JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 103.163.220.228

103.163.220.228 was found in our database!

This IP was reported 210 times. Confidence of Abuse is 29%: ?

29%

ISP	XS Usenet
Usage Type	Data Center/Web Hosting/Transit
ASN	AS206092
Domain Name	xsusenet.com
Country	🇯🇵 Japan
City	Asagaya-minami, Tokyo

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 103.163.220.228

Whois 103.163.220.228

IP Abuse Reports for 103.163.220.228:

This IP address has been reported a total of 210 times from 87 distinct sources. 103.163.220.228 was first reported on March 17th 2023, and the most recent report was 6 days ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇺🇸 --KBXX--	2026-07-10 23:01:54 (6 days ago)	bfa, m365	Brute-Force
Anonymous	2026-06-22 23:21:33 (3 weeks ago)	103.163.220.228 - - [23/Jun/2026:01:21:29 +0200] "POST /wp-login.php HTTP/1.1" 200 7226 "https://fem ... show more 103.163.220.228 - - [23/Jun/2026:01:21:29 +0200] "POST /wp-login.php HTTP/1.1" 200 7226 "https://femmestylista.co.bw/wp-login.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36" 103.163.220.228 - - [23/Jun/2026:01:21:30 +0200] "POST /wp-login.php HTTP/1.1" 200 7226 "https://femmestylista.co.bw/wp-login.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36" 103.163.220.228 - - [23/Jun/2026:01:21:31 +0200] "POST /wp-login.php HTTP/1.1" 200 7226 "https://femmestylista.co.bw/wp-login.php" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/139.0.0.0 Safari/537.36 Edg/139.0.3124.85" 103.163.220.228 - - [23/Jun/2026:01:21:32 +0200] "POST /wp-login.php HTTP/1.1" 200 7226 "https://femmestylista.co.bw/wp-login.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537. ... show less	Brute-Force Web App Attack
🇯🇵 ki3	2026-06-21 17:32:08 (3 weeks ago)	Fail2Ban: Web App Attacks and Forum Spam 103.163.220.228 1782063127(JST)	Web Spam Bad Web Bot Web App Attack
Anonymous	2026-06-21 02:01:03 (3 weeks ago)	103.163.220.228 - - [21/Jun/2026:04:01:00 +0200] "POST /wp-login.php HTTP/1.1" 200 7226 "https://fem ... show more 103.163.220.228 - - [21/Jun/2026:04:01:00 +0200] "POST /wp-login.php HTTP/1.1" 200 7226 "https://femmestylista.co.bw/wp-login.php" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_7_4) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.3 Safari/605.1.15" 103.163.220.228 - - [21/Jun/2026:04:01:01 +0200] "POST /wp-login.php HTTP/1.1" 200 7226 "https://femmestylista.co.bw/wp-login.php" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_7_4) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.3 Safari/605.1.15" 103.163.220.228 - - [21/Jun/2026:04:01:01 +0200] "POST /wp-login.php HTTP/1.1" 200 7226 "https://femmestylista.co.bw/wp-login.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36" 103.163.220.228 - - [21/Jun/2026:04:01:02 +0200] "POST /wp-login.php HTTP/1.1" 200 7226 "https://femmestylista.co.bw/wp-login.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36 OPR/120.0.0 ... show less	Brute-Force Web App Attack
🇬🇧 consul.to	2026-06-16 22:10:34 (1 month ago)	Web attack/malicious scanning detected	Web App Attack
🇩🇪 LRob	2026-06-12 15:15:03 (1 month ago)	Repeated 403 errors, blocked by Fail2ban in custom-403 jail	Bad Web Bot
🇧🇪 cmbplf	2026-06-12 08:28:59 (1 month ago)	779 requests with url.path //xmlrpc.php	Brute-Force Bad Web Bot
🇩🇪 LRob	2026-06-09 04:00:06 (1 month ago)	Repeated 403 errors, blocked by Fail2ban in custom-403 jail	Bad Web Bot
