JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

103.147.106.63

Recent Activity

Abuse Confidence Score

95% Critical

56 reports

36 reporters · latest 1 day ago

ISP: Galaxy Net
Usage Type: Fixed Line ISP
ASN: AS139927
Domain Name: galaxynett.com
Country: 🇧🇩 Bangladesh
City: Dhaka, Dhaka Division

ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report Whois

Example preview

Account required for the enhanced features Log in Sign up

Abuse Reports

Export reports CSV

Total reports

56 from 36 distinct reporters

First reported

February 3rd 2024

Most recent report

1 day ago

Last 60 days

Top reporter locations 🇺🇸 United States of America 13 🇩🇪 Germany 7 🇨🇿 Czechia 4

Most common categories Web App Attack 15 Bad Web Bot 15 Brute-Force 11 Port Scan 6 Hacking 6

Recent reports We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇩🇪 KPS	2026-11-13 04:57:30 UTC · (1 day ago)	Portscan-T	Port Scan
🇫🇮 inlink.ltd	2026-11-13 01:30:07 UTC · (1 day ago)	pdf scraper	Bad Web Bot
🇩🇪 FeG Deutschland	2026-11-12 19:20:55 UTC · (1 day ago)	Looking for CMS/PHP/SQL vulnerablilities/excessive crawling - 248	Exploited Host Web App Attack
🇺🇸 computertrendz	2026-11-10 02:30:01 UTC · (4 days ago)	Blocked by os-abuseipdb; 11 hits, proto=udp, ports=443	Port Scan Hacking
🇺🇸 justbible	2026-11-09 13:41:03 UTC · (5 days ago)	HTTPS (TCP 443) scraping bot, part of a distributed and coordinated scrape: 2 requests from 2026-11-09T13:41:03+00:00 to 2026-11-09T19:53:12+00:00, e.g. 'GET /en/kjv,web,bsb,esv/matt/13/13 HTTP/2.0' with User-Agent 'Mozilla/5.0 (Windows NT 10.0; Win6 ... show more HTTPS (TCP 443) scraping bot, part of a distributed and coordinated scrape: 2 requests from 2026-11-09T13:41:03+00:00 to 2026-11-09T19:53:12+00:00, e.g. 'GET /en/kjv,web,bsb,esv/matt/13/13 HTTP/2.0' with User-Agent 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0'. Forged browser headers; spoofed user agent (did not identify itself as a bot); robots.txt ignored (a disallowed URL requested). show less	Bad Web Bot
Anonymous	2026-11-08 09:11:42 UTC · (6 days ago)	Web app attack and vulnerability scan detected from IIS logs	Brute-Force Bad Web Bot Web App Attack
🇺🇸 kosada.com	2026-11-06 16:33:52 UTC · (1 week ago)	Repeated requests classified as pathological web bot behavior, for example: /[redacted]?topics%5B0%5D=56&topics%5B3%5D=38&topics%5B4%5D=69&topics%5B5%5D=81 (HTTP/2.0 port 443, user agent: "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/5 ... show more Repeated requests classified as pathological web bot behavior, for example: /[redacted]?topics%5B0%5D=56&topics%5B3%5D=38&topics%5B4%5D=69&topics%5B5%5D=81 (HTTP/2.0 port 443, user agent: "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36") show less	DDoS Attack Bad Web Bot
🇫🇷 ingroscart.it	2026-11-05 01:47:21 UTC · (1 week ago)	(wordpress) Failed wordpress login from 103.147.106.63 (BD/Bangladesh/-/-/-/[redacted])	Brute-Force
🇨🇿 Countryman	2026-11-05 01:10:01 UTC · (1 week ago)	repeated unauthorized VPN login attempt, user sweep	VPN IP Hacking Brute-Force
