JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 103.168.159.158

103.168.159.158 was found in our database!

This IP was reported 1,451 times. Confidence of Abuse is 100%: ?

100%

ISP	PT Cover Network Indonesia
Usage Type	Fixed Line ISP
ASN	AS142317
Domain Name	covernet.id
Country	🇮🇩 Indonesia
City	Jakarta, Jakarta

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 103.168.159.158

Whois 103.168.159.158

IP Abuse Reports for 103.168.159.158:

This IP address has been reported a total of 1,451 times from 138 distinct sources. 103.168.159.158 was first reported on April 21st 2024, and the most recent report was 6 hours ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇫🇮 TrafficAnalyser	2026-06-13 14:51:42 (6 hours ago)	Port scanning	Port Scan
🇩🇪 Mailguard-FRD	2026-06-13 03:03:23 (18 hours ago)	1781319802 - 06/13/2026 05:03:22 Host: 103.168.159.158/103.168.159.158 Port: 445 TCP Blocked ...	Port Scan
🇧🇷 diego	2026-06-11 06:20:09 (2 days ago)	[rede-168-134] 06/11/2026-03:20:08.927216, 103.168.159.158, Protocol: 6, ET SCAN Suspicious inbound ... show more [rede-168-134] 06/11/2026-03:20:08.927216, 103.168.159.158, Protocol: 6, ET SCAN Suspicious inbound to MSSQL port 1433 show less	Hacking
🇫🇮 iamxorum	2026-06-11 02:47:56 (2 days ago)	2026-06-11T02:47:55.415479+00:00 XRM-01 kernel: [HONEYPORT] IN=eth0 OUT= MAC=92:00:06:e6:da:95:d2:74 ... show more 2026-06-11T02:47:55.415479+00:00 XRM-01 kernel: [HONEYPORT] IN=eth0 OUT= MAC=92:00:06:e6:da:95:d2:74:7f:6e:37:e3:08:00 SRC=103.168.159.158 DST=46.62.222.43 LEN=52 TOS=0x00 PREC=0x00 TTL=112 ID=16679 DF PROTO=TCP SPT=61044 DPT=1433 WINDOW=8192 RES=0x00 SYN URGP=0 ... show less	Port Scan
🇫🇮 6kilowatti	2026-06-10 13:01:52 (3 days ago)	2026-06-10T16:01:51.343074+03:00 6kw kernel: [UFW BLOCK] IN=eth0 OUT= MAC=00:16:3e:b6:e7:09:78:9a:18 ... show more 2026-06-10T16:01:51.343074+03:00 6kw kernel: [UFW BLOCK] IN=eth0 OUT= MAC=00:16:3e:b6:e7:09:78:9a:18:bd:57:7e:08:00 SRC=103.168.159.158 DST=5.61.88.83 LEN=52 TOS=0x00 PREC=0x00 TTL=115 ID=3526 DF PROTO=TCP SPT=56592 DPT=135 WINDOW=8192 RES=0x00 SYN URGP=0 ... show less	Port Scan
🇺🇦 space.ua	2026-06-10 12:12:52 (3 days ago)	SMB_Brute-Force	Brute-Force
🇮🇩 sockominfo	2026-06-10 02:00:54 (3 days ago)	User login to application from malicious IP 103.168.159.158.. Threat Score: 4.1/10 (MEDIUM). Confide ... show more User login to application from malicious IP 103.168.159.158.. Threat Score: 4.1/10 (MEDIUM). Confidence: 40%. CVSS v3.1: 0/10 (None). CVSS Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:N. Bayesian Probability: 57%. MITRE ATT&CK: T1016 (System Network Configuration Discovery). Tactic: TA0001. Freshness: Fresh. Source Reputation: UNKNOWN. Methodology: CVSS 3.1 + Bayesian + Temporal + Environmental + MITRE ATT&CK + OWASP. Standards: ISO/IEC 27065:2022, NIST SP 800-30, IEEE S&P 2020. Reported by TangerangKota-CSIRT. Status: MALICIOUS show less	Hacking Web App Attack