🇫🇷 dynamix	2026-06-08 21:56:49 (1 month ago)	Multiple WAF Violations	Web App Attack
🇨🇭 zynex	2026-05-31 08:05:40 (1 month ago)	URL Probing: /images/base/post.php	Web App Attack
🇮🇳 evicky2002	2026-05-14 06:00:00 (2 months ago)	Confirmed malicious by STILWaters CTI platform (score=100, sources=3)	Hacking Brute-Force SSH
🇺🇸 TPI-Abuse	2026-05-03 09:24:51 (2 months ago)	(mod_security) mod_security (id:240000) triggered by 103.163.220.228 (-): 1 in the last 300 secs; Po ... show more (mod_security) mod_security (id:240000) triggered by 103.163.220.228 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun May 03 05:24:46.965549 2026] [security2:error] [pid 30387:tid 30387] [client 103.163.220.228:49343] ModSecurity: Access denied with code 403 (phase 2). String match ".php" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/24_Apps_Joomla.conf"] [line "74"] [id "240000"] [rev "1"] [msg "COMODO WAF: Protecting Joomla folder\|\|haywardcarpentry.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "Joomla"] [hostname "haywardcarpentry.com"] [uri "/images/stories/themes.php"] [unique_id "afcUXj7PR4uGSE2BbRZeuAAAAAI"] show less	Brute-Force Bad Web Bot Web App Attack
🇨🇳 ThreatBook.io	2026-04-26 22:06:57 (2 months ago)	ThreatBook Intelligence: Scanner,Dynamic IP more details on https://threatbook.io/ip/103.163.220.228 ... show more ThreatBook Intelligence: Scanner,Dynamic IP more details on https://threatbook.io/ip/103.163.220.228 2026-04-26 12:30:28 /auth/static/js/chunk-vendors.1c3da631.js 2026-04-26 12:32:09 /lianruan/md5 2026-04-26 12:32:11 /api/qrcode.htm?act=getloginuuid 2026-04-26 12:32:11 /lianruan/ConfigManage/devInfo.htm?act=checkIPExists 2026-04-26 12:24:53 /admin/ 2026-04-26 12:32:10 /manager 2026-04-26 12:30:28 /auth/static/js/static/js/app.126a0316.js 2026-04-26 12:32:11 /lianruan/dhcp/reserve.htm?act=checkMACExists 2026-04-26 12:30:27 /auth/captcha_login 2026-04-26 12:32:08 /lianruan/jsencrypt.js show less	Web App Attack
🇨🇳 ThreatBook.io	2026-04-24 22:05:47 (2 months ago)	ThreatBook Intelligence: Scanner,Dynamic IP more details on https://threatbook.io/ip/103.163.220.228 ... show more ThreatBook Intelligence: Scanner,Dynamic IP more details on https://threatbook.io/ip/103.163.220.228 2026-04-24 01:19:49 /ai/proxy/http://example.org 2026-04-24 01:19:50 /lab/.htpasswd 2026-04-24 01:19:34 /gitlab/proxy?url=http://browserkernel.baidu.com/newpac31/videoproxy.conf.txt 2026-04-24 00:24:13 / 2026-04-24 00:04:28 /login/proxy?url=http://browserkernel.baidu.com/newpac31/videoproxy.conf.txt 2026-04-24 00:04:28 /login/.htpasswd 2026-04-24 00:24:09 /proxy?url=http://browserkernel.baidu.com/newpac31/videoproxy.conf.txt 2026-04-24 00:04:28 /login/env 2026-04-24 00:04:29 /login///////../../../etc/passwd 2026-04-24 01:19:29 /g/..;/env show less	Web App Attack
🇩🇪 EGP Abuse Dept	2026-04-20 12:39:36 (2 months ago)	Scanning for web/db/file exploits on www.evenementenkleding.nl	SQL Injection Bad Web Bot Web App Attack

Showing 1 to 15 of 210 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇺🇸 162.216.149.227

🇸🇬 118.26.111.107

🇺🇸 85.254.128.161

🇮🇳 210.212.136.3

🇧🇪 198.235.24.145

🇮🇳 125.62.196.225

🇻🇳 116.110.1.90

🇮🇩 103.46.8.70

🇮🇳 103.10.224.209

🇬🇧 81.19.219.205

🇺🇸 74.114.28.221

🇺🇸 66.132.172.41

🇮🇳 59.89.17.173

🇨🇦 2604:a880:cad:d0:0:1:90ac:8001

🇩🇪 217.229.9.136

🇭🇰 199.45.155.77

🇺🇸 195.184.76.107

🇺🇸 170.187.165.218

🇧🇬 79.124.40.110

🇱🇹 45.227.254.170