JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

103.147.9.138

Recent Activity

Abuse Confidence Score

3% Caution

16 reports

12 reporters · latest 2 days ago

ISP: PT Aksara Perdana Multimedia
Usage Type: Fixed Line ISP
ASN: AS55699
Domain Name: corpnet.net.id
Country: 🇮🇩 Indonesia
City: Banjar, West Java

ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report Whois

Example preview

Account required for the enhanced features Log in Sign up

Abuse Reports

Export reports CSV

Total reports

16 from 12 distinct reporters

First reported

November 24th 2021

Most recent report

2 days ago

Last 60 days

Top reporter locations 🇨🇭 Switzerland 1

Most common categories Port Scan 1

Recent reports We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇨🇭 Elysium Security	2026-11-11 15:33:23 UTC · (2 days ago)	Mass port scanning on a whole network	Port Scan
🇺🇸 kosada.com	2026-07-23 22:00:21 UTC · (3 months ago)	Web bot: denial-of-service flood	DDoS Attack Bad Web Bot
🇮🇩 hermawan	2026-06-16 10:37:00 UTC · (4 months ago)	[Tue Jun 16 17:36:57.682665 2026] [security2:error] [pid 766163:tid 139771444717248] [client 103.147.9.138:6492] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "www.bmkg.go.id" at REQUEST_HEADERS:Referer. [file "/etc/modsecurity/c ... show more [Tue Jun 16 17:36:57.682665 2026] [security2:error] [pid 766163:tid 139771444717248] [client 103.147.9.138:6492] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "www.bmkg.go.id" at REQUEST_HEADERS:Referer. [file "/etc/modsecurity/coreruleset-4.26.0/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "582"] [id "440068"] [msg "BAD Referer"] [data "Matched Data: www.bmkg.go.id found within REQUEST_HEADERS:Referer: https://www.bmkg.go.id/ request_line = GET /index.php/profil/alamat-kantor/list-all-categories/555556811-mengakses-halaman-web-https-karangploso-jatim-bmkg-go-id-secara-offline-dan-menginstallnya-di-hp-android-atau-di-komputer HTTP/2.0"] [severity "NOTICE"] [hostname "staklim-jatim.bmkg.go.id"] [uri "/index.php/profil/alamat-kantor/list-all-categories/555556811-mengakses-halaman-web-https-karangploso-jatim-bmkg-go-id-secara-offline-dan-menginstallnya-di-hp-android-atau-di-komputer"] [unique_id "ajEnSUyXvECZniZnjlSBkwAAgQA"], referer https://www.bmkg.go.id/ [s ... show less	Email Spam Hacking
🇦🇺 prologic	2026-06-13 18:42:41 UTC · (5 months ago)	Distributed application-layer DoS against git.mills.io (self-hosted Gitea). High-volume automated requests to expensive Git repository endpoints (commit/diff/blame/archive views), ~1 request per IP, spoofed browser UA, rejected with HTTP 429. Residen ... show more Distributed application-layer DoS against git.mills.io (self-hosted Gitea). High-volume automated requests to expensive Git repository endpoints (commit/diff/blame/archive views), ~1 request per IP, spoofed browser UA, rejected with HTTP 429. Residential-proxy botnet campaign, 2026-06-13/14 UTC. show less	DDoS Attack Web App Attack
