JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 206.237.109.11

206.237.109.11 was found in our database!

This IP was reported 34 times. Confidence of Abuse is 99%: ?

99%

ISP	Herza Cloud
Usage Type	Data Center/Web Hosting/Transit
ASN	AS140443
Domain Name	herza.id
Country	🇮🇩 Indonesia
City	Surabaya, East Java

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 206.237.109.11

Whois 206.237.109.11

IP Abuse Reports for 206.237.109.11:

This IP address has been reported a total of 34 times from 19 distinct sources. 206.237.109.11 was first reported on August 30th 2026, and the most recent report was 15 hours ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇹🇭 MWA SOC	2026-09-01 23:04:28 (15 hours ago)		SQL Injection
🇮🇱 spd.co.il	2026-09-01 22:01:40 (16 hours ago)	Web application attack detected	Hacking Web App Attack
Anonymous	2026-09-01 10:23:42 (1 day ago)	[Drupal AbuseIPDB module] Request path is blacklisted. /wp-json/batch/v1	Web App Attack
🇹🇼 kk_it_man	2026-09-01 10:03:02 (1 day ago)	ET WEB_SERVER Possible SQL Injection SELECT CONCAT in HTTP Request Body ET WEB_SERVER Possible SQL ... show more ET WEB_SERVER Possible SQL Injection SELECT CONCAT in HTTP Request Body ET WEB_SERVER Possible SQL Injection UNION SELECT in HTTP Request Body ET WEB_SPECIFIC_APPS WordPress Core wp2shell Remote Code Execution (CVE-2026-63030 & CVE-2026-60137) M2 show less	Port Scan
🇮🇩 sockominfo	2026-09-01 09:01:11 (1 day ago)	Active Response: IP 206.237.109.11 Blocked via Firewall Drop, WP2Shell activity detected (Success: 2 ... show more Active Response: IP 206.237.109.11 Blocked via Firewall Drop, WP2Shell activity detected (Success: 200)., Webshell discovery success (Response: 200). Threat Score: 9.6/10 (CRITICAL). Confidence: 85%. CVSS v3.1: 10/10 (Critical). CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H. Bayesian Probability: 99%. MITRE ATT&CK: T1566 (Phishing). Tactic: TA0001. Freshness: Fresh. Source Reputation: KNOWN_MALICIOUS. Methodology: CVSS 3.1 + Bayesian + Temporal + Environmental + MITRE ATT&CK + OWASP. Standards: ISO/IEC 27065:2022, NIST SP 800-30, IEEE S&P 2020. Reported by TangerangKota-CSIRT. Status: MALICIOUS show less	Hacking Email Spam
🇺🇸 ambor	2026-09-01 08:38:19 (1 day ago)	Attack type: wordpress_attack_attempt \| Target: /wp-json/batch/v1 \| UA: Mozilla/5.0 (Windows NT 10.0 ... show more Attack type: wordpress_attack_attempt \| Target: /wp-json/batch/v1 \| UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWeb \| Country: ID show less	Web App Attack Brute-Force
🇮🇩 sockominfo	2026-09-01 08:00:13 (1 day ago)	Active Response: IP 206.237.109.11 Blocked via Firewall Drop. Threat Score: 0/10 (INFORMATIONAL). Re ... show more Active Response: IP 206.237.109.11 Blocked via Firewall Drop. Threat Score: 0/10 (INFORMATIONAL). Reported by TangerangKota-CSIRT show less	Hacking Web App Attack
🇮🇩 sockominfo	2026-09-01 07:00:09 (1 day ago)	Webshell discovery success (Response: 200). Threat Score: 9.2/10 (CRITICAL). Reported by TangerangKo ... show more Webshell discovery success (Response: 200). Threat Score: 9.2/10 (CRITICAL). Reported by TangerangKota-CSIRT. Status: MALICIOUS show less	Hacking Email Spam
Anonymous	2026-09-01 05:35:00 (1 day ago)	'Suspicious Activity'	Web App Attack Hacking
🇺🇸 mnsf	2026-09-01 01:05:43 (1 day ago)	Too many Status 40X (14)	Brute-Force Web App Attack
🇩🇪 LRob	2026-08-31 21:31:52 (1 day ago)	Malicious web request: probing for secrets, traversal or a known exploit path \| method: GET \| path: ... show more Malicious web request: probing for secrets, traversal or a known exploit path \| method: GET \| path: /wp-json/batch/v1 \| 2026-08-31 21:31 UTC show less	Hacking Web App Attack
🇺🇦 URAN Publishing Service	2026-08-31 20:09:33 (1 day ago)	[31/Aug/2026:23:09:33 +0300] -- 206.237.109.11 Ban reason: Scanner [CMS_GENERIC] \| Request: POST /wp ... show more [31/Aug/2026:23:09:33 +0300] -- 206.237.109.11 Ban reason: Scanner [CMS_GENERIC] \| Request: POST /wp-json/batch/v1 HTTP/1.1 show less	Bad Web Bot Web App Attack
🇪🇸 alferez	2026-08-31 18:22:54 (1 day ago)	wp2shell bug exploit	Hacking Exploited Host Web App Attack
Anonymous	2026-08-31 14:13:16 (2 days ago)	Attack detected: 206.237.109.11 [2026-08-31] Categories: 21 --- wp2shell/batch exploit (7 hits) --- ... show more Attack detected: 206.237.109.11 [2026-08-31] Categories: 21 --- wp2shell/batch exploit (7 hits) --- 206.237.109.11 - - [31/Aug/2026:13:01:40 +0000] "POST /wp-json/batch/v1 HTTP/1.1" 207 1004 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 206.237.109.11 - - [31/Aug/2026:13:01:42 +0000] "POST /wp-json/batch/v1 HTTP/1.1" 207 1004 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 206.237.109.11 - - [31/Aug/2026:13:01:43 +0000] "POST /wp-json/batch/v1 HTTP/1.1" 207 1004 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 206.237.109.11 - - [31/Aug/2026:13:01:47 +0000] "POST /wp-json/batch/v1 HTTP/1.1" 207 1004 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 206.237.109.11 - - [31/Aug/2026:13:01:48 +0000] "POST /wp-json/batch/v1 HTTP/1.1" 207 10 show less	Web App Attack
🇮🇩 sockominfo	2026-08-31 13:00:57 (2 days ago)	Active Response: IP 206.237.109.11 Blocked via Firewall Drop. Threat Score: 3.8/10 (LOW). Confidence ... show more Active Response: IP 206.237.109.11 Blocked via Firewall Drop. Threat Score: 3.8/10 (LOW). Confidence: 30%. CVSS v3.1: 0/10 (None). CVSS Vector: CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:N. Bayesian Probability: 40%. MITRE ATT&CK: T1016 (System Network Configuration Discovery). Tactic: TA0001. Freshness: Fresh. Source Reputation: UNKNOWN. Methodology: CVSS 3.1 + Bayesian + Temporal + Environmental + MITRE ATT&CK + OWASP. Standards: ISO/IEC 27065:2022, NIST SP 800-30, IEEE S&P 2020. Reported by TangerangKota-CSIRT show less	Hacking Web App Attack

Showing 1 to 15 of 34 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇧🇩 182.48.68.82

🇮🇳 122.180.242.27

🇻🇳 103.77.247.206

🇫🇷 91.196.152.205

🇳🇱 91.92.40.188

🇫🇷 90.112.104.249

🇩🇪 89.117.104.21

🇫🇷 37.66.29.244

🇨🇱 34.176.157.162

🇨🇳 182.32.204.209

🇺🇸 65.49.1.134

🇳🇱 34.13.148.18

🇬🇧 217.146.80.123

🇦🇺 216.226.77.10

🇦🇷 200.59.122.158

🇭🇰 165.154.61.184

🇷🇴 85.186.244.106

🇸🇬 84.75.155.238

🇺🇸 66.228.62.156

🇭🇰 46.8.78.208