JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 160.20.123.9

160.20.123.9 was found in our database!

This IP was reported 144 times. Confidence of Abuse is 92%: ?

92%

ISP	NATIONAL INSTITUTE OF TECHNOLOGY KARNATAKA
Usage Type	University/College/School
ASN	AS152533
Hostname(s)	nitk-gw2-up-9.nitk.ac.in
Domain Name	nitk.ac.in
Country	🇮🇳 India
City	Tokuru, Karnataka

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 160.20.123.9

Whois 160.20.123.9

IP Abuse Reports for 160.20.123.9:

This IP address has been reported a total of 144 times from 44 distinct sources. 160.20.123.9 was first reported on January 30th 2025, and the most recent report was 17 hours ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇬🇧 consul.to	2026-07-06 12:16:38 (17 hours ago)	Web attack/malicious scanning detected	Web App Attack
🇩🇪 stinpriza	2026-07-06 12:02:46 (17 hours ago)	Web App Attack	Web App Attack
🇳🇱 Roderic	2026-07-06 06:34:56 (23 hours ago)	(apache_scanners-2) Failed apache-scanners trigger with match [redacted])	Port Scan
🇳🇱 Site.eu	2026-07-05 16:04:24 (1 day ago)	Repeated wp-login/xmlrpc attempts	Brute-Force SSH
🇺🇸 TPI-Abuse	2026-07-05 10:37:35 (1 day ago)	(mod_security) mod_security (id:225170) triggered by 160.20.123.9 (nitk-gw2-up-9.nitk.ac.in): 1 in t ... show more (mod_security) mod_security (id:225170) triggered by 160.20.123.9 (nitk-gw2-up-9.nitk.ac.in): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Jul 05 06:37:31.122674 2026] [security2:error] [pid 9713:tid 9724] [client 160.20.123.9:60755] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)\|\|maroontribe.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "maroontribe.com"] [uri "/wp-json/wp/v2/users"] [unique_id "akoz6zDEzF38naio46cHkgAAAMg"] show less	Brute-Force Bad Web Bot Web App Attack
🇳🇱 Site.eu	2026-07-02 01:02:31 (5 days ago)	Repeated wp-login/xmlrpc attempts	Brute-Force SSH
🇩🇪 moretrix	2026-07-01 18:57:28 (5 days ago)	2026-07-01T20:57:28.147686+02:00 ieyasu.moretrix.com named[1412]: client @0x7ffbc00c1400 160.20.123. ... show more 2026-07-01T20:57:28.147686+02:00 ieyasu.moretrix.com named[1412]: client @0x7ffbc00c1400 160.20.123.9#52804 (worLDSHakE.oRg): view external: query (cache) 'worLDSHakE.oRg/A/IN' denied (allow-query-cache did not match) 2026-07-01T20:57:28.438428+02:00 ieyasu.moretrix.com named[1412]: client @0x7ffbd3dda800 160.20.123.9#4768 (WOrlDSHakE.orG): view external: query (cache) 'WOrlDSHakE.orG/A/IN' denied (allow-query-cache did not match) 2026-07-01T20:57:28.572272+02:00 ieyasu.moretrix.com named[1412]: client @0x7ffbc05ef800 160.20.123.9#10622 (WoRlDShAKE.ORg): view external: query (cache) 'WoRlDShAKE.ORg/A/IN' denied (allow-query-cache did not match) ... show less	Brute-Force
🇺🇸 TPI-Abuse	2026-07-01 07:31:06 (5 days ago)	(mod_security) mod_security (id:225170) triggered by 160.20.123.9 (nitk-gw2-up-9.nitk.ac.in): 1 in t ... show more (mod_security) mod_security (id:225170) triggered by 160.20.123.9 (nitk-gw2-up-9.nitk.ac.in): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jul 01 03:30:58.768463 2026] [security2:error] [pid 4568:tid 4568] [client 160.20.123.9:50559] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)\|\|consolidatedoperationsgroup.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "consolidatedoperationsgroup.com"] [uri "/wp-json/wp/v2/users"] [unique_id "akTCMruJoFFEktlWMl8hcAAAABA"] show less	Brute-Force Bad Web Bot Web App Attack
🇬🇧 venus.launch.bz	2026-07-01 06:30:55 (5 days ago)	(wpscan) WordPress probe detected from 160.20.123.9 (IN/India/nitk-gw2-up-9.nitk.ac.in)	Hacking
🇳🇱 Site.eu	2026-06-30 20:18:43 (6 days ago)	Repeated wp-login/xmlrpc attempts	Brute-Force SSH
