JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 103.189.201.21

103.189.201.21 was found in our database!

This IP was reported 23 times. Confidence of Abuse is 11%: ?

11%

ISP	PT Indonesia Comnets Plus
Usage Type	Fixed Line ISP
ASN	AS9341
Domain Name	iconpln.net.id
Country	🇮🇩 Indonesia
City	Surabaya, East Java

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 103.189.201.21

Whois 103.189.201.21

IP Abuse Reports for 103.189.201.21:

This IP address has been reported a total of 23 times from 22 distinct sources. 103.189.201.21 was first reported on May 13th 2023, and the most recent report was 1 hour ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇩🇪 Vegascosmetics	2026-06-20 20:48:34 (1 hour ago)	(Kingcopy.org-AI-IDS-Report):IP automatically blocked after obfuscated redirect. Vegas Security	DDoS Attack Hacking Exploited Host
🇮🇩 hermawan	2026-05-14 12:14:24 (1 month ago)	[Thu May 14 17:30:46.773879 2026] [security2:error] [pid 410461:tid 139838184449728] [client 103.189 ... show more [Thu May 14 17:30:46.773879 2026] [security2:error] [pid 410461:tid 139838184449728] [client 103.189.201.21:44318] ModSecurity: Access denied with code 403 (phase 1). Match of "pm matomo.staklim-malang.info " against "SERVER_NAME" required. [file "/etc/modsecurity/coreruleset-4.26.0/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "230"] [id "440235"] [msg "BAD REQUEST Bro"] [data " Matched Data ARGS charset: - Matched Data TX.1: found within Content-Type multipart form Matched Data: wp found within SERVER_NAME: staklim-jatim.bmkg.go.id request_line = GET /?utm_source=ig&utm_medium=social&utm_content=link_in_bio&fbclid=PAZXh0bgNhZW0CMTEAc3J0YwZhcHBfaWQPNTY3MDY3MzQzMzUyNDI3AAGn-iaz3Rv6tIE9lIL1xDsgu5r5qD6WAjzy-bo2KPHm_PGmBgBUI8eJqDpKH9Y_aem_IGwPtrr3oif8danCnfccOA HTTP/2.0 Request URI RAW = /?utm_source=ig&utm_medium=social&utm_content=link_in_bio&fbclid=PAZXh0bgNhZW0CMTEAc3J0YwZhcH..."] [hostname "staklim-jatim.bmkg.go.id"] [uri "/"] [unique_id "agWkVrWP0wd1uk-4Ex0PAAAARAg"], refere ... show less	Email Spam Hacking
🇹🇷 rtbh.com.tr	2026-03-27 20:12:18 (2 months ago)	list.rtbh.com.tr report: tcp/0	Brute-Force
🇺🇸 gui-ying233	2026-03-24 01:16:53 (2 months ago)	Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.1 ... show more Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36 show less	Bad Web Bot
🇨🇦 Read.Team	2026-02-19 00:01:40 (4 months ago)	DDoS attack source: UDP PPS Flood targeting 37.59.144.156. Detected via automated PCAP analysis. Rep ... show more DDoS attack source: UDP PPS Flood targeting 37.59.144.156. Detected via automated PCAP analysis. Report ref: yh9454c3rf show less	DDoS Attack
Anonymous	2026-01-15 04:19:53 (5 months ago)	Unauthorized connection attempt	Port Scan Hacking Exploited Host
🇯🇵 mkaraki	2025-08-28 12:37:56 (9 months ago)	1756384660 # Service_probe # SIGNATURE_SEND # source_ip:103.189.201.21 # dst_port:445 ...	Port Scan
🇲🇾 syokadmin	2025-08-15 01:20:29 (10 months ago)	(cpanel) Failed cPanel login from 103.189.201.21 (ID/Indonesia/-): 1 in the last 3600 secs	Brute-Force Web App Attack
