This IP address has been reported a total of
28
times from
20 distinct
sources.
103.158.159.76 was first reported on
, and the most recent report was
.
In the last 60 days, the top reporter locations were:
France
with 1
report;
United States of America
with 1
report.
The most common categories in these recent reports were:
Web App Attack
1
time;
DDoS Attack
1
time;
Bad Web Bot
1
time.
Old Reports
The most recent abuse report for this IP address is from
. It is possible that this IP is no
longer involved in abusive activities.
BnL006: Obvious dumb distributed botnet crawler stepping into honeypot trap despite it clearly being ...
show moreBnL006: Obvious dumb distributed botnet crawler stepping into honeypot trap despite it clearly being a burning bag of dog poop.
103.158.159.76 443 - [16/Jun/2026:00:47:52 +0000] "GET [redacted] HTTP/1.1" 503 4647 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36"
show less
Bad Web Bot
Exploited Host
Anonymous
DDoS botnet 510.000+ IPs; URL with bing/trustpilot/githubhelp and %C2%A4 or \xc2\xa4. NEW 09/2025: a ...
show moreDDoS botnet 510.000+ IPs; URL with bing/trustpilot/githubhelp and %C2%A4 or \xc2\xa4. NEW 09/2025: amplification attacks via third-parties e.g. HTTP_USER_AGENT facebookexternalhit/meta-externalagent/meta-externalfetcher or IPs from googleusercontent.com with fake HTTP_REFERER foxnews.com/newsweek.com/upwork.com/activision.com/... Port 443.
show less
(mod_security) mod_security (id:210730) triggered by 103.158.159.76 (iqtel-159.76.dns.iq-tel.net): 1 ...
show more(mod_security) mod_security (id:210730) triggered by 103.158.159.76 (iqtel-159.76.dns.iq-tel.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Jan 17 01:12:30.208710 2026] [security2:error] [pid 5858:tid 5858] [client 103.158.159.76:58822] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||www.leothecolorman.com|F|2"] [data ".grovewood.com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.leothecolorman.com"] [uri "/tag/aces-and-eights/www.grovewood.com"] [unique_id "aWsoTuo6SkGQoRRtBneUwgAAAAs"], referer: https://www.leothecolorman.com/
show less
Brute-Force
Bad Web Bot
Web App Attack
Anonymous
Distributed web crawl botnet attack (like Mellowtel), likely illicit scraping of AI training data to ...
show moreDistributed web crawl botnet attack (like Mellowtel), likely illicit scraping of AI training data to bypass firewall/robots.txt restrictions in printer-friendly.asp
show less
