JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 102.203.137.244

102.203.137.244 was found in our database!

This IP was reported 22 times. Confidence of Abuse is 89%: ?

89%

ISP	att-subnet2
Usage Type	Fixed Line ISP
ASN	AS329693
Domain Name	atlantictechfibre.com
Country	🇰🇪 Kenya
City	Nairobi, Nairobi County

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 102.203.137.244

Whois 102.203.137.244

IP Abuse Reports for 102.203.137.244:

This IP address has been reported a total of 22 times from 16 distinct sources. 102.203.137.244 was first reported on September 12th 2026, and the most recent report was 3 hours ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇳🇱 DonAtari	2026-09-19 21:55:06 (3 hours ago)	DShield firewall scan - TCP to port 23	Brute-Force SSH
🇹🇷 savasboluk	2026-09-19 03:03:02 (22 hours ago)	Seczar SecureOps — SSH Brute Force (6 events) — quarantined 43200m on ABB-GATE	SSH Brute-Force
🇺🇸 TPI-Abuse	2026-09-18 04:24:11 (1 day ago)	(mod_security) mod_security (id:210350) triggered by 102.203.137.244 (-): 1 in the last 300 secs; Po ... show more (mod_security) mod_security (id:210350) triggered by 102.203.137.244 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Sep 18 00:24:05.507417 2026] [security2:error] [pid 28488:tid 28488] [client 102.203.137.244:46580] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close\|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close\|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found\|\|unionega.com\|F\|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "unionega.com"] [uri "/"] [unique_id "aqy85ZZfJ4fh-UIw2qN65gAAAAM"], referer: https://onlinedachecker.online/dir/website-ranking-links-221474 show less	Brute-Force Bad Web Bot Web App Attack
🇧🇷 noconex	2026-09-17 12:14:03 (2 days ago)	Wazuh Alert \| Rule ID: 100199 \| Desc: Suricata: (ET SCAN Potential SSH Scan) detectado de 102.203.13 ... show more Wazuh Alert \| Rule ID: 100199 \| Desc: Suricata: (ET SCAN Potential SSH Scan) detectado de 102.203.137.244 show less	Port Scan Brute-Force SSH
🇺🇸 MPL	2026-09-17 06:19:20 (2 days ago)	tcp/22 (4 or more attempts)	Port Scan
🇺🇸 ISPLtd	2026-09-16 20:11:13 (3 days ago)	Sep 16 17:11:12 102.203.137.244 TCP SPT=49652 DPT=22 SYN Sep 16 17:11:12 102.203.137.244 TCP SPT=496 ... show more Sep 16 17:11:12 102.203.137.244 TCP SPT=49652 DPT=22 SYN Sep 16 17:11:12 102.203.137.244 TCP SPT=49652 DPT=22 SYN ... show less	Port Scan SSH
🇺🇸 TPI-Abuse	2026-09-16 17:56:30 (3 days ago)	(mod_security) mod_security (id:210350) triggered by 102.203.137.244 (-): 1 in the last 300 secs; Po ... show more (mod_security) mod_security (id:210350) triggered by 102.203.137.244 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Sep 16 13:56:25.008098 2026] [security2:error] [pid 27887:tid 27887] [client 102.203.137.244:56514] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close\|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close\|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found\|\|puckerbottombikini.com\|F\|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "puckerbottombikini.com"] [uri "/"] [unique_id "aqrYSSd8tt-hswDqAZudgQAAACc"], referer: https://dadrpachecker.space/dir/seo-link-building-experts-168686 show less	Brute-Force Bad Web Bot Web App Attack
Anonymous	2026-09-16 11:53:31 (3 days ago)	PROTO=TCP DPT=23	Port Scan Hacking
🇫🇮 iamxorum	2026-09-16 08:31:09 (3 days ago)	Automated SSH scanner trapped in Endlessh tarpit. Log: 2026-09-16T08:31:08.243256+00:00 XRM-01 endle ... show more Automated SSH scanner trapped in Endlessh tarpit. Log: 2026-09-16T08:31:08.243256+00:00 XRM-01 endlessh[928]: 2026-09-16T08:31:08.243Z ACCEPT host=::ffff:102.203.137.244 port=44252 fd=5 n=2/4096 ... show less	Brute-Force SSH
🇺🇸 TPI-Abuse	2026-09-15 19:10:45 (4 days ago)	(mod_security) mod_security (id:210350) triggered by 102.203.137.244 (-): 1 in the last 300 secs; Po ... show more (mod_security) mod_security (id:210350) triggered by 102.203.137.244 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 15 15:10:42.630137 2026] [security2:error] [pid 10723:tid 10723] [client 102.203.137.244:50576] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close\|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close\|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found\|\|www.justicehoward.com\|F\|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.justicehoward.com"] [uri "/"] [unique_id "aqmYMuk3k43t_iO9kke_iwAAABU"], referer: https://digitalsophistication.blogspot.com/ show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 RAP	2026-09-15 16:56:40 (4 days ago)	2026-09-15 16:56:40 UTC Unauthorized activity to TCP port 22. SSH	SSH
🇺🇸 TPI-Abuse	2026-09-15 16:28:08 (4 days ago)	(mod_security) mod_security (id:210350) triggered by 102.203.137.244 (-): 1 in the last 300 secs; Po ... show more (mod_security) mod_security (id:210350) triggered by 102.203.137.244 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 15 12:28:00.070023 2026] [security2:error] [pid 10639:tid 10639] [client 102.203.137.244:39942] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close\|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close\|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found\|\|wryemusings.com\|F\|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "wryemusings.com"] [uri "/"] [unique_id "aqlyELXvYg5rzE8IBt_oKAAAAAo"], referer: https://wrye-code-collection.github.io/wcc-wiki show less	Brute-Force Bad Web Bot Web App Attack
🇩🇪 Vegascosmetics	2026-09-15 13:26:11 (4 days ago)	Kingcopy.org AI-IDS (Vegas Cosmetics shop): auto-blocked after high AbuseIPDB reputation + local blo ... show more Kingcopy.org AI-IDS (Vegas Cosmetics shop): auto-blocked after high AbuseIPDB reputation + local block policy. Evidence: High Abuse + Suspicion (63, Abuse: 56) show less	Hacking Exploited Host Web App Attack
🇺🇸 RAP	2026-09-15 12:32:14 (4 days ago)	2026-09-15 12:32:14 UTC Unauthorized activity to TCP port 22. SSH	SSH
🇺🇦 TawnyBalfour	2026-09-15 06:50:25 (4 days ago)	SSH honeypot. Target port: 22. Window: 2026-09-15 06:50 to 2026-09-15 06:50 UTC.	SSH

Showing 1 to 15 of 22 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇺🇸 216.73.163.71

🇳🇱 185.226.197.32

🇺🇸 165.154.163.10

🇺🇸 147.182.233.11

🇹🇷 78.188.187.188

🇺🇸 2607:ff10:c8:594::d

🇺🇸 207.90.244.17

🇩🇪 196.251.121.220

🇺🇸 195.184.76.6

🇨🇳 183.195.135.222

🇨🇱 179.60.95.198

🇳🇱 178.62.253.136

🇬🇧 165.22.127.129

🇺🇸 147.185.132.100

🇺🇸 103.168.66.158

🇧🇩 103.26.136.173

🇳🇱 94.154.46.245

🇺🇸 20.84.165.59

🇬🇧 209.97.132.108

🇲🇾 202.176.4.53