JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 103.204.209.128

103.204.209.128 was found in our database!

This IP was reported 78 times. Confidence of Abuse is 80%: ?

80%

ISP	Level3 Carrier Limited
Usage Type	Fixed Line ISP
ASN	AS58682
Domain Name	level3carrier.com
Country	🇧🇩 Bangladesh
City	Dhaka, Dhaka Division

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 103.204.209.128

Whois 103.204.209.128

IP Abuse Reports for 103.204.209.128:

This IP address has been reported a total of 78 times from 26 distinct sources. 103.204.209.128 was first reported on December 24th 2024, and the most recent report was 1 day ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇺🇸 TPI-Abuse	2026-10-22 14:45:13 (1 day ago)	(mod_security) mod_security (id:225170) triggered by 103.204.209.128 (128.209.204.103-level3carrier. ... show more (mod_security) mod_security (id:225170) triggered by 103.204.209.128 (128.209.204.103-level3carrier.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 22 10:45:04.896765 2026] [security2:error] [pid 7696:tid 7696] [client 103.204.209.128:48030] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)\|\|proyectando.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "proyectando.com"] [uri "/wp-json/wp/v2/users"] [unique_id "atohcC4LQgbxQbNjfkhUZQAAAAA"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 SX Communications	2026-10-22 04:22:27 (1 day ago)	HTTP application-layer DoS / botnet traffic from 103.204.209.128: repeated high-cost dynamic page an ... show more HTTP application-layer DoS / botnet traffic from 103.204.209.128: repeated high-cost dynamic page and feed requests (profile/tag views, forums, tracker, RSS) at abusive rates via completed TCP/HTTPS. Likely compromised end-user host. show less	DDoS Attack Bad Web Bot Exploited Host
🇫🇷 masterguru	2026-10-21 16:23:40 (2 days ago)	WordPress: User enumeration. Pattern match "(author\\\\= (88030-197)	Hacking
🇮🇹 CoreTech srl	2026-10-20 19:28:56 (2 days ago)	cloudlinux2 fail2ban: 2026-10-20 21:24:41,706 fail2ban.filter [1957]: INFO [plesk-modsecu ... show more cloudlinux2 fail2ban: 2026-10-20 21:24:41,706 fail2ban.filter [1957]: INFO [plesk-modsecurity] Found 103.204.209.128 - 2026-10-20 21:24:41cloudlinux2 fail2ban: 2026-10-20 21:25:08,055 fail2ban.actions [1957]: NOTICE [plesk-modsecurity] Unban 35.242.162.30cloudlinux2 fail2ban: 2026-10-20 21:25:09,267 fail2ban.actions [1957]: NOTICE [plesk-modsecurity] Unban 49.206.116.236cloudlinux2 fail2ban: 2026-10-20 21:26:08,654 fail2ban.filter [1957]: INFO [plesk-modsecurity] Found 188.165.63.131 - 2026-10-20 21:26:08cloudlinux2 fail2ban: 2026-10-20 21:26:06,321 fail2ban.filter [1957]: INFO [plesk-modsecurity] Found 188.165.63.131 - 2026-10-20 21:26:06cloudlinux2 fail2ban: 2026-10-20 21:26:06,554 fail2ban.filter [1957]: INFO [recidive] Found 188.165.63.131 - 2026-10-20 21:26:06cloudlinux2 fail2ban: 2026-10-20 21:26:03,416 fail2ban.filter [1957]: INFO [plesk-modsecurity] Found 188.165.63.131 - 2026-10-20 21:26:03cloudlinux2 fail2ban: 2026-10-20 21:26:10 show less	Brute-Force
