JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 103.241.206.127

103.241.206.127 was found in our database!

This IP was reported 16 times. Confidence of Abuse is 27%: ?

27%

ISP	Universitas Jember
Usage Type	University/College/School
ASN	AS132678
Domain Name	unej.ac.id
Country	🇮🇩 Indonesia
City	Jember, East Java

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 103.241.206.127

Whois 103.241.206.127

IP Abuse Reports for 103.241.206.127:

This IP address has been reported a total of 16 times from 11 distinct sources. 103.241.206.127 was first reported on May 22nd 2024, and the most recent report was 2 days ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇩🇪 rh24	2026-07-13 04:07:07 (2 days ago)	(xmlrpc_405) XMLRPC-Bot 405 103.241.206.127 (ID/Indonesia/-)	Hacking
🇺🇸 TPI-Abuse	2026-07-08 07:18:25 (1 week ago)	(mod_security) mod_security (id:240335) triggered by 103.241.206.127 (-): 1 in the last 300 secs; Po ... show more (mod_security) mod_security (id:240335) triggered by 103.241.206.127 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jul 08 03:18:18.935446 2026] [security2:error] [pid 23503:tid 23503] [client 103.241.206.127:59076] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 103.241.206.127 (+1 hits since last alert)\|ralphharris.org\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "ralphharris.org"] [uri "/xmlrpc.php"] [unique_id "ak35ukv9nbWAnzjm46qP7gAAAAc"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-06-29 05:38:16 (2 weeks ago)	(mod_security) mod_security (id:240335) triggered by 103.241.206.127 (-): 1 in the last 300 secs; Po ... show more (mod_security) mod_security (id:240335) triggered by 103.241.206.127 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jun 29 01:38:09.265387 2026] [security2:error] [pid 541:tid 541] [client 103.241.206.127:60773] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 103.241.206.127 (+1 hits since last alert)\|reallifelearninghub.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "reallifelearninghub.com"] [uri "/xmlrpc.php"] [unique_id "akIEwWqrxpe_6-03lJm5KwAAAAo"] show less	Brute-Force Bad Web Bot Web App Attack
🇦🇺 screwlooseit.com.au	2026-06-24 04:40:21 (3 weeks ago)	Blocked by CSF 13 firewall - Rule: XMLRPC ID/Indonesia/-	Web App Attack
🇺🇸 TPI-Abuse	2026-06-23 08:21:53 (3 weeks ago)	(mod_security) mod_security (id:240335) triggered by 103.241.206.127 (-): 1 in the last 300 secs; Po ... show more (mod_security) mod_security (id:240335) triggered by 103.241.206.127 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jun 23 04:21:48.529497 2026] [security2:error] [pid 21540:tid 21540] [client 103.241.206.127:51432] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5965"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 103.241.206.127 (+1 hits since last alert)\|tourissue.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "tourissue.com"] [uri "/xmlrpc.php"] [unique_id "ajpCHFlXvxd4l9KLgJ6UawAAAAI"] show less	Brute-Force Bad Web Bot Web App Attack
Anonymous	2026-06-18 05:42:11 (3 weeks ago)	[server.tmg.gr] httpd-xmlrpc-post: sites=tmg.gr; logs=/var/log/httpd/domains/tmg.gr.log; samples=/xm ... show more [server.tmg.gr] httpd-xmlrpc-post: sites=tmg.gr; logs=/var/log/httpd/domains/tmg.gr.log; samples=/xmlrpc.php show less	Brute-Force Web App Attack
Anonymous	2026-05-28 06:49:23 (1 month ago)	[redacted] 103.241.206.127 - - [28/May/2026:08:19:42 +0200] "POST /xmlrpc.php HTTP/1.1" 200 418 "-" ... show more [redacted] 103.241.206.127 - - [28/May/2026:08:19:42 +0200] "POST /xmlrpc.php HTTP/1.1" 200 418 "-" "Jetpack by WordPress.com (Jetpack 12.5; WordPress 6.1)" [redacted] 103.241.206.127 - - [28/May/2026:08:19:52 +0200] "POST /xmlrpc.php HTTP/1.1" 200 418 "-" "Jetpack by WordPress.com (Jetpack 12.1; WordPress 6.1)" [redacted] 103.241.206.127 - - [28/May/2026:08:20:03 +0200] "POST /xmlrpc.php HTTP/1.1" 200 418 "-" "Jetpack by WordPress.com" [redacted] 103.241.206.127 - - [28/May/2026:08:20:14 +0200] "POST /xmlrpc.php HTTP/1.1" 200 418 "-" "Jetpack by WordPress.com" [redacted] 103.241.206.127 - - [28/May/2026:08:20:24 +0200] "POST /xmlrpc.php HTTP/1.1" 200 418 "-" "Jetpack by WordPress.com (Jetpack 12.5; WordPress 6.1)" [redacted] 103.241.206.127 - - [28/May/2026:08:20:35 +0200] "POST /xmlrpc.php HTTP/1.1" 200 418 "-" "WordPress.com; https://wordpress.com" [redacted] 103.241.206.127 - - [28/May/2026:08:20:46 +0200] "POST /xmlrpc.php HTTP/1.1" ... show less	Hacking Web App Attack
