This IP address has been reported a total of
27
times from
11 distinct
sources.
103.208.104.166 was first reported on
, and the most recent report was
.
In the last 60 days, the only reporter location was:
Indonesia
with 1
report.
The most common categories in these recent reports were:
Email Spam
1
time;
Hacking
1
time.
Recent Reports
We have received reports of abusive activity from this IP address within the last week. It is
potentially still actively engaged in abusive activities.
[Sun Oct 18 11:05:10.253003 2026] [security2:error] [pid 1208915:tid 140148222170816] [client 103.20 ...
show more[Sun Oct 18 11:05:10.253003 2026] [security2:error] [pid 1208915:tid 140148222170816] [client 103.208.104.166:0] ModSecurity: Access denied with code 403 (phase 1). Match of "pm matomo.staklim-malang.info " against "SERVER_NAME" required. [file "/etc/modsecurity/coreruleset-4.29.0/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "224"] [id "440235"] [msg "BAD REQUEST Bro"] [data " Matched Data ARGS charset: - Matched Data TX.1: found within Content-Type multipart form Matched Data: %3a found within SERVER_NAME: staklim-jatim.bmkg.go.id request_line = GET /index.php/profil/arsip-artikel?catid=483&id=1265%3Aprakiraan-cuaca-daerah-malang-dan-batu-seminggu-ke-depan-berlaku-tanggal-29-november-5-desember-2016&start=100 HTTP/1.1 Request URI RAW = /index.php/profil/arsip-artikel?catid=483&id=1265%3Aprakiraan-cuaca-daerah-malang-dan-batu-seminggu-ke-depan-berlaku-tanggal-29-november-5-..."] [hostname "staklim-jatim.bmkg.go.id"] [uri "/index.php/profil/arsip-artikel"] [unique_id "atRFdlLq_
...
show less
{"ClientAddr":"103.208.104.166:11762","ClientHost":"103.208.104.166","ClientPort":"11762","ClientUse ...
show more{"ClientAddr":"103.208.104.166:11762","ClientHost":"103.208.104.166","ClientPort":"11762","ClientUsername":"-","DownstreamContentSize":418,"DownstreamStatus":403,"Duration":432526988,"OriginContentSize":418,"OriginDuration":429608298,"OriginStatus":403,"Overhead":2918690,"RequestAddr":"www.cleveradmin.de","RequestContentSize":682,"RequestCount":3523108,"RequestHost":"www.cleveradmin.de","RequestMethod":"POST","RequestPath":"/xmlrpc.php","RequestPort":"-","RequestProtocol":"HTTP/1.1","RequestScheme":"https","RetryAttempts":0,"RouterName":"cleveradmin-www-websecure@file","ServiceAddr":"172.16.80.10:80","ServiceName":"cleveradmin-www@file","ServiceURL":"http://172.16.80.10:80","StartLocal":"2026-08-11T21:27:08.430115567+02:00","StartUTC":"2026-08-11T19:27:08.430115567Z","TLSCipher":"TLS_AES_128_GCM_SHA256","TLSVersion":"1.3","entryPointName":"websecure","level":"info","msg":"","time":"2026-08-11T21:27:08+02:00"}
{"ClientAddr":"103.208.104.166:11762","ClientHost":"103.208.104.166","ClientP
...
show less
Blocked by UFW on mummo [7574/tcp]
Source port: 57696
TTL: 48
Packet length: 60
TOS: 0x00
This repo ...
show moreBlocked by UFW on mummo [7574/tcp]
Source port: 57696
TTL: 48
Packet length: 60
TOS: 0x00
This report was generated by:
https://github.com/sefinek/UFW-AbuseIPDB-Reporter
show less
ThreatBook Intelligence: Zombie,Dynamic IP more details on https://threatbook.io/ip/103.208.104.166
...
show moreThreatBook Intelligence: Zombie,Dynamic IP more details on https://threatbook.io/ip/103.208.104.166
2025-09-29 07:47:00 /boaform/admin/formLogin?username=ec8&psd=ec8
show less
Blocked by UFW (TCP on 60001)
Source port: 64382
TTL: 52
Packet length: 60
TOS: 0x00
This report (f ...
show moreBlocked by UFW (TCP on 60001)
Source port: 64382
TTL: 52
Packet length: 60
TOS: 0x00
This report (for 103.208.104.166) was generated by:
https://github.com/sefinek/UFW-AbuseIPDB-Reporter
show less