🇲🇹 Malta	2026-10-19 10:47:56 (4 days ago)	103.204.209.128 - - [19/Oct/2026:12:47:56 +0200] "POST /wp-login.php HTTP/1.1" "Mozilla/5.0 (X11; Li ... show more 103.204.209.128 - - [19/Oct/2026:12:47:56 +0200] "POST /wp-login.php HTTP/1.1" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36" Brute-force password attempt show less	Hacking Web App Attack Brute-Force
🇺🇸 kosada.com	2026-10-19 02:12:41 (4 days ago)	Repeated requests classified as pathological web bot behavior, for example: /[redacted]?topics%5B1%5 ... show more Repeated requests classified as pathological web bot behavior, for example: /[redacted]?topics%5B1%5D=53&topics%5B3%5D=60&topics%5B4%5D=68&topics%5B5%5D=89 (HTTP/2.0 port 443, user agent: "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36") show less	DDoS Attack Bad Web Bot
🇫🇷 bigorre.org	2026-10-17 06:31:16 (6 days ago)	Unidentified crawling: not a self-announced bot in user-agent	Bad Web Bot
🇺🇸 TPI-Abuse	2026-10-16 13:14:06 (1 week ago)	(mod_security) mod_security (id:225170) triggered by 103.204.209.128 (128.209.204.103-level3carrier. ... show more (mod_security) mod_security (id:225170) triggered by 103.204.209.128 (128.209.204.103-level3carrier.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 16 09:14:02.208723 2026] [security2:error] [pid 16854:tid 17033] [client 103.204.209.128:36004] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)\|\|hmpdecors.com.oplconnect.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "hmpdecors.com.oplconnect.com"] [uri "/wp-json/wp/v2/users/me"] [unique_id "atIjGnyjDprVVgo7JYb03QAAAQg"] show less	Brute-Force Bad Web Bot Web App Attack
🇩🇪 FeG Deutschland	2026-10-16 13:06:13 (1 week ago)	Looking for CMS/PHP/SQL vulnerablilities/excessive crawling - 2	Exploited Host Web App Attack
🇩🇪 Packets-Decreaser.NET	2026-10-12 15:27:52 (1 week ago)	Incoming Layer 7 Flood Detected	DDoS Attack Web Spam
Anonymous	2026-10-12 03:19:13 (1 week ago)	WordPress Brute Force	Brute-Force
🇩🇪 neckaralb-admin.de	2026-10-10 04:10:46 (1 week ago)	(wordpress) Failed login wp-login.php or xmlrpc.php	Web App Attack
🇩🇪 FeG Deutschland	2026-10-09 15:39:57 (2 weeks ago)	Looking for CMS/PHP/SQL vulnerablilities/excessive crawling - 2	Exploited Host Web App Attack
🇫🇷 bigorre.org	2026-10-09 11:03:56 (2 weeks ago)	Unidentified crawling: not a self-announced bot in user-agent	Bad Web Bot
🇺🇸 kosada.com	2026-10-06 07:52:49 (2 weeks ago)	Repeated requests classified as pathological web bot behavior, for example: /[redacted]?topics%5B1%5 ... show more Repeated requests classified as pathological web bot behavior, for example: /[redacted]?topics%5B1%5D=44&topics%5B2%5D=27&topics%5B3%5D=37&topics%5B4%5D=49 (HTTP/2.0 port 443, user agent: "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36") show less	DDoS Attack Bad Web Bot

Showing 1 to 15 of 78 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇨🇱 186.189.85.75

🇹🇬 156.38.87.121

🇨🇳 125.86.31.99

🇸🇬 118.139.164.171

🇬🇧 86.38.187.179

🇩🇪 34.179.208.37

🇵🇰 202.66.181.22

🇳🇱 185.223.235.6

🇻🇳 171.244.201.80

🇺🇸 129.121.126.188

🇮🇳 74.225.203.7

🇸🇬 47.237.2.150

🇭🇰 35.220.239.146

🇨🇴 201.184.50.251

🇧🇷 179.51.153.37

🇺🇦 176.103.5.103

🇳🇱 138.226.239.234

🇳🇱 77.91.71.23

🇺🇸 68.225.60.172

🇮🇪 54.229.248.0