🇺🇸 TPI-Abuse	2026-11-04 10:54:10 UTC · (1 week ago)	(mod_security) mod_security (id:225170) triggered by 103.147.106.63 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 04 05:54:01.644114 2026] [security2:error] [pid 24757:tid 24757] [client 103.147.106.63:34312] ... show more (mod_security) mod_security (id:225170) triggered by 103.147.106.63 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 04 05:54:01.644114 2026] [security2:error] [pid 24757:tid 24757] [client 103.147.106.63:34312] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)\|\|kdgsf.xyz\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "kdgsf.xyz"] [uri "/wp-json/wp/v2/users/me"] [unique_id "ausOyS9DgDug_4TYzhbuyAAAAA0"] show less	Brute-Force Bad Web Bot Web App Attack
🇵🇱 Budyn	2026-11-04 06:07:28 UTC · (1 week ago)	[Budyn Honeypot Sinkhole] \| Attack type: WP Path Scanning (Recon) \| Summary: Web scanner triggered an emulated security trap. \| Evidence: \| Host: jira.dont-eat-the-pudding.xyz \| Path: /xmlrpc.php \| User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64 ... show more [Budyn Honeypot Sinkhole] \| Attack type: WP Path Scanning (Recon) \| Summary: Web scanner triggered an emulated security trap. \| Evidence: \| Host: jira.dont-eat-the-pudding.xyz \| Path: /xmlrpc.php \| User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36 \| Request: <?xml version="1.0"?><methodCall><methodName>system.listMethods</methodName><params></params></methodCall> show less	Bad Web Bot Web App Attack
🇮🇩 hermawan	2026-11-04 02:17:11 UTC · (1 week ago)	[Wed Nov 04 09:17:10.507965 2026] [security2:error] [pid 298510:tid 139765944936128] [client 103.147.106.63:0] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "www.yahoo.go.id" at REQUEST_HEADERS:referer. [file "/etc/modsecurity/co ... show more [Wed Nov 04 09:17:10.507965 2026] [security2:error] [pid 298510:tid 139765944936128] [client 103.147.106.63:0] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "www.yahoo.go.id" at REQUEST_HEADERS:referer. [file "/etc/modsecurity/coreruleset-4.29.0/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "618"] [id "440068"] [msg "BAD Referer"] [data "Matched Data: www.yahoo.go.id found within REQUEST_HEADERS:referer: https://www.yahoo.go.id/ request_line = GET /index.php/profil/meteorologi/list-all-categories/551-klimatologi/prakiraan-klimatologi/peringatan-dini/555562843-press-release-kewaspadaan-cuaca-ekstrim-di-jawa-timur-11-20-maret-2026 HTTP/1.1"] [severity "NOTICE"] [hostname "staklim-jatim.bmkg.go.id"] [uri "/index.php/profil/meteorologi/list-all-categories/551-klimatologi/prakiraan-klimatologi/peringatan-dini/555562843-press-release-kewaspadaan-cuaca-ekstrim-di-jawa-timur-11-20-maret-2026"] [unique_id "auqVpirjWRvOjWoXFFZtcAAAABY"], referer https://www.yahoo.go.id ... show less	Email Spam Hacking
🇨🇿 Countryman	2026-11-03 01:10:02 UTC · (1 week ago)	repeated unauthorized VPN login attempt, user sweep	VPN IP Hacking Brute-Force
🇦🇺 QT	2026-11-01 14:30:48 UTC · (1 week ago)	Unauthorised WordPress admin login attempted at 2026-11-02 00:30:41 +1000	Web App Attack
🇪🇸 SweetHoneyPress	2026-10-30 22:32:46 UTC · (2 weeks ago)	WordPress honeypot: POST to /xmlrpc.php \| event_id=1595322 \| UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:148.0) Gecko/20100101 Firefox/148.0	Web App Attack Brute-Force

Showing 1 to 15 of 56 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown

Recently Reported IPs:

🇹🇭 180.183.31.119

🇮🇳 49.207.182.187

🇰🇿 37.99.44.228

🇧🇪 34.77.140.104

🇱🇹 194.165.16.26

🇫🇷 193.163.92.120

🇺🇸 192.155.90.80

🇺🇸 174.67.181.114

🇨🇳 111.22.163.209

🇳🇱 109.160.32.108

🇺🇸 104.222.43.173

🇷🇴 2.57.122.168

🇬🇧 188.240.59.11

🇮🇶 185.244.154.174

🇳🇬 102.88.137.80

🇷🇴 92.118.39.50

🇳🇱 86.38.187.36

🇺🇸 66.132.224.79

🇫🇷 54.38.180.48

🇺🇸 50.187.155.130