JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 103.225.58.6

103.225.58.6 was found in our database!

This IP was reported 23 times. Confidence of Abuse is 41%: ?

41%

ISP	candor infosolution Pvt Ltd
Usage Type	Fixed Line ISP
ASN	AS58762
Domain Name	candorsolution.com
Country	🇮🇳 India
City	Patna, Bihar

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 103.225.58.6

Whois 103.225.58.6

IP Abuse Reports for 103.225.58.6:

This IP address has been reported a total of 23 times from 15 distinct sources. 103.225.58.6 was first reported on January 13th 2021, and the most recent report was 3 weeks ago.

Old Reports: The most recent abuse report for this IP address is from 3 weeks ago . It is possible that this IP is no longer involved in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇺🇸 TPI-Abuse	2026-06-15 10:46:26 (3 weeks ago)	(mod_security) mod_security (id:240335) triggered by 103.225.58.6 (-): 1 in the last 300 secs; Ports ... show more (mod_security) mod_security (id:240335) triggered by 103.225.58.6 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jun 15 06:46:18.093136 2026] [security2:error] [pid 1435:tid 1435] [client 103.225.58.6:64635] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 103.225.58.6 (+1 hits since last alert)\|apuntesdeinversion.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "apuntesdeinversion.com"] [uri "/xmlrpc.php"] [unique_id "ai_X-skxwrDU4DD8M6Pa7gAAABQ"] show less	Brute-Force Bad Web Bot Web App Attack
🇳🇱 Site.eu	2026-06-15 08:39:59 (3 weeks ago)	Repeated wp-login/xmlrpc attempts	Brute-Force SSH
🇩🇪 Marc	2026-06-13 08:13:41 (4 weeks ago)	103.225.58.6 - - [13/Jun/2026:10:13:19 +0200] "POST /xmlrpc.php HTTP/1.1" 200 3296 "-" "Jetpack/12.5 ... show more 103.225.58.6 - - [13/Jun/2026:10:13:19 +0200] "POST /xmlrpc.php HTTP/1.1" 200 3296 "-" "Jetpack/12.5; WordPress/6.2; http://site24429286.com" 103.225.58.6 - - [13/Jun/2026:10:13:29 +0200] "POST /xmlrpc.php HTTP/1.1" 200 3295 "-" "Jetpack/12.1; WordPress/6.1; http://site21273254.com" 103.225.58.6 - - [13/Jun/2026:10:13:40 +0200] "POST /xmlrpc.php HTTP/1.1" 200 3294 "-" "Jetpack by WordPress.com" show less	Brute-Force Web App Attack
🇩🇪 ger-stg-sifi1	2026-06-13 08:13:22 (4 weeks ago)	(wordpress) Failed wordpress login using wp-login.php or xmlrpc.php	Web App Attack
🇫🇷 dynamix	2026-06-13 06:42:19 (4 weeks ago)	WordPress XMLRPC Brute Force Attack	Brute-Force Web App Attack
🇳🇱 Site.eu	2026-06-13 06:12:17 (4 weeks ago)	Repeated wp-login/xmlrpc attempts	Brute-Force SSH
🇦🇺 LiftUp Hosting	2026-06-12 12:51:51 (4 weeks ago)	Honeypot hit: SMB traffic on port 445	Hacking
🇺🇸 TPI-Abuse	2026-06-12 11:13:44 (4 weeks ago)	(mod_security) mod_security (id:240335) triggered by 103.225.58.6 (-): 1 in the last 300 secs; Ports ... show more (mod_security) mod_security (id:240335) triggered by 103.225.58.6 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jun 12 07:13:36.265976 2026] [security2:error] [pid 16302:tid 16302] [client 103.225.58.6:54412] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 103.225.58.6 (+1 hits since last alert)\|sizefinder.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "sizefinder.com"] [uri "/xmlrpc.php"] [unique_id "aivp4MSmUb2vOZ2xCsWUXwAAAAE"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-06-12 10:33:30 (4 weeks ago)	(mod_security) mod_security (id:240335) triggered by 103.225.58.6 (-): 1 in the last 300 secs; Ports ... show more (mod_security) mod_security (id:240335) triggered by 103.225.58.6 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jun 12 06:33:25.140446 2026] [security2:error] [pid 24159:tid 24159] [client 103.225.58.6:52638] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 103.225.58.6 (+1 hits since last alert)\|gaeltv.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "gaeltv.com"] [uri "/xmlrpc.php"] [unique_id "aivgdZnPemsL9ivdwEUXnAAAAA8"] show less	Brute-Force Bad Web Bot Web App Attack
