JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 103.241.206.111

103.241.206.111 was found in our database!

This IP was reported 32 times. Confidence of Abuse is 30%: ?

30%

ISP	Universitas Jember
Usage Type	University/College/School
ASN	AS132678
Domain Name	unej.ac.id
Country	🇮🇩 Indonesia
City	Jember, East Java

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 103.241.206.111

Whois 103.241.206.111

IP Abuse Reports for 103.241.206.111:

This IP address has been reported a total of 32 times from 9 distinct sources. 103.241.206.111 was first reported on January 23rd 2024, and the most recent report was 1 hour ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇫🇷 dynamix	2026-07-30 06:24:11 (1 hour ago)	WordPress XMLRPC Brute Force Attack	Brute-Force Web App Attack
Anonymous	2026-07-29 07:00:00 (1 day ago)	Apache probe; attempts=32; exact paths: /xmlrpc.php	Web App Attack
Anonymous	2026-07-29 07:00:00 (1 day ago)	Automated Apache web application probing in selected 24h window; attempts=32, unique_paths=1, error_ ... show more Automated Apache web application probing in selected 24h window; attempts=32, unique_paths=1, error_responses=0; targets include WordPress, .env/.git, phpMyAdmin, autodiscover, wpad.dat and related probe paths. show less	Web App Attack
🇪🇸 alferez	2026-07-27 08:43:30 (2 days ago)	xmlrpc.php attack DOS	Hacking Exploited Host Web App Attack
🇫🇷 masterguru	2026-07-13 01:23:47 (2 weeks ago)	xmlrpc request blocked, no referer. Pattern match "xmlrpc.php" at REQUEST_URI. (88010-201)	Hacking
🇪🇸 alferez	2026-07-02 03:51:19 (4 weeks ago)	xmlrpc.php attack DOS	Hacking Exploited Host Web App Attack
🇫🇷 dynamix	2026-06-25 06:10:13 (1 month ago)	WordPress XMLRPC Brute Force Attack	Brute-Force Web App Attack
🇺🇸 TPI-Abuse	2026-06-25 03:07:39 (1 month ago)	(mod_security) mod_security (id:240335) triggered by 103.241.206.111 (-): 1 in the last 300 secs; Po ... show more (mod_security) mod_security (id:240335) triggered by 103.241.206.111 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jun 24 23:07:35.977412 2026] [security2:error] [pid 11077:tid 11089] [client 103.241.206.111:55995] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 103.241.206.111 (+1 hits since last alert)\|emehache.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "emehache.com"] [uri "/xmlrpc.php"] [unique_id "ajybd2BbQWGrXSj4Dn4xZwAAAMo"] show less	Brute-Force Bad Web Bot Web App Attack
🇫🇷 dynamix	2026-06-23 08:19:50 (1 month ago)	WordPress XMLRPC Brute Force Attack	Brute-Force Web App Attack
🇫🇷 dynamix	2026-06-17 05:54:15 (1 month ago)	WordPress XMLRPC Brute Force Attack	Brute-Force Web App Attack
🇺🇸 TPI-Abuse	2026-06-08 08:15:42 (1 month ago)	(mod_security) mod_security (id:240335) triggered by 103.241.206.111 (-): 1 in the last 300 secs; Po ... show more (mod_security) mod_security (id:240335) triggered by 103.241.206.111 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jun 08 04:15:35.543044 2026] [security2:error] [pid 9005:tid 9005] [client 103.241.206.111:61679] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 103.241.206.111 (+1 hits since last alert)\|misogynyis.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "misogynyis.com"] [uri "/xmlrpc.php"] [unique_id "aiZ6JywFLVBWeTbluV6WcAAAAAk"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-05-21 04:38:05 (2 months ago)	(mod_security) mod_security (id:240335) triggered by 103.241.206.111 (-): 1 in the last 300 secs; Po ... show more (mod_security) mod_security (id:240335) triggered by 103.241.206.111 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu May 21 00:37:58.736202 2026] [security2:error] [pid 20723:tid 20723] [client 103.241.206.111:63620] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 103.241.206.111 (+1 hits since last alert)\|georgegourmet.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "georgegourmet.com"] [uri "/xmlrpc.php"] [unique_id "ag6MJryZR79BYJfQIyV_IAAAAAA"] show less	Brute-Force Bad Web Bot Web App Attack
🇮🇩 hermawan	2026-05-08 06:57:14 (2 months ago)	1778223310.487275 103.241.206.111 103.166.156.58 64240_2-1-3-1-1-4_1456_8 2026-05-08 13:55:10 WIB .. ... show more 1778223310.487275 103.241.206.111 103.166.156.58 64240_2-1-3-1-1-4_1456_8 2026-05-08 13:55:10 WIB ... show less	Email Spam Hacking
🇺🇸 TPI-Abuse	2026-04-20 06:04:57 (3 months ago)	(mod_security) mod_security (id:240335) triggered by 103.241.206.111 (-): 1 in the last 300 secs; Po ... show more (mod_security) mod_security (id:240335) triggered by 103.241.206.111 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Apr 20 02:04:50.028736 2026] [security2:error] [pid 4013642:tid 4013642] [client 103.241.206.111:59220] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 103.241.206.111 (+1 hits since last alert)\|ronjamestelevision.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "ronjamestelevision.com"] [uri "/xmlrpc.php"] [unique_id "aeXCArSyQ-Gjytau45d40AAAAAM"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-03-25 09:14:19 (4 months ago)	(mod_security) mod_security (id:225170) triggered by 103.241.206.111 (-): 1 in the last 300 secs; Po ... show more (mod_security) mod_security (id:225170) triggered by 103.241.206.111 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Mar 25 05:14:14.516842 2026] [security2:error] [pid 4309:tid 4343] [client 103.241.206.111:50548] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)\|\|executiveconsultingpr.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "executiveconsultingpr.com"] [uri "/wp-json/wp/v2/users"] [unique_id "acOnZqNWAbmICoVt-r5LaQAAAQI"] show less	Brute-Force Bad Web Bot Web App Attack

Showing 1 to 15 of 32 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇪🇨 186.66.50.38

🇻🇳 160.22.171.138

🇺🇸 147.185.132.172

🇺🇸 132.145.208.89

🇬🇧 83.147.29.150

🇬🇧 35.203.211.17

🇺🇸 205.210.31.79

🇸🇬 192.161.54.233

🇲🇽 187.212.37.143

🇺🇸 147.189.169.69

🇺🇸 135.237.126.209

🇳🇱 91.92.40.47

🇳🇱 85.11.167.7

🇸🇪 83.233.149.204

🇧🇬 78.128.114.102

🇵🇰 14.1.105.2

🇺🇸 216.25.89.119

🇨🇴 190.242.58.101

🇹🇼 118.165.113.90

🇰🇷 118.37.214.187