JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 103.189.63.149

103.189.63.149 was found in our database!

This IP was reported 97 times. Confidence of Abuse is 45%: ?

45%

ISP	PT Blip Integrator Provider
Usage Type	Fixed Line ISP
ASN	AS149746
Hostname(s)	ipv4-63-189-103.blip.net.id
Domain Name	blip.net.id
Country	🇮🇩 Indonesia
City	Legian, Bali

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 103.189.63.149

Whois 103.189.63.149

IP Abuse Reports for 103.189.63.149:

This IP address has been reported a total of 97 times from 49 distinct sources. 103.189.63.149 was first reported on January 24th 2025, and the most recent report was 1 day ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇮🇳 liveaspankaj	2026-03-10 18:58:53 (2 months ago)	DDoS attack: 114 requests in 5m (GET / or repair.php).	DDoS Attack
🇨🇿 interconnect.cz	2026-03-06 17:22:04 (2 months ago)	[06/Mar/2026 18:22:02] IP address 103.189.63.149 found in DNS blacklist SpamCop, mail from <ivsxlxpp ... show more [06/Mar/2026 18:22:02] IP address 103.189.63.149 found in DNS blacklist SpamCop, mail from <[email protected]> to <[email protected]> [06/Mar/2026 18:22:02] IP address 103.189.63.149 found in DNS blacklist SpamHaus SBL-XBL, mail from <[email protected]> to <[email protected]> [06/Mar/2026 18:22:03] IP address 103.189.63.149 found in DNS blacklist SpamHaus SBL-XBL, mail from <[email protected]> to <[email protected]> ... show less	Brute-Force Email Spam
🇨🇭 Origon	2026-03-03 19:56:34 (3 months ago)	NOQUEUE - IP: 103.189.63.149 - Mar 3 20:56:34 plesk postfix/smtpd[1369183]: NOQUEUE: reject: RCPT f ... show more NOQUEUE - IP: 103.189.63.149 - Mar 3 20:56:34 plesk postfix/smtpd[1369183]: NOQUEUE: reject: RCPT from unknown[103.189.63.149]: 554 5.7.1 Service unavailable; Client host [103.189.63.149] blocked using dnsbl-1.uceprotect.net; IP 103.189.63.149 is UCEPROTECT-Level 1 listed. See http://www.uceprotect.net/rblcheck.php?ipr=103.189.63.149; from=<REDACTED@REDACTED> to=<REDACTED@REDACTED> proto=ESMTP helo=<ipv4-63-189-103.blip.net.id> show less	Email Spam
🇨🇿 interconnect.cz	2026-02-27 15:20:46 (3 months ago)	[27/Feb/2026 16:20:45] IP address 103.189.63.149 found in DNS blacklist SpamCop, mail from <nqonik@y ... show more [27/Feb/2026 16:20:45] IP address 103.189.63.149 found in DNS blacklist SpamCop, mail from <[email protected]> to <[email protected]> [27/Feb/2026 16:20:45] IP address 103.189.63.149 found in DNS blacklist SpamHaus SBL-XBL, mail from <[email protected]> to <[email protected]> [27/Feb/2026 16:20:45] IP address 103.189.63.149 found in DNS blacklist SpamHaus SBL-XBL, mail from <[email protected]> to <[email protected]> ... show less	Brute-Force Email Spam
🇦🇱 cheatmaster.store	2026-02-27 01:16:09 (3 months ago)	Automated report: This IP address has been identified as an active public open proxy. Classification ... show more Automated report: This IP address has been identified as an active public open proxy. Classification: Open Proxy \| Spoofing \| VPN/Anonymizer \| Bad Web Bot. Country: Indonesia Threat level: High. This host is listed across multiple public proxy databases and poses a risk of abuse, credential stuffing, scraping, and spoofed traffic. Reported by automated threat intelligence pipeline. Do not whitelist without manual verification. show less	Web Spam Port Scan Web App Attack
