This IP address has been reported a total of
35
times from
22 distinct
sources.
103.138.123.67 was first reported on
, and the most recent report was
.
Recent Reports:
We have received reports of abusive activity from this IP address within the last week. It is
potentially still actively engaged in abusive activities.
Reporter
IoA Timestamp (UTC)
Comment
Categories
Anonymous
suricata IPS/IDS detection, ruleset ET SCAN Potential SSH Scan
Aug 26 13:05:54 kernel: [1445009.640787] [UFW BLOCK] IN=ens160 OUT= SRC=103.138.123.67 LEN=60 TOS=0x ...
show moreAug 26 13:05:54 kernel: [1445009.640787] [UFW BLOCK] IN=ens160 OUT= SRC=103.138.123.67 LEN=60 TOS=0x00 PREC=0x00 TTL=54 ID=34984 DF PROTO=TCP SPT=40148 DPT=23 WINDOW=65535 RES=0x00 SYN URGP=0
...
show less
Port Scan
Anonymous
Large-scale coordinated botnet (2M+ IPs). Ordered by Alexander Pen'kov (alexander-pen-kov-7b41aa6a/S ...
show moreLarge-scale coordinated botnet (2M+ IPs). Ordered by Alexander Pen'kov (alexander-pen-kov-7b41aa6a/Shursky [yordim|LIS|MOW]); Attacker: Mikhail Smirnov (mikhail-smirnov-79830323/Aidan [MOW]) employed by Angara Technologies Group | Attack Signature Blocked: /catalog/product_compare/add/product/135/uenc/aHR0cHM6Ly93d3cuZDJvZmZpY2UucnUvY2F0YWxvZ3NlYXJjaC9yZXN1bHQvP2NhdD00NSZhbXA7bW9kZT1ncmlkJmFtcDtwPTImYW1wO3E9RFZJKzEwNCtUeCUyRlJ4/form_key/FFk4GbeytRYDAGRk/ | UA: Mozilla/5.0 (iPod; U; CPU iPhone OS 3_2 like Mac OS X; is-IS) AppleWebKit/535.8.3 (KHTML, like Gecko) Version/4.0.5 Mobile/8B112 Safari/6535.8.3 | (Magento Site)
show less
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Sa ...
show moreMozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36 Edg/144.0.0.0
show less
UDP flood (DDoS) vs AS215599: 85 pkts / 0.12 MB to UDP 8443 across 61 dst IP(s), 2026-08-19 21:46 to ...
show moreUDP flood (DDoS) vs AS215599: 85 pkts / 0.12 MB to UDP 8443 across 61 dst IP(s), 2026-08-19 21:46 to 2026-08-20 00:36 CEST. No legitimate service on these UDP ports (7-day baseline 0 GB/day). Carpet-bombing of a /24, likely botnet-compromised host. Evidence: sFlow + hardware ACL counters.
show less
This IP address carried out 2 port scanning attempts on 13-08-2026. For more information or to repor ...
show moreThis IP address carried out 2 port scanning attempts on 13-08-2026. For more information or to report interesting / incorrect findings, give me a shoutout @parthmaniar on Twitter.
show less
BnL006: Obvious dumb distributed botnet crawler stepping into honeypot trap despite it clearly being ...
show moreBnL006: Obvious dumb distributed botnet crawler stepping into honeypot trap despite it clearly being a burning bag of dog poop.
103.138.123.67 443 - [01/Aug/2026:23:11:06 +0000] "GET [redacted] HTTP/1.1" 200 6888 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:135.0) Gecko/20100101 Firefox/135.0"
show less