JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 203.29.26.49

203.29.26.49 was found in our database!

This IP was reported 12 times. Confidence of Abuse is 8%: ?

ISP	PT. Java Digital Nusantara
Usage Type	Fixed Line ISP
ASN	AS135477
Domain Name	nusantara.net.id
Country	🇮🇩 Indonesia
City	Jember, East Java

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 203.29.26.49

Whois 203.29.26.49

IP Abuse Reports for 203.29.26.49:

This IP address has been reported a total of 12 times from 9 distinct sources. 203.29.26.49 was first reported on April 27th 2025, and the most recent report was 1 month ago.

Old Reports: The most recent abuse report for this IP address is from 1 month ago . It is possible that this IP is no longer involved in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇩🇪 Vegascosmetics	2026-06-19 00:11:21 (1 month ago)	(Kingcopy.org-AI-IDS-Report):IP automatically blocked after obfuscated redirect. Vegas Security	DDoS Attack Hacking Exploited Host
🇮🇩 hermawan	2026-05-31 05:44:19 (1 month ago)	05/31/2026-12:44:09.567467 [Drop] [] [1:921373:1] Suricata Dibuat Gemini TCP SYN port scanner - W ... show more 05/31/2026-12:44:09.567467 [Drop] [] [1:921373:1] Suricata Dibuat Gemini TCP SYN port scanner - Win 65535 [**] [Classification: (null)] [Priority: 3] {TCP} 203.29.26.49:51554 -> 103.166.156.58:443 ... show less	Email Spam Hacking
🇮🇩 hermawan	2026-05-26 09:14:40 (1 month ago)	05/26/2026-15:58:32.034398 [Drop] [*] [1:2210016:2] SURICATA STREAM CLOSEWAIT FIN out of window [ ... show more 05/26/2026-15:58:32.034398 [Drop] [] [1:2210016:2] SURICATA STREAM CLOSEWAIT FIN out of window [] [Classification: Generic Protocol Command Decode] [Priority: 3] {TCP} 203.29.26.49:19202 -> 103.166.156.58:443 ... show less	Email Spam Hacking
🇮🇹 Fusty	2026-05-05 06:13:08 (2 months ago)	Unauthorized attempt on (TCP on port 23). Source port: 18203 TTL: 48 Packet length: 60 Timestamp: 20 ... show more Unauthorized attempt on (TCP on port 23). Source port: 18203 TTL: 48 Packet length: 60 Timestamp: 2026-05-05 08:13:08 show less	Port Scan Hacking Brute-Force
🇩🇪 filstal.org	2026-04-30 11:53:55 (2 months ago)	Bad web bot: Spoofed/obsolete UA (Opera/9.74.(Windows 98; ml-IN) Presto/2.9.170 Version/10.00). Mass ... show more Bad web bot: Spoofed/obsolete UA (Opera/9.74.(Windows 98; ml-IN) Presto/2.9.170 Version/10.00). Mass-scanning WordPress plugin. Coordinated large-scale bot attack. show less	Bad Web Bot Web App Attack
🇸🇪 Johan Finn	2026-01-17 17:07:42 (6 months ago)	malicious activity	Web App Attack
🇦🇺 MAGIC	2025-10-16 01:29:20 (9 months ago)	VM1 Bad user agents ignoring web crawling rules. Draing bandwidth	DDoS Attack Bad Web Bot
🇮🇩 hermawan	2025-10-02 15:02:08 (9 months ago)	[Thu Oct 02 22:01:26.093836 2025] [security2:error] [pid 227203:tid 140597236057792] [client 203.29. ... show more [Thu Oct 02 22:01:26.093836 2025] [security2:error] [pid 227203:tid 140597236057792] [client 203.29.26.49:59758] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i),.?[\\"'\\\\)0-9`-f][\\"'`](?:[\\"'`].?[\\"'`]\|(?:\\\\r?\\\\n)?\\\\z\|[^\\"'`]+)\|[^0-9A-Z_a-z]select.+[^0-9A-Z_a-z]?from\|(?:alter\|(?:(?:cre\|trunc\|upd)at\|renam)e\|d(?:e(?:lete\|sc)\|rop)\|(?:inser\|selec)t\|load)[\\\\s\\\\x0b]?\\\\([\\\\s\\\\x0b]?space[\\\\s\\\\x0b]?\\\\(" at REQUEST_HEADERS:User-Agent. [file "/etc/modsecurity/coreruleset-4.16.0/rules/REQUEST-942-APPLICATION-ATTACK-SQLI.conf"] [line "2129"] [id "942200"] [msg "Detects MySQL comment-/space-obfuscated injections and backtick termination"] [data " Matched Data ARGS charset: - Matched Data TX.1: found within Content-Type multipart form Matched Data: , like Gecko) Version/4.0 Chrome/141.0.7390.43 Mobile Safari/537.36 OcIdWebView ({\\x22os\\x22:\\x22Android\\x22, found within REQUEST_HEADERS:User-Agent: Mozilla/5.0 (Linux; Android 13; SM-M325FV ... show less	Hacking Web App Attack