🇳🇱 Study Bitcoin 🤗	2025-06-15 08:29:08 (1 year ago)	2 port probes: 2x tcp/445 (smb) [gda]	Port Scan Hacking
🇫🇷 geeek	2025-06-11 05:27:38 (1 year ago)	Port scanning: 445 TCP Blocked	Port Scan
🇱🇹 NotACaptcha	2025-06-08 04:14:41 (1 year ago)	Unauthorised access (Jun 8 07:14) SRC=103.189.201.21 LEN=52 TTL=115 ID=16786 DF TCP DPT=445 WINDOW= ... show more Unauthorised access (Jun 8 07:14) SRC=103.189.201.21 LEN=52 TTL=115 ID=16786 DF TCP DPT=445 WINDOW=8192 SYN show less	Port Scan
🇺🇸 TPI-Abuse	2024-11-19 02:56:02 (1 year ago)	(mod_security) mod_security (id:225170) triggered by 103.189.201.21 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:225170) triggered by 103.189.201.21 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 18 21:55:58.689400 2024] [security2:error] [pid 9848:tid 9848] [client 103.189.201.21:57581] [client 103.189.201.21] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)\|\|buanamegah.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "buanamegah.com"] [uri "/wp-json/wp/v2/users/"] [unique_id "Zzv-PjjiZpDWiBgpXnFipQAAAAE"] show less	Brute-Force Bad Web Bot Web App Attack
Anonymous	2024-11-19 02:55:40 (1 year ago)	Ports: 80,443; Direction: 0; Trigger: LF_CUSTOMTRIGGER	Brute-Force SSH
🇮🇩 hermawan	2024-03-19 04:55:34 (2 years ago)	[Tue Mar 19 11:52:48.862778 2024] [security2:error] [pid 6904:tid 127542159738432] [client 103.189.2 ... show more [Tue Mar 19 11:52:48.862778 2024] [security2:error] [pid 6904:tid 127542159738432] [client 103.189.201.21:42548] [client 103.189.201.21] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:[\\"'`]\\\\s?(?:(?:n(?:and\|ot)\|(?:x?x)?or\|between\|\\\\\|\\\\\|\|and\|div\|&&)\\\\s+[\\\\s\\\\w]+=\\\\s?\\\\w+\\\\s?having\\\\s+\|like(?:\\\\s+[\\\\s\\\\w]+=\\\\s?\\\\w+\\\\s?having\\\\s+\|\\\\W?[\\"'`\\\\d])\|[^?\\\\w\\\\s=.,;)(]++\\\\s?[(@\\"'`]?\\\\s?\\\\w+\\\\W+\\\\w\|\\\\\\\\s*?\\\\w+\\\\W+[\\"'`])\|(?:unio ..." at REQUEST_COOKIES:cfz_google-analytics_v4. [file "/etc/modsecurity/coreruleset-3.3.5/rules/REQUEST-942-APPLICATION-ATTACK-SQLI.conf"] [line "1833"] [id "942260"] [msg "Detects basic SQL authentication bypass attempts 2/3"] [data "Matched Data: \\x22:{\\x22value\\x22:\\x223 found within REQUEST_COOKIES:cfz_google-analytics_v4: {\\x220bd2_engagementDuration\\x22:{\\x22value\\x22:\\x223769\\x22,\\x22expires\\x22:1742359851511},\\x220bd2_engagementStart\\x22:{\\x22value\\x ... show less	Hacking Web App Attack
🇩🇪 Packets-Decreaser.NET	2024-01-25 19:57:11 (2 years ago)	Incoming Layer 7 Flood Detected	DDoS Attack Web Spam

Showing 1 to 15 of 23 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇩🇪 69.5.169.32

🇨🇳 218.94.25.243

🇩🇪 213.209.159.56

🇸🇬 172.217.43.147

🇸🇬 161.118.247.52

🇲🇾 121.122.119.170

🇩🇪 69.5.169.107

🇩🇪 69.5.169.55

🇨🇳 47.99.32.200

🇬🇧 35.203.211.59

🇲🇽 187.191.48.4

🇵🇭 180.191.140.149

🇳🇱 172.211.56.214

🇫🇮 85.192.31.14

🇬🇧 81.19.219.212

🇫🇷 51.159.149.103

🇬🇧 35.203.211.49

🇩🇪 178.16.52.239

🇺🇸 138.197.15.3

🇨🇳 115.231.78.11