Anonymous	2026-06-29 09:45:08 (1 week ago)	[redacted] 160.20.123.9 - - [29/Jun/2026:11:44:09 +0200] "POST /xmlrpc.php HTTP/1.1" 405 428 "-" "Mo ... show more [redacted] 160.20.123.9 - - [29/Jun/2026:11:44:09 +0200] "POST /xmlrpc.php HTTP/1.1" 405 428 "-" "Mozilla/5.0 (Windows NT 6.2; x86) AppleWebKit/537.36 (KHTML, like Gecko) Edge/97.0.0.0 Safari/537.36" [redacted] 160.20.123.9 - - [29/Jun/2026:11:44:39 +0200] "POST /xmlrpc.php HTTP/1.1" 405 428 "-" "Mozilla/5.0 (Windows NT 10.0; x64) AppleWebKit/537.36 (KHTML, like Gecko) Safari/13.0.0.0 Safari/537.36" [redacted] 160.20.123.9 - - [29/Jun/2026:11:44:40 +0200] "POST /xmlrpc.php HTTP/1.1" 405 428 "-" "Mozilla/5.0 (Windows NT 10.0; x86) AppleWebKit/537.36 (KHTML, like Gecko) Edge/95.0.0.0 Safari/537.36" [redacted] 160.20.123.9 - - [29/Jun/2026:11:45:05 +0200] "POST /xmlrpc.php HTTP/1.1" 405 428 "-" "Mozilla/5.0 (Linux; Android 10; x86) AppleWebKit/537.36 (KHTML, like Gecko) Edge/89.0.0.0 Safari/537.36" [redacted] 160.20.123.9 - - [29/Jun/2026:11:45:07 +0200] "POST /xmlrpc.php HTTP/1.1" 405 428 "-" "Mozilla/5.0 (Windows NT 10.0; x64) AppleWebKit ... show less	Hacking Web App Attack
🇨🇭 4server	2026-06-28 05:04:35 (1 week ago)	[SunJun2807:04:29.5769082026][security2:error][pid334823:tid334827][client160.20.123.9:0]ModSecurity ... show more [SunJun2807:04:29.5769082026][security2:error][pid334823:tid334827][client160.20.123.9:0]ModSecurity:Accessdeniedwithcode403\(phase1\).Stringmatch\"/xmlrpc.php\"atREQUEST_URI.[file\"/etc/apache2/conf.d/modsec_custom_rules.conf\"][line\"368\"][id\"960024\"][msg\"XML-RPCdisabled\"][hostname\"gsdsagl.ch\"][uri\"/xmlrpc.php\"][unique_id\"akCrXYuRXCnIZLfWcU_caAAAAAE\"] show less	Hacking Web App Attack
Anonymous	2026-06-27 15:07:12 (1 week ago)	(wordpress) Failed wordpress login from 160.20.123.9 (IN/India/Karnataka/Surathkal/nitk-gw2-up-9.nit ... show more (wordpress) Failed wordpress login from 160.20.123.9 (IN/India/Karnataka/Surathkal/nitk-gw2-up-9.nitk.ac.in/[redacted]) show less	Brute-Force
🇮🇩 hermawan	2026-06-26 17:49:54 (1 week ago)	[Sat Jun 27 00:49:51.267056 2026] [security2:error] [pid 385489:tid 139695336969920] [client 160.20. ... show more [Sat Jun 27 00:49:51.267056 2026] [security2:error] [pid 385489:tid 139695336969920] [client 160.20.123.9:58101] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "www.yandex.go.id" at REQUEST_HEADERS:Referer. [file "/etc/modsecurity/coreruleset-4.26.0/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "601"] [id "440068"] [msg "BAD Referer"] [data "Matched Data: www.yandex.go.id found within REQUEST_HEADERS:Referer: https://www.yandex.go.id/ request_line = GET /index.php/profil/alamat-kantor/list-all-categories/555556811-mengakses-halaman-web-https-karangploso-jatim-bmkg-go-id-secara-offline-dan-menginstallnya-di-hp-android-atau-di-komputer HTTP/2.0"] [severity "NOTICE"] [hostname "staklim-jatim.bmkg.go.id"] [uri "/index.php/profil/alamat-kantor/list-all-categories/555556811-mengakses-halaman-web-https-karangploso-jatim-bmkg-go-id-secara-offline-dan-menginstallnya-di-hp-android-atau-di-komputer"] [unique_id "aj67vwKPOPv60ocUrhXuJQADQwE"], referer https://www.yandex.g ... show less	Email Spam Hacking
🇳🇱 oisecnet	2026-06-25 21:04:22 (1 week ago)	Automated report: Unauthorized vulnerability scanning detected on 2026-06-25. 1 requests from this I ... show more Automated report: Unauthorized vulnerability scanning detected on 2026-06-25. 1 requests from this IP. show less	Brute-Force Web App Attack SSH

Showing 1 to 15 of 144 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇫🇷 172.68.151.129

🇻🇳 171.251.237.35

🇵🇰 139.135.55.216

🇨🇳 124.117.195.21

🇺🇸 64.62.156.52

🇺🇸 205.210.31.89

🇧🇪 198.235.24.231

🇧🇪 198.235.24.199

🇲🇽 187.131.65.42

🇺🇸 66.132.186.249

🇧🇷 45.205.1.240

🇵🇰 39.34.134.246

🇰🇿 212.134.63.65

🇸🇦 175.110.171.19

🇺🇸 172.234.25.187

🇿🇦 172.209.216.234

🇲🇾 149.118.135.252

🇧🇩 103.153.210.248

🇲🇾 85.211.203.196

🇷🇴 80.94.92.128