0.231.161:59159] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 61.0.231.161 (+1 hits since last alert)\|coolcustomproducts.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "coolcustomproducts.com"] [uri "/xmlrpc.php"] [unique_id "ak7qM7CKGNPfHuP4M3sbYQAAAAQ"] show less	Brute-Force Bad Web Bot Web App Attack
🇪🇸 SweetHoneyPress	2026-07-09 00:06:03 (1 day ago)	WordPress honeypot: POST to /xmlrpc.php \| event_id=1011908 \| UA: Jetpack by WordPress.com	Web App Attack Brute-Force
🇪🇸 SweetHoneyPress	2026-07-08 23:50:57 (1 day ago)	WordPress honeypot: POST to /xmlrpc.php \| event_id=1011735 \| UA: Jetpack by WordPress.com	Web App Attack Brute-Force
🇺🇸 TPI-Abuse	2026-07-08 14:05:07 (2 days ago)	(mod_security) mod_security (id:240335) triggered by 61.0.231.161 (-): 1 in the last 300 secs; Ports ... show more (mod_security) mod_security (id:240335) triggered by 61.0.231.161 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jul 08 10:04:58.616583 2026] [security2:error] [pid 4271:tid 4271] [client 61.0.231.161:57967] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 61.0.231.161 (+1 hits since last alert)\|canebrakes.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "canebrakes.com"] [uri "/xmlrpc.php"] [unique_id "ak5ZCtVZ1jjM36gLuoULzwAAAA8"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 lostswordfish.com	2026-07-08 13:06:03 (2 days ago)	Wordfence waf block on ncrsol	Web App Attack
🇫🇷 applemooz	2026-07-07 22:39:51 (2 days ago)	WordPress XMLRPC Brute Force Attacks ...	Brute-Force Web App Attack
Anonymous	2026-07-07 19:37:17 (2 days ago)	[server.tmg.gr] httpd-xmlrpc-post: sites=www.eradjournal.com; logs=/var/log/httpd/domains/eradjourna ... show more [server.tmg.gr] httpd-xmlrpc-post: sites=www.eradjournal.com; logs=/var/log/httpd/domains/eradjournal.com.log; samples=/xmlrpc.php show less	Brute-Force Web App Attack
🇦🇺 screwlooseit.com.au	2026-07-07 16:32:28 (3 days ago)	Blocked by CSF 13 firewall - Rule: XMLRPC IN/India/-	Web App Attack
🇫🇷 dynamix	2026-07-07 13:34:50 (3 days ago)	WordPress XMLRPC Brute Force Attack	Brute-Force Web App Attack

Showing 1 to 14 of 14 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇳🇱 95.97.20.138

🇰🇷 59.8.52.102

🇺🇸 162.216.150.44

🇳🇱 77.83.39.94

🇲🇾 49.124.151.39

🇲🇾 49.124.147.96

🇮🇳 49.37.233.42

🇰🇪 41.89.128.6

🇬🇧 35.203.211.70

🇺🇸 199.195.249.11

🇧🇷 191.210.73.33

🇺🇦 176.121.12.226

🇫🇮 147.185.133.184

🇧🇩 103.239.252.132

🇺🇸 75.89.47.24

🇺🇸 54.166.30.52

🇩🇪 45.135.194.10

🇰🇼 37.34.237.45

🇬🇧 35.203.211.249

🇮🇳 27.123.107.154