JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 103.126.149.180

103.126.149.180 was found in our database!

This IP was reported 15 times. Confidence of Abuse is 36%: ?

36%

ISP	Ashulia Network
Usage Type	Fixed Line ISP
ASN	AS138474
Domain Name	ashulianetwork.net
Country	🇧🇩 Bangladesh
City	Savar, Dhaka Division

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 103.126.149.180

Whois 103.126.149.180

IP Abuse Reports for 103.126.149.180:

This IP address has been reported a total of 15 times from 12 distinct sources. 103.126.149.180 was first reported on February 5th 2026, and the most recent report was 2 days ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇩🇪 pltcldvlpr	2026-06-10 15:00:28 (2 days ago)	Bogus Useragent: 103.126.149.180 - - [10/Jun/2026:17:00:28 +0200] "GET /protocol?id=rp_17_81&offset= ... show more Bogus Useragent: 103.126.149.180 - - [10/Jun/2026:17:00:28 +0200] "GET /protocol?id=rp_17_81&offset=3100&seq=3116 HTTP/1.1" 444 0 "-" "Opera/9.41.(Windows 98; Win 9x 4.90; kok-IN) Presto/2.9.160 Version/12.00" asn=138474 org="Ashulia Network" country=BD ... show less	Bad Web Bot
🇫🇷 Sklurk	2026-05-28 08:28:17 (2 weeks ago)	Web App Attack	Web App Attack
🇩🇪 SMARTNET	2026-05-27 06:03:53 (2 weeks ago)	Aisuru(Mirai variant) DDoS \| Incident ID: 4acf41a8-b801-4675-a9cd-4cf95dcec3e7	DDoS Attack
🇺🇸 TPI-Abuse	2026-05-21 16:16:43 (3 weeks ago)	(mod_security) mod_security (id:217210) triggered by 103.126.149.180 (-): 1 in the last 300 secs; Po ... show more (mod_security) mod_security (id:217210) triggered by 103.126.149.180 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu May 21 12:16:34.965081 2026] [security2:error] [pid 13770:tid 13770] [client 103.126.149.180:48980] ModSecurity: Access denied with code 403 (phase 2). Match of "rx ^(?i:(?:[a-z]{3,10}\\\\s+(?:\\\\w{3,7}?://[\\\\w\\\\-\\\\./](?::\\\\d+)?)?/[^?#](?:\\\\?[^#\\\\s])?(?:#[\\\\S])?\|connect (?:\\\\d{1,3}\\\\.){3}\\\\d{1,3}\\\\.?(?::\\\\d+)?\|options \\\\)\\\\s+[\\\\w\\\\./]+\|get /[^?#](?:\\\\?[^#\\\\s])?(?:#[\\\\S]*)?)$" against "REQUEST_LINE" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "114"] [id "217210"] [rev "1"] [msg "COMODO WAF: Invalid HTTP Request Line\|\|moon33peoples.xyz\|F\|4"] [data "GET http://moon33peoples.xyz HTTP/1.1"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "moon33peoples.xyz"] [uri "/"] [unique_id "ag8v4m2qb-2q5XyNxSt97AAAAAg"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 RAP	2026-05-11 15:32:41 (1 month ago)	2026-05-11 15:32:41 UTC Unauthorized activity to TCP port 23. Telnet	Port Scan
🇨🇭 ALPHANET	2026-05-10 01:40:06 (1 month ago)	Botnet or web spider not respecting robots.txt	DDoS Attack Exploited Host
🇫🇷 security.rdmc.fr	2026-05-08 05:41:37 (1 month ago)	Port Scan Attack proto:TCP src:44382 dst:23	Port Scan
🇩🇪 bescared	2026-05-05 14:55:31 (1 month ago)	F2B - Malicious activity detected. Unauthorized connection attempt: Telnet. -c0423ad6-	Port Scan
🇺🇸 RAP	2026-05-02 04:20:19 (1 month ago)	2026-05-02 04:20:19 UTC Unauthorized activity to TCP port 23. Telnet	Port Scan
🇫🇷 Sklurk	2026-05-01 04:57:56 (1 month ago)	Web App Attack	Web App Attack
🇳🇱 EGP Abuse Dept	2026-02-23 01:02:07 (3 months ago)	Scanning for port/service exploits on tpc-027.mach3builders.nl	Port Scan Hacking
🇺🇸 TPI-Abuse	2026-02-19 08:44:13 (3 months ago)	(mod_security) mod_security (id:217210) triggered by 103.126.149.180 (-): 1 in the last 300 secs; Po ... show more (mod_security) mod_security (id:217210) triggered by 103.126.149.180 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Feb 19 03:44:05.894847 2026] [security2:error] [pid 26221:tid 26221] [client 103.126.149.180:54064] ModSecurity: Access denied with code 403 (phase 2). Match of "rx ^(?i:(?:[a-z]{3,10}\\\\s+(?:\\\\w{3,7}?://[\\\\w\\\\-\\\\./](?::\\\\d+)?)?/[^?#](?:\\\\?[^#\\\\s])?(?:#[\\\\S])?\|connect (?:\\\\d{1,3}\\\\.){3}\\\\d{1,3}\\\\.?(?::\\\\d+)?\|options \\\\)\\\\s+[\\\\w\\\\./]+\|get /[^?#](?:\\\\?[^#\\\\s])?(?:#[\\\\S]*)?)$" against "REQUEST_LINE" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "114"] [id "217210"] [rev "1"] [msg "COMODO WAF: Invalid HTTP Request Line\|\|usa61suchs.top\|F\|4"] [data "GET http://usa61suchs.top HTTP/1.1"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "usa61suchs.top"] [uri "/"] [unique_id "aZbNVXkQj7aK17urJxBi3QAAAAE"] show less	Brute-Force Bad Web Bot Web App Attack
🇮🇹 VHosting	2026-02-16 11:32:26 (3 months ago)	Detected mail brute force attack from 4 different servers	Brute-Force
🇺🇸 johnkarlhill	2026-02-06 06:28:36 (4 months ago)	WebKnight blocked malicious web request on johnkarlhill.com	Brute-Force SSH
🇨🇭 backslash	2026-02-05 07:10:07 (4 months ago)	block ruleset Badbot using very old user-agents 5CF3CDB778C7D82564405B86B9242E612F378C68	Bad Web Bot

Showing 1 to 15 of 15 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇺🇸 104.194.9.81

🇺🇸 44.223.232.55

🇩🇪 31.76.11.243

🇺🇸 203.88.119.100

🇹🇼 198.235.24.90

🇺🇸 147.185.132.251

🇨🇳 113.2.188.39

🇰🇷 106.243.155.71

🇩🇪 91.204.46.241

🇮🇳 49.205.183.78

🇧🇷 45.229.91.34

🇸🇬 43.134.160.4

🇮🇳 40.81.224.202

🇮🇩 36.95.194.50

🇰🇷 14.63.196.175

🇺🇸 2607:f8b0:4004:c27::127

🇹🇷 178.245.193.187

🇵🇱 138.124.20.112

🇳🇱 45.148.10.157

🇹🇿 41.93.28.9