🇮🇩 sockominfo	2026-06-10 01:00:09 (3 days ago)	User login to application from malicious IP 103.168.159.158.. Threat Score: 0/10 (INFORMATIONAL). Re ... show more User login to application from malicious IP 103.168.159.158.. Threat Score: 0/10 (INFORMATIONAL). Reported by TangerangKota-CSIRT show less	Hacking Web App Attack
🇺🇸 micropedro	2026-06-09 16:10:26 (4 days ago)	4 incidents: database attack (MSSQL/MySQL). First: 2026-06-09 09:06, Last: 2026-06-09 12:10 UTC. Tri ... show more 4 incidents: database attack (MSSQL/MySQL). First: 2026-06-09 09:06, Last: 2026-06-09 12:10 UTC. Triggers: firewall-database,non-public-port,ufw-repeater,ufw-repeater. show less	Port Scan Hacking
🇪🇸 DXC-0	2026-06-09 03:00:05 (4 days ago)	Multiple attacks on Honeypot servers	Web Spam Brute-Force Web App Attack Hacking
🇩🇪 AS213449.net	2026-06-07 00:47:27 (6 days ago)	06/07/2026-02:47:17.923267 src=103.168.159.158 dst=89.144.63.2:1433 proto=6 msg=ET SCAN Suspicious i ... show more 06/07/2026-02:47:17.923267 src=103.168.159.158 dst=89.144.63.2:1433 proto=6 msg=ET SCAN Suspicious inbound to MSSQL port 1433 show less	SQL Injection
🇵🇱 sefinek.net	2026-06-07 00:45:17 (6 days ago)	Blocked by UFW on PL02 [1433/tcp] \| SPT: 54043 \| TTL: 111 \| LEN: 52 \| TOS: 0x00 • Reported by: githu ... show more Blocked by UFW on PL02 [1433/tcp] \| SPT: 54043 \| TTL: 111 \| LEN: 52 \| TOS: 0x00 • Reported by: github.com/sefinek/UFW-AbuseIPDB-Reporter show less	Port Scan
🇹🇷 SeczarSecureOps	2026-06-04 03:59:17 (1 week ago)	Auto-blocked by Seczar SecureOps — Database Service Brute Force (20 events in 5min) at 2026-06-04 03 ... show more Auto-blocked by Seczar SecureOps — Database Service Brute Force (20 events in 5min) at 2026-06-04 03:59 show less	Web App Attack
🇮🇪 RoboSOC	2026-06-03 15:05:25 (1 week ago)	SCAN: Host Sweep CloudCIX Reconnaissance Scan Detected, PTR: PTR record not found	Port Scan
🇫🇮 iamxorum	2026-06-03 08:05:08 (1 week ago)	2026-06-03T08:05:08.107680+00:00 XRM-01 kernel: [HONEYPORT] IN=eth0 OUT= MAC=92:00:06:e6:da:95:d2:74 ... show more 2026-06-03T08:05:08.107680+00:00 XRM-01 kernel: [HONEYPORT] IN=eth0 OUT= MAC=92:00:06:e6:da:95:d2:74:7f:6e:37:e3:08:00 SRC=103.168.159.158 DST=46.62.222.43 LEN=52 TOS=0x00 PREC=0x00 TTL=113 ID=13461 DF PROTO=TCP SPT=62415 DPT=1433 WINDOW=8192 RES=0x00 SYN URGP=0 ... show less	Port Scan

Showing 1 to 15 of 1451 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇯🇴 176.28.138.89

🇵🇪 161.132.50.236

🇫🇮 138.124.5.60

🇮🇳 103.25.47.94

🇳🇱 82.40.15.184

🇵🇱 82.40.6.111

🇺🇸 20.25.54.58

🇨🇳 218.17.217.141

🇧🇷 191.233.234.186

🇫🇷 185.177.72.67

🇨🇳 180.106.80.22

🇨🇦 142.44.247.134

🇻🇳 103.60.242.169

🇹🇬 102.64.162.80

🇺🇸 81.27.86.91

🇮🇳 74.125.178.217

🇺🇸 34.194.226.74

🇧🇷 201.55.113.122

🇨🇳 115.190.243.99

🇨🇳 113.56.35.44