JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 103.169.39.206

103.169.39.206 was found in our database!

This IP was reported 25 times. Confidence of Abuse is 61%: ?

61%

ISP	Asia Pacific Network Information Centre
Usage Type	Fixed Line ISP
ASN	AS142331
Domain Name	apnic.net
Country	🇮🇩 Indonesia
City	Trucuk, Central Java

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 103.169.39.206

Whois 103.169.39.206

IP Abuse Reports for 103.169.39.206:

This IP address has been reported a total of 25 times from 17 distinct sources. 103.169.39.206 was first reported on November 16th 2023, and the most recent report was 1 day ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇺🇸 fazar	2026-07-20 01:45:43 (1 day ago)	crowdsecurity/http-probing on node: us01	Web App Attack Hacking
🇮🇩 zam	2026-07-19 22:02:04 (1 day ago)	103.169.39.206 - - [19/Jul/2026:22:01:58 +0000] "POST /vendor/phpunit/phpunit/src/Util/PHP/eval-stdi ... show more 103.169.39.206 - - [19/Jul/2026:22:01:58 +0000] "POST /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1" 301 325 show less	Web App Attack
🇺🇸 TPI-Abuse	2026-07-19 21:44:31 (1 day ago)	(mod_security) mod_security (id:210492) triggered by 103.169.39.206 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210492) triggered by 103.169.39.206 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Jul 19 17:44:18.877289 2026] [security2:error] [pid 19443:tid 19630] [client 103.169.39.206:53002] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "dcs.co.id"] [uri "/sftp-config.json"] [unique_id "al1FMlh-N44Zph2dChKYwgAAAkw"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 fazar	2026-07-19 20:30:06 (1 day ago)	crowdsecurity/CVE-2017-9841 on node: us01	Web App Attack
🇮🇩 origrata	2026-07-19 19:00:35 (1 day ago)	[OGWAF] path_traversal attack blocked \| severity: high \| GET /sftp-config.json \| UA: Mozilla/5.0 (Li ... show more [OGWAF] path_traversal attack blocked \| severity: high \| GET /sftp-config.json \| UA: Mozilla/5.0 (Linux; Android 11; Redmi Note 9 Pro Build/RKQ1.200826.002; wv) AppleWebKit/537.36 (KHTM show less	Hacking Web App Attack
🇮🇩 soc-yk	2026-07-05 17:54:11 (2 weeks ago)	Type: suspicious_network_activity Risk: 72 Events: 810 Evidence: - Persistent suspicious network ac ... show more Type: suspicious_network_activity Risk: 72 Events: 810 Evidence: - Persistent suspicious network activity detected - Repeated hostile operational behavior observed - Multi-event operational persistence identified show less	Port Scan Hacking
🇸🇬 wulan17	2026-07-01 04:54:34 (2 weeks ago)	Fail2ban: Web bot/vulnerability scanning detected.	Bad Web Bot
🇮🇩 soc-yk	2026-07-01 03:18:10 (2 weeks ago)	Type: web_scanning Risk: 76 Events: 286 Evidence: - Automated hostile web probing detected - Repeat ... show more Type: web_scanning Risk: 76 Events: 286 Evidence: - Automated hostile web probing detected - Repeated web scanning activity observed - Multi-event operational persistence identified - Threat escalation behavior observed show less	Web App Attack
🇮🇩 soc-yk	2026-07-01 00:42:14 (2 weeks ago)	Type: suspicious_network_activity Risk: 97 Events: 142 Evidence: - Persistent suspicious network ac ... show more Type: suspicious_network_activity Risk: 97 Events: 142 Evidence: - Persistent suspicious network activity detected - Repeated hostile operational behavior observed - Multi-event operational persistence identified - Threat escalation behavior observed show less	Port Scan Hacking
🇮🇩 Burayot	2026-07-01 00:35:25 (2 weeks ago)	LF_MODSEC: (mod_security) mod_security (id:1000001) triggered by 103.169.39.206 (ID/Indonesia/-): 1 ... show more LF_MODSEC: (mod_security) mod_security (id:1000001) triggered by 103.169.39.206 (ID/Indonesia/-): 1 in the last 3600 secs show less	Web App Attack
🇮🇩 origrata	2026-06-30 22:31:26 (2 weeks ago)	[OGWAF] crs_913 attack blocked \| severity: high \| GET /wp-includes/ID3/ \| UA: Mozilla/5.0 (Windows N ... show more [OGWAF] crs_913 attack blocked \| severity: high \| GET /wp-includes/ID3/ \| UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Sa \| payload: Directory enumeration in sensitive area show less	Web App Attack
🇮🇩 soc-yk	2026-06-30 22:30:10 (2 weeks ago)	Type: web_scanning Risk: 73 Events: 103 Evidence: - Automated hostile web probing detected - Repeat ... show more Type: web_scanning Risk: 73 Events: 103 Evidence: - Automated hostile web probing detected - Repeated web scanning activity observed - Multi-event operational persistence identified - Threat escalation behavior observed show less	Web App Attack
🇮🇩 soc-yk	2026-06-30 21:42:10 (2 weeks ago)	Type: suspicious_network_activity Risk: 100 Events: 35 Evidence: - Persistent suspicious network ac ... show more Type: suspicious_network_activity Risk: 100 Events: 35 Evidence: - Persistent suspicious network activity detected - Repeated hostile operational behavior observed - Threat escalation behavior observed show less	Port Scan Hacking
🇺🇦 URAN Publishing Service	2026-06-30 15:54:50 (2 weeks ago)	103.169.39.206 - - [30/Jun/2026:18:54:47 +0300] "GET /wp-admin/network/ HTTP/1.1" 404 3373 "-" "Mozi ... show more 103.169.39.206 - - [30/Jun/2026:18:54:47 +0300] "GET /wp-admin/network/ HTTP/1.1" 404 3373 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 103.169.39.206 - - [30/Jun/2026:18:54:49 +0300] "GET /wp-admin/user/ HTTP/1.1" 404 705 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" ... show less	Web App Attack
Anonymous	2026-06-30 14:11:11 (2 weeks ago)	Attribution: mikhail-smirnov-79830323 (LinkedIn/profile ID) employed by Angara Technologies Group (E ... show more Attribution: mikhail-smirnov-79830323 (LinkedIn/profile ID) employed by Angara Technologies Group (Explicitly identified himself as enemy a week before attack began) \| Aggressive search filter manipulation / web scraper probe on port 443 \| URI: Heavy query parameter abuse: /communications/videoconference.html?___SID=b0521a58a3845f8c07ca29197a064937U+&dir=asc&limit=12&mode=grid&order=name&rating=6 \| UA: Mozilla/5.0 (Linux; Android 6.0; Nexus 5 Build/MRA58N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/65.0.3325.181 Mobile Safari/537.36 \| (Magento Site) show less	Hacking Bad Web Bot

Showing 1 to 15 of 25 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇬🇧 217.146.80.119

🇺🇸 205.210.31.14

🇮🇩 163.7.8.79

🇺🇸 66.154.106.190

🇭🇰 47.243.213.8

🇳🇱 45.153.34.89

🇵🇱 20.215.50.93

🇨🇳 218.20.220.36

🇪🇸 217.154.106.153

🇦🇷 190.3.50.154

🇨🇳 183.220.79.91

🇨🇳 101.126.64.76

🇬🇧 81.19.219.250

🇺🇸 66.132.224.228

🇺🇸 47.77.234.83

🇳🇱 45.148.10.157

🇺🇸 205.210.31.5

127.0.0.1

🇨🇳 115.195.80.109

🇻🇳 103.252.123.105