Anonymous	2026-05-13 08:26:25 (2 months ago)	(xmlrpc) Failed wordpress XMLRPC 103.241.206.127 (ID/Indonesia/-)	Brute-Force
🇳🇱 wlt-blocker	2026-04-06 04:42:52 (3 months ago)	Unauthorized access to webpage admin	Web App Attack
🇩🇪 iNetWorker	2026-01-31 23:20:30 (5 months ago)	firewall-block, port(s): 139/tcp	Port Scan
🇩🇪 iNetWorker	2026-01-31 20:20:36 (5 months ago)	firewall-block, port(s): 445/tcp	Port Scan
🇮🇩 hermawan	2025-11-09 11:47:12 (8 months ago)	[Sun Nov 09 18:44:10.320504 2025] [security2:error] [pid 1243295:tid 140440708830912] [client 103.24 ... show more [Sun Nov 09 18:44:10.320504 2025] [security2:error] [pid 1243295:tid 140440708830912] [client 103.241.206.127:65515] ModSecurity: Access denied with code 403 (phase 2). Pattern match "." at ARGS_NAMES:utm_source. [file "/etc/modsecurity/coreruleset-4.20.0/rules/REQUEST-921-PROTOCOL-ATTACK.conf"] [line "728"] [id "921170"] [msg "deny 921170"] [data " Matched Data ARGS charset: - Matched Data TX.1: found within Content-Type multipart form Matched Data: u found within ARGS_NAMES:utm_source: utm_source request_line = GET /index.php/profil/meteorologi/list-of-all-tags/analisis-dasarian-distribusi-curah-hujan-provinsi-jawa-timur-tahun-2024?utm_source=chatgpt.com HTTP/2.0 Request URI RAW = /index.php/profil/meteorologi/list-of-all-tags/analisis-dasarian-distribusi-curah-hujan-provinsi-jawa-timur-tahun-2024?utm_source=chatgpt.com Request Basename = anali..."] [ver "OWASP_CRS/4.20.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_C ... show less	Hacking Web App Attack
🇮🇩 hermawan	2025-11-05 05:45:59 (8 months ago)	[Wed Nov 05 12:45:27.602850 2025] [security2:error] [pid 1397828:tid 140511066187456] [client 103.24 ... show more [Wed Nov 05 12:45:27.602850 2025] [security2:error] [pid 1397828:tid 140511066187456] [client 103.241.206.127:63115] ModSecurity: Access denied with code 403 (phase 1). Pattern match "(?i)(?:(?:^\|=)[\\\\s\\\\v](?:t[\\"'\\\\)\\\\[-\\\\x5c](?:(?:(?:\\\\\|\\\\\|\|&&)[\\\\s\\\\v])?\\\\$[!#\\\$\\\\\\\\-0-9\\\\?-@_a-\\\\{])?\\\\x5c?i[\\"'\\\$\\\\[-\\\\x5c](?:(?:(?:\\\\\|\\\\\|\|&&)[\\\\s\\\\v])?\\\\$[!#\\\$\\\\\\\\-0-9\\\\?-@_a-\\\\{])?\\\\x5c?m[\\"'\\\$\\\\[-\\\\x5c](?:(?:(?:\\\\\|\\\\\|\|&&)[\\\\s\\\\v]*)?\\ ..." at REQUEST_HEADERS:User-Agent. [file "/etc/modsecurity/coreruleset-4.19.0/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "2529"] [id "932243"] [msg "Remote Command Execution: Unix Command Injection found in user-agent or referer header"] [data " Matched Data ARGS charset: - Matched Data TX.1: found within Content-Type multipart form Matched Data: ; iP found within REQUEST_HEADERS:User-Agent: ChatGPT/1.2025.294 (iOS 18.6.2; iPhone11,2; build 18795397348) request_line ... show less	Hacking Web App Attack
🇩🇪 Admins@FBN	2025-11-01 14:18:29 (8 months ago)	FW-PortScan: Traffic Blocked srcport=50101 dstport=445	Port Scan
🇧🇷 diego	2024-05-23 08:11:35 (2 years ago)	[rede-164-29] 05/23/2024-05:11:34.394793, 103.241.206.127, Protocol: 6, ET SCAN Suspicious inbound t ... show more [rede-164-29] 05/23/2024-05:11:34.394793, 103.241.206.127, Protocol: 6, ET SCAN Suspicious inbound to MSSQL port 1433 show less	Hacking

Showing 1 to 15 of 16 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇨🇦 104.223.85.144

🇰🇿 89.218.69.66

🇫🇷 85.217.140.54

🇺🇸 34.48.239.6

🇰🇷 211.178.165.251

🇳🇱 195.178.110.227

🇯🇵 172.105.208.132

🇸🇬 165.22.57.22

🇫🇷 145.239.10.137

🇧🇷 129.121.33.174

🇮🇩 110.136.126.131

🇨🇳 106.13.56.235

🇨🇦 85.217.149.43

🇨🇳 1.24.16.42

🇺🇦 195.64.250.15

🇫🇮 144.31.156.154

🇺🇸 104.210.134.90

🇸🇪 90.230.168.26

🇺🇸 20.169.75.73

🇿🇦 2c0f:fb50:4001:3::12e