JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 103.92.209.1

103.92.209.1 was found in our database!

This IP was reported 27 times. Confidence of Abuse is 80%: ?

80%

ISP	UNIVERSITAS 17 AGUSTUS 1945 BANYUWANGI
Usage Type	University/College/School
ASN	AS136110
Domain Name	untag-banyuwangi.ac.id
Country	🇮🇩 Indonesia
City	Banyuwangi, East Java

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 103.92.209.1

Whois 103.92.209.1

IP Abuse Reports for 103.92.209.1:

This IP address has been reported a total of 27 times from 21 distinct sources. 103.92.209.1 was first reported on January 11th 2021, and the most recent report was 4 days ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇲🇽 octageeks.com	2026-08-24 04:18:24 (4 days ago)	Wordpress malicious attack:[octablocked]	Web App Attack
🇺🇸 ANTI SCANNER	2026-08-23 20:42:54 (4 days ago)	Scanner : /administrator/	Web Spam
🇺🇸 TPI-Abuse	2026-08-23 16:57:53 (5 days ago)	(mod_security) mod_security (id:225170) triggered by 103.92.209.1 (-): 1 in the last 300 secs; Ports ... show more (mod_security) mod_security (id:225170) triggered by 103.92.209.1 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Aug 23 12:57:48.070423 2026] [security2:error] [pid 17327:tid 17327] [client 103.92.209.1:48082] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)\|\|evelynkay.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "evelynkay.com"] [uri "/wp-json/wp/v2/users/"] [unique_id "aosmjMLwMeqNaL2hIJUIUAAAAAQ"] show less	Brute-Force Bad Web Bot Web App Attack
🇩🇪 LRob	2026-08-23 12:55:06 (5 days ago)	Malicious web request: probing for secrets, traversal or a known exploit path \| method: GET \| path: ... show more Malicious web request: probing for secrets, traversal or a known exploit path \| method: GET \| path: /wp-json/wp/v2/users/ \| 2026-08-23 12:55 UTC show less	Hacking Web App Attack
🇷🇸 Smel	2026-08-22 11:37:03 (6 days ago)	HTTP/80/443/8080 Unauthorized Probe, Hack -	Hacking Web App Attack
🇳🇱 maxxsense	2026-08-21 14:54:49 (1 week ago)	(wordpress) Failed wordpress login from 103.92.209.1 (ID/Indonesia/-)	Brute-Force
🇫🇮 bittiguru.fi	2026-08-19 21:09:51 (1 week ago)	103.92.209.1 - [20/Aug/2026:00:09:34 +0300] "POST /wp-login.php HTTP/1.1" 403 9704 "https://vatupass ... show more 103.92.209.1 - [20/Aug/2026:00:09:34 +0300] "POST /wp-login.php HTTP/1.1" 403 9704 "https://vatupassi.fi/wp-login.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:138.0) Gecko/20100101 Firefox/138.0" "-" 103.92.209.1 - [20/Aug/2026:00:09:38 +0300] "POST /wp-login.php HTTP/1.1" 404 81641 "https://vatupassi.fi/wp-login.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:138.0) Gecko/20100101 Firefox/138.0" "-" 103.92.209.1 - [20/Aug/2026:00:09:42 +0300] "POST /wp-login.php HTTP/1.1" 404 81633 "https://vatupassi.fi/wp-login.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:138.0) Gecko/20100101 Firefox/138.0" "-" 103.92.209.1 - [20/Aug/2026:00:09:46 +0300] "POST /wp-login.php HTTP/1.1" 404 81633 "https://vatupassi.fi/wp-login.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:138.0) Gecko/20100101 Firefox/138.0" "-" 103.92.209.1 - [20/Aug/2026:00:09:50 +0300] "POST /wp-login.php HTTP/1.1" 404 81633 "https://vatupassi.fi/wp-login.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:138.0) ... show less	Hacking Brute-Force Web App Attack
🇦🇺 oncord	2026-08-19 05:28:56 (1 week ago)	Form spam	Web Spam
🇩🇪 LRob	2026-08-18 10:28:13 (1 week ago)	WordPress REST-API user enumeration (probing CVE-2017-5487 to harvest usernames) \| req: /wp-json/wp/ ... show more WordPress REST-API user enumeration (probing CVE-2017-5487 to harvest usernames) \| req: /wp-json/wp/v2/users/ \| UA: Go-http-client/1.1 show less	Hacking Web App Attack