🇩🇪 pressler.pro	2025-09-21 02:28:21 (9 months ago)	Fail2ban - DDoS attack on woocommerce shop ...	DDoS Attack
🇩🇪 jjdb	2025-09-16 09:33:03 (10 months ago)	dmarc report	Spoofing
🇫🇷 Dorian GRANDHAY	2025-09-07 19:50:18 (10 months ago)	203.29.26.49 (ID/Indonesia/-), 5 distributed smtpauth attacks on account [[email protected]] in t ... show more 203.29.26.49 (ID/Indonesia/-), 5 distributed smtpauth attacks on account [[email protected]] in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_DISTATTACK; Logs: 2025-09-07 21:48:51 dovecot_plain authenticator failed for ([31.57.166.58]) [203.29.26.49]:52407: 535 Incorrect authentication data ([email protected]) 2025-09-07 21:50:07 dovecot_login authenticator failed for ([31.57.166.58]) [64.137.209.164]:62906: 535 Incorrect authentication data ([email protected]) 2025-09-07 21:48:58 dovecot_login authenticator failed for ([31.57.166.58]) [203.29.26.49]:52407: 535 Incorrect authentication data ([email protected]) 2025-09-07 21:50:00 dovecot_plain authenticator failed for ([31.57.166.58]) [64.137.209.164]:62906: 535 Incorrect authentication data ([email protected]) 2025-09-07 21:50:14 dovecot_plain authenticator failed for ([31.57.166.58]) [51.36.40.27]:1060: 535 Incorrect authentication data ([email protected]) IP Addresses Blocked: show less	Port Scan
🇮🇩 hermawan	2025-04-27 10:48:13 (1 year ago)	[Sun Apr 27 17:48:12.638514 2025] [security2:error] [pid 976452:tid 140550520911552] [client 203.29. ... show more [Sun Apr 27 17:48:12.638514 2025] [security2:error] [pid 976452:tid 140550520911552] [client 203.29.26.49:50244] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i),.?[\\"'\\\\)0-9`-f][\\"'`](?:[\\"'`].?[\\"'`]\|(?:\\\\r?\\\\n)?\\\\z\|[^\\"'`]+)\|[^0-9A-Z_a-z]select.+[^0-9A-Z_a-z]?from\|(?:alter\|(?:(?:cre\|trunc\|upd)at\|renam)e\|d(?:e(?:lete\|sc)\|rop)\|(?:inser\|selec)t\|load)[\\\\s\\\\x0b]?\\\\([\\\\s\\\\x0b]?space[\\\\s\\\\x0b]?\\\\(" at REQUEST_HEADERS:User-Agent. [file "/etc/modsecurity/coreruleset-4.13.0/rules/REQUEST-942-APPLICATION-ATTACK-SQLI.conf"] [line "2168"] [id "942200"] [msg "Detects MySQL comment-/space-obfuscated injections and backtick termination"] [data " Matched Data ARGS charset: - Matched Data TX.1: found within Content-Type multipart form Matched Data: , like Gecko) Version/4.0 Chrome/135.0.7049.100 Mobile Safari/537.36 OcIdWebView ({\\x22os\\x22:\\x22Android\\x22, found within REQUEST_HEADERS:User-Agent: Mozilla/5.0 (Linux; Android 12; SM-A025F ... show less	Hacking Web App Attack

Showing 1 to 12 of 12 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇹🇭 223.204.246.71

🇺🇸 147.185.132.55

🇮🇳 103.17.50.91

🇳🇱 91.92.40.237

🇳🇱 45.148.10.147

🇩🇪 45.135.141.16

🇺🇸 206.82.3.190

🇺🇸 205.210.31.67

🇺🇸 172.202.30.177

🇳🇱 77.239.124.249

🇺🇸 20.171.9.108

🇺🇸 2a09:bac5:963f:3af::5e:67

🇮🇳 182.95.12.178

🇺🇸 172.210.68.21

🇨🇳 122.236.222.233

🇺🇸 100.29.192.119

🇹🇷 94.154.43.188

🇧🇬 91.92.199.36

🇳🇱 45.148.10.152

🇸🇬 2404:6800:4003:c20::123