🇮🇩 hermawan	2025-11-19 23:44:26 UTC · (11 months ago)	[Thu Nov 20 06:43:31.217416 2025] [security2:error] [pid 765477:tid 140590678185664] [client 103.147.9.138:5877] ModSecurity: Access denied with code 403 (phase 1). Match of "pm matomo.staklim-malang.info " against "SERVER_NAME" required. [file "/etc ... show more [Thu Nov 20 06:43:31.217416 2025] [security2:error] [pid 765477:tid 140590678185664] [client 103.147.9.138:5877] ModSecurity: Access denied with code 403 (phase 1). Match of "pm matomo.staklim-malang.info " against "SERVER_NAME" required. [file "/etc/modsecurity/coreruleset-4.20.0/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "183"] [id "440235"] [msg "BAD REQUEST Bro"] [data " Matched Data ARGS charset: - Matched Data TX.1: found within Content-Type multipart form Matched Data: %3a found within SERVER_NAME: staklim-malang.info request_line = GET /index.php/profil/arsip-artikel?catid=473&id=594%3Aprakiraan-cuaca-daerah-malang-dan-batu-seminggu-ke-depan-berlaku-tanggal-30-juni-6-juli-2015&start=170 HTTP/2.0 Request URI RAW = /index.php/profil/arsip-artikel?catid=473&id=594%3Aprakiraan-cuaca-daerah-malang-dan-batu-seminggu-ke-depan-berlaku-tanggal-30-juni-6-juli-2015&start=170..."] [hostname "staklim-malang.info"] [uri "/index.php/profil/arsip-artikel"] [unique_id "aR5WI2CzkxTx9h ... show less	Hacking Web App Attack
Anonymous	2025-11-14 17:24:18 UTC · (11 months ago)	scanning http requests from known botnet	Web App Attack
🇪🇸 10dencehispahard SL	2023-05-06 21:25:44 UTC · (3 years ago)	Unauthorized login attempts [{'postfix-spam', 'postfix-dos'}]	Brute-Force
🇩🇪 KPS	2022-09-24 22:05:19 UTC · (4 years ago)	PortscanM	Port Scan
🇿🇦 IrisFlower	2022-09-24 03:06:04 UTC · (4 years ago)	Unauthorized connection attempt detected from IP address 103.147.9.138 to port 80 [J]	Port Scan Hacking
🇿🇦 IrisFlower	2022-09-22 07:39:56 UTC · (4 years ago)	Unauthorized connection attempt detected from IP address 103.147.9.138 to port 8080 [J]	Port Scan Hacking
🇿🇦 IrisFlower	2022-09-20 00:40:05 UTC · (4 years ago)	Unauthorized connection attempt detected from IP address 103.147.9.138 to port 8080 [J]	Port Scan Hacking
🇺🇸 vestibtech	2022-03-26 00:06:59 UTC · (4 years ago)	Mar 25 22:06:58 Host-KLAX-C postfix/in_clean/cleanup[715124]: B4FBC1C0C58: reject: header Subject: Pending for payment. from unknown[103.147.9.138]; from=<[email protected]> to=<[email protected]> proto=ESMTP helo=<a103-147-9-138.bdo.starne ... show more Mar 25 22:06:58 Host-KLAX-C postfix/in_clean/cleanup[715124]: B4FBC1C0C58: reject: header Subject: Pending for payment. from unknown[103.147.9.138]; from=<[email protected]> to=<[email protected]> proto=ESMTP helo=<a103-147-9-138.bdo.starnet.net.id>: 5.7.1 Message identified as SPAM - Rule #509 ... show less	Email Spam
🇪🇸 10dencehispahard SL	2022-02-15 07:31:49 UTC · (4 years ago)	Multiple failed login attempts on various servers [wordpress-xmlrpc]	Brute-Force Web App Attack
🇩🇪 IP Analyzer	2021-12-07 22:02:23 UTC · (4 years ago)	Unauthorized connection attempt from IP address 103.147.9.138 on Port 445(SMB)	Port Scan
🇺🇸 etu brutus	2021-12-07 21:58:09 UTC · (4 years ago)	21/12/7@21:58:08: FAIL: Alarm-Network address from=103.147.9.138 ...	Hacking Brute-Force SSH

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown

Recently Reported IPs:

🇨🇭 179.43.153.2

🇩🇪 167.94.146.49

🇺🇸 147.185.132.230

🇨🇳 36.139.216.235

🇧🇪 34.78.85.62

🇻🇳 203.205.37.233

🇬🇧 198.244.226.117

🇬🇧 194.50.235.135

🇸🇬 193.37.32.202

🇷🇺 185.94.32.186

🇨🇳 113.24.225.168

🇬🇧 92.60.44.24

🇳🇱 89.21.67.130

🇺🇸 3.227.235.115

🇺🇿 213.230.92.36

🇮🇳 203.129.218.98

🇬🇧 198.244.226.9

🇬🇧 195.96.139.118

🇻🇳 116.98.249.168

🇩🇪 69.5.169.148