Anonymous	2026-06-12 09:24:42 (4 weeks ago)	Attac	Brute-Force
🇺🇸 TPI-Abuse	2026-06-11 16:19:24 (4 weeks ago)	(mod_security) mod_security (id:240335) triggered by 103.225.58.6 (-): 1 in the last 300 secs; Ports ... show more (mod_security) mod_security (id:240335) triggered by 103.225.58.6 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jun 11 12:19:18.124193 2026] [security2:error] [pid 826:tid 826] [client 103.225.58.6:54883] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 103.225.58.6 (+1 hits since last alert)\|cloudex.link\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "cloudex.link"] [uri "/xmlrpc.php"] [unique_id "airgBj5c2bRamq0794A-2gAAAAg"] show less	Brute-Force Bad Web Bot Web App Attack
Anonymous	2026-06-11 10:11:20 (1 month ago)	[redacted] 103.225.58.6 - - [11/Jun/2026:12:10:38 +0200] "POST /xmlrpc.php HTTP/1.1" 405 428 "-" "Je ... show more [redacted] 103.225.58.6 - - [11/Jun/2026:12:10:38 +0200] "POST /xmlrpc.php HTTP/1.1" 405 428 "-" "Jetpack by WordPress.com (Jetpack 12.1; WordPress 6.3)" [redacted] 103.225.58.6 - - [11/Jun/2026:12:10:48 +0200] "POST /xmlrpc.php HTTP/1.1" 405 428 "-" "Jetpack by WordPress.com" [redacted] 103.225.58.6 - - [11/Jun/2026:12:10:58 +0200] "POST /xmlrpc.php HTTP/1.1" 405 428 "-" "Jetpack by WordPress.com (Jetpack 12.0; WordPress 6.4)" [redacted] 103.225.58.6 - - [11/Jun/2026:12:11:09 +0200] "POST /xmlrpc.php HTTP/1.1" 405 428 "-" "Jetpack/12.5; WordPress/6.4; http://site66051390.com" [redacted] 103.225.58.6 - - [11/Jun/2026:12:11:19 +0200] "POST /xmlrpc.php HTTP/1.1" 405 428 "-" "Jetpack/12.0; WordPress/6.4; http://site29786704.com" ... show less	Hacking Web App Attack
🇺🇸 TPI-Abuse	2026-06-11 09:18:44 (1 month ago)	(mod_security) mod_security (id:240335) triggered by 103.225.58.6 (-): 1 in the last 300 secs; Ports ... show more (mod_security) mod_security (id:240335) triggered by 103.225.58.6 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jun 11 05:18:37.479123 2026] [security2:error] [pid 27685:tid 27685] [client 103.225.58.6:58339] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 103.225.58.6 (+1 hits since last alert)\|churchbehindthewalls.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "churchbehindthewalls.com"] [uri "/xmlrpc.php"] [unique_id "aip9bbgvlwrpjv0xkgsu3wAAAAg"] show less	Brute-Force Bad Web Bot Web App Attack
🇦🇹 urnilxfgbez	2026-06-10 22:45:00 (1 month ago)	Last 24 Hours suspicious: (DPT=445\|DPT=3389\|DPT=22\|DPT=3306\|DPT=8080\|DPT=23\|DPT=5900\|DPT=1433)	Port Scan
🇺🇸 TPI-Abuse	2026-06-10 07:57:31 (1 month ago)	(mod_security) mod_security (id:240335) triggered by 103.225.58.6 (-): 1 in the last 300 secs; Ports ... show more (mod_security) mod_security (id:240335) triggered by 103.225.58.6 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jun 10 03:57:25.662390 2026] [security2:error] [pid 7466:tid 7466] [client 103.225.58.6:52262] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 103.225.58.6 (+1 hits since last alert)\|kmelson.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "kmelson.com"] [uri "/xmlrpc.php"] [unique_id "aikY5ZJclRk5nOyFnv0EAAAAAAE"] show less	Brute-Force Bad Web Bot Web App Attack

Showing 1 to 15 of 23 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇩🇪 194.88.98.84

🇧🇷 177.99.193.135

🇵🇱 172.253.206.57

🇺🇸 147.185.132.198

🇨🇳 101.126.153.162

🇦🇪 94.205.161.130

🇵🇱 83.168.110.23

🇯🇵 43.165.177.143

🇭🇰 199.45.155.81

🇧🇪 178.51.27.41

🇩🇪 134.209.229.23

🇮🇩 103.29.185.162

🇨🇳 39.156.168.6

🇦🇷 181.91.26.166

🇧🇷 177.92.181.241

🇳🇱 91.92.40.204

🇧🇷 20.195.184.45

🇨🇳 218.56.160.82

🇻🇳 171.236.48.95

🇺🇸 164.90.151.212