🇵🇱 cheatmaster.store	2026-02-25 23:04:53 (3 months ago)	Automated report: This IP address has been identified as an active public open proxy. Classification ... show more Automated report: This IP address has been identified as an active public open proxy. Classification: Open Proxy \| Spoofing \| VPN/Anonymizer \| Bad Web Bot. Country: Indonesia Threat level: High. This host is listed across multiple public proxy databases and poses a risk of abuse, credential stuffing, scraping, and spoofed traffic. Reported by automated threat intelligence pipeline. Do not whitelist without manual verification. show less	Web Spam Port Scan Web App Attack
🇮🇳 liveaspankaj	2026-02-12 12:26:19 (3 months ago)	DDoS attack on learngeeta.com: 87 requests of GET / HTTP/1.1 over plain HTTP with no referrer. Autom ... show more DDoS attack on learngeeta.com: 87 requests of GET / HTTP/1.1 over plain HTTP with no referrer. Automated bot attack with randomized User-Agents (outdated Chrome 127-129). show less	DDoS Attack
🇺🇸 COMPLEX	2026-01-26 01:07:22 (4 months ago)	Triggered Cloudflare WAF (l7ddos) from ID. Action taken: BLOCK ASN: undefined (undefined) Protocol: ... show more Triggered Cloudflare WAF (l7ddos) from ID. Action taken: BLOCK ASN: undefined (undefined) Protocol: HTTP/2 (GET method) Endpoint: / UA: Mozilla/5.0 (Android 12; Mobile; rv:146.0) Gecko/146.0 Firefox/146.0 show less	DDoS Attack Bad Web Bot
🇪🇸 10dencehispahard SL	2026-01-23 07:26:03 (4 months ago)	Wordpress probing for vulnerabilities	Hacking Exploited Host
🇪🇸 cuscusero (FlexBacks, FlexChar, FlexAve, FlexCDNM, FlexTudy, ColdHosting SL)	2026-01-15 14:35:26 (4 months ago)	[CPD ESP-BCN02-FW11-394] Suspicious connection detected on port 22. DDoS detected	DDoS Attack Brute-Force SSH
🇬🇧 Joe-Mark	2026-01-14 07:17:06 (4 months ago)	TCP Port: 143 . src-port=43996 Found Blocklist.Net.ua - Reason on blocklist: DDoS attack on site ... show more TCP Port: 143 . src-port=43996 Found Blocklist.Net.ua - Reason on blocklist: DDoS attack on site muskulnamasa.com [ filter blocked ] (79) show less	Port Scan Hacking
🇯🇵 Kinsei Engineering Inc.	2026-01-04 20:42:44 (4 months ago)	Postfix,Possible SPAM, Postscreen, Received incorrect commands at a high frequency.	Email Spam Brute-Force
🇳🇱 wlt-blocker	2026-01-03 21:33:15 (5 months ago)	Attempts to login to mail server with wrong username and/or password	Brute-Force
🇺🇸 TPI-Abuse	2026-01-02 21:47:08 (5 months ago)	(mod_security) mod_security (id:210492) triggered by 103.189.63.149 (ipv4-63-189-103.blip.net.id): 1 ... show more (mod_security) mod_security (id:210492) triggered by 103.189.63.149 (ipv4-63-189-103.blip.net.id): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jan 02 16:47:02.781195 2026] [security2:error] [pid 24290:tid 24303] [client 103.189.63.149:44965] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "andeanbouquet.com"] [uri "/.env"] [unique_id "aVg81s-6usd_E1shRRkzaQAAAAo"] show less	Brute-Force Bad Web Bot Web App Attack
🇫🇷 MatStef132	2026-01-01 19:20:28 (5 months ago)	Malicious activity detected (3 incidents). IP has been blacklisted.	DDoS Attack Port Scan

Showing 16 to 30 of 97 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇩🇪 43.228.157.143

🇩🇪 178.63.130.140

🇺🇸 172.253.91.154

🇯🇵 180.24.76.246

🇨🇱 170.82.129.8

🇺🇸 162.243.71.23

🇺🇸 135.237.126.73

🇨🇳 118.145.237.236

🇭🇰 118.26.37.26

🇰🇪 102.210.