JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 103.189.201.241

103.189.201.241 was found in our database!

This IP was reported 19 times. Confidence of Abuse is 52%: ?

52%

ISP	PT Indonesia Comnets Plus
Usage Type	Fixed Line ISP
ASN	AS9341
Domain Name	iconpln.net.id
Country	🇮🇩 Indonesia
City	Sidoarjo, East Java

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 103.189.201.241

Whois 103.189.201.241

IP Abuse Reports for 103.189.201.241:

This IP address has been reported a total of 19 times from 14 distinct sources. 103.189.201.241 was first reported on April 11th 2023, and the most recent report was 2 days ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇺🇸 TPI-Abuse	2026-07-08 14:06:20 (2 days ago)	(mod_security) mod_security (id:240335) triggered by 103.189.201.241 (-): 1 in the last 300 secs; Po ... show more (mod_security) mod_security (id:240335) triggered by 103.189.201.241 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jul 08 10:06:16.599348 2026] [security2:error] [pid 22172:tid 22172] [client 103.189.201.241:12014] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 103.189.201.241 (+1 hits since last alert)\|naturalacu.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "naturalacu.com"] [uri "/xmlrpc.php"] [unique_id "ak5ZWJwi8t73hazWNm4MaAAAAAA"] show less	Brute-Force Bad Web Bot Web App Attack
🇩🇪 stinpriza	2026-07-08 13:23:56 (2 days ago)	Web App Attack	Web App Attack
🇫🇷 dynamix	2026-07-07 06:13:40 (4 days ago)	WordPress XMLRPC Brute Force Attack	Brute-Force Web App Attack
🇫🇮 YF	2026-07-07 01:00:24 (4 days ago)	xmlrpc.php Potential DDoS or brute force	DDoS Attack Brute-Force
🇹🇷 ycoskun41	2026-07-06 19:38:39 (4 days ago)	fail2ban: plesk-modsecurity jail on genckocaeli.com	Web App Attack
🇺🇸 TPI-Abuse	2026-07-06 18:08:50 (4 days ago)	(mod_security) mod_security (id:240335) triggered by 103.189.201.241 (-): 1 in the last 300 secs; Po ... show more (mod_security) mod_security (id:240335) triggered by 103.189.201.241 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jul 06 14:08:44.398605 2026] [security2:error] [pid 11290:tid 11290] [client 103.189.201.241:65354] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 103.189.201.241 (+1 hits since last alert)\|tonytremblayauthor.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "tonytremblayauthor.com"] [uri "/xmlrpc.php"] [unique_id "akvvLH_MaDmgr0r47drZiAAAABA"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-07-06 13:52:35 (4 days ago)	(mod_security) mod_security (id:240335) triggered by 103.189.201.241 (-): 1 in the last 300 secs; Po ... show more (mod_security) mod_security (id:240335) triggered by 103.189.201.241 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jul 06 09:52:30.189899 2026] [security2:error] [pid 28082:tid 28082] [client 103.189.201.241:63667] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 103.189.201.241 (+1 hits since last alert)\|daisydoesoap.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "daisydoesoap.com"] [uri "/xmlrpc.php"] [unique_id "akuzHtGo4DXJozNsONDDgwAAAAI"] show less	Brute-Force Bad Web Bot Web App Attack
Anonymous	2026-07-06 12:51:14 (4 days ago)	Attac	Brute-Force
🇪🇸 masterguru	2026-07-06 11:58:22 (5 days ago)	(xmlrpc) Failed xmlrpc access from 103.189.201.241 (ID/Indonesia/-): 5 in the last 3600 secs (0-122)	Hacking
🇫🇷 Sklurk	2026-07-05 19:02:23 (5 days ago)	Web App Attack	Web App Attack
🇩🇪 Vegascosmetics	2026-06-09 04:24:14 (1 month ago)	(Kingcopy.org-AI-IDS-Report):IP automatically blocked after obfuscated encoding. Vegas Security	DDoS Attack Hacking Bad Web Bot
🇬🇧 Birdo	2026-05-06 00:27:35 (2 months ago)	[Birdo SMB Honeypot] SMB unauthorized attempt	Exploited Host Brute-Force Port Scan Hacking
🇮🇩 hermawan	2025-11-11 12:56:59 (7 months ago)	[Tue Nov 11 19:38:56.946215 2025] [security2:error] [pid 68704:tid 139672478004928] [client 103.189. ... show more [Tue Nov 11 19:38:56.946215 2025] [security2:error] [pid 68704:tid 139672478004928] [client 103.189.201.241:47012] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i),.?[\\"'\\\\)0-9`-f][\\"'`](?:[\\"'`].?[\\"'`]\|(?:\\\\r?\\\\n)?\\\\z\|[^\\"'`]+)\|[^0-9A-Z_a-z]select.+[^0-9A-Z_a-z]?from\|(?:alter\|(?:(?:cre\|trunc\|upd)at\|renam)e\|d(?:e(?:lete\|sc)\|rop)\|(?:inser\|selec)t\|load)[\\\\s\\\\x0b]?\\\\([\\\\s\\\\x0b]?space[\\\\s\\\\x0b]?\\\\(" at REQUEST_HEADERS:User-Agent. [file "/etc/modsecurity/coreruleset-4.20.0/rules/REQUEST-942-APPLICATION-ATTACK-SQLI.conf"] [line "1989"] [id "942200"] [msg "Detects MySQL comment-/space-obfuscated injections and backtick termination"] [data " Matched Data ARGS charset: - Matched Data TX.1: found within Content-Type multipart form Matched Data: , like Gecko) Version/4.0 Chrome/141.0.7390.122 Mobile Safari/537.36 OcIdWebView ({\\x22os\\x22:\\x22Android\\x22, found within REQUEST_HEADERS:User-Agent: Mozilla/5.0 (Linux; Android 15; SM-A06 ... show less	Hacking Web App Attack
🇦🇹 HoneyPotEu-AT	2025-04-15 06:48:23 (1 year ago)	1744699702 - 04/15/2025 08:48:22 Host: 103.189.201.241/103.189.201.241 Port: 445 TCP Blocked ...	Port Scan
Anonymous	2024-05-08 02:39:10 (2 years ago)	Ports: 80,443; Direction: 0; Trigger: LF_CUSTOMTRIGGER	Brute-Force SSH

Showing 1 to 15 of 19 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇺🇸 2607:f8b0:4001:c17::128

🇵🇱 176.53.159.198

🇷🇺 95.31.48.66

🇬🇧 35.203.210.140

🇩🇪 213.209.159.236

🇹🇭 203.154.158.195

🇩🇪 172.68.195.136

🇬🇧 35.203.211.163

🇺🇸 18.119.209.50

🇺🇸 198.11.179.46

🇩🇰 185.129.61.4

🇷🇺 176.114.190.7

🇮🇩 163.7.15.78

🇮🇳 103.149.197.34

🇹🇭 101.109.231.144

🇷🇴 92.118.39.14

🇮🇳 52.140.76.154

🇩🇪 167.94.145.18

🇲🇦 160.174.129.232

🇩🇿 41.105.247.174