🇺🇸 ANTI SCANNER	2026-08-18 06:47:02 (1 week ago)	Scanner : /administrator/	Web Spam
🇺🇸 helios.live	2026-08-17 19:01:18 (1 week ago)	2026/08/17 19:01:12 [error] 1026388#1026388: 157069 FastCGI sent in stderr: "Primary script unknown ... show more 2026/08/17 19:01:12 [error] 1026388#1026388: 157069 FastCGI sent in stderr: "Primary script unknown" while reading response header from upstream, client: 103.92.209.1, server: kocerroxy.com, request: "GET /administrator/index.php HTTP/1.1", upstream: "fastcgi://unix:/var/run/php/php8.4-fpm-betakocerroxycom.sock:", host: "kocerroxy.com" 103.92.209.1 - - [17/Aug/2026:19:01:12 +0000] "GET /administrator/index.php HTTP/1.1" 404 47 "-" "Mozilla/5.0 (iPad; CPU OS 12_1_4 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0 Mobile/15E148 Safari/604.1" 2026/08/17 19:01:14 [error] 1026388#1026388: *157069 FastCGI sent in stderr: "Primary script unknown" while reading response header from upstream, client: 103.92.209.1, server: kocerroxy.com, request: "GET /wp-login.php HTTP/1.1", upstream: "fastcgi://unix:/var/run/php/php8.4-fpm-betakocerroxycom.sock:", host: "kocerroxy.com" 103.92.209.1 - - [17/Aug/2026:19:01:14 +0000] "GET /wp-login.php HTTP/1.1" 404 47 "-" "Mozilla/5.0 (iPad; ... show less	Web App Attack
🇮🇩 sockominfo	2026-08-17 11:00:53 (1 week ago)	Zimbra: Login failures from malicious IP: 103.92.209.1. Threat Score: 6.4/10 (MEDIUM). Confidence: 4 ... show more Zimbra: Login failures from malicious IP: 103.92.209.1. Threat Score: 6.4/10 (MEDIUM). Confidence: 40%. CVSS v3.1: 4.6/10 (Medium). CVSS Vector: CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L. Bayesian Probability: 77%. MITRE ATT&CK: T1083 (File and Directory Discovery). Tactic: TA0001. Freshness: Very Fresh. Source Reputation: UNKNOWN. Methodology: CVSS 3.1 + Bayesian + Temporal + Environmental + MITRE ATT&CK + OWASP. Standards: ISO/IEC 27065:2022, NIST SP 800-30, IEEE S&P 2020. Reported by TangerangKota-CSIRT. Status: MALICIOUS show less	Hacking Web App Attack
🇮🇩 sockominfo	2026-08-17 10:00:09 (1 week ago)	Zimbra: Login failures from malicious IP: 103.92.209.1. Threat Score: 6/10 (MEDIUM). Reported by Tan ... show more Zimbra: Login failures from malicious IP: 103.92.209.1. Threat Score: 6/10 (MEDIUM). Reported by TangerangKota-CSIRT show less	Hacking Web App Attack
🇨🇿 ptlab	2026-08-16 18:45:09 (1 week ago)	Detected wp_login attack from WP-host.	Hacking Web App Attack
🇮🇩 sockominfo	2026-08-16 11:00:53 (1 week ago)	Zimbra: Login failures from malicious IP: 103.92.209.1. Threat Score: 6.3/10 (MEDIUM). Confidence: 4 ... show more Zimbra: Login failures from malicious IP: 103.92.209.1. Threat Score: 6.3/10 (MEDIUM). Confidence: 40%. CVSS v3.1: 4.6/10 (Medium). CVSS Vector: CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L. Bayesian Probability: 75%. MITRE ATT&CK: T1083 (File and Directory Discovery). Tactic: TA0001. Freshness: Fresh. Source Reputation: UNKNOWN. Methodology: CVSS 3.1 + Bayesian + Temporal + Environmental + MITRE ATT&CK + OWASP. Standards: ISO/IEC 27065:2022, NIST SP 800-30, IEEE S&P 2020. Reported by TangerangKota-CSIRT. Status: MALICIOUS show less	Hacking Web App Attack

Showing 1 to 15 of 27 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇬🇧 195.96.139.243

🇬🇧 195.96.139.223

🇬🇧 195.96.139.74

🇳🇱 192.253.248.223

🇺🇸 172.253.244.154

🇧🇷 168.197.237.38

🇭🇰 165.154.41.6

🇫🇮 147.185.133.12

🇺🇸 147.185.132.217

🇫🇷 90.27.177.14

🇫🇷 85.217.140.16

🇱🇹 62.60.130.201

🇷🇴 80.94.92.234

🇳🇱 45.148.10.152

🇳🇱 45.148.10.12

🇬🇧 35.203.210.153

🇺🇸 34.26.148.248

🇳🇱 195.178.110.204

🇳🇱 195.178.110.39

🇬🇧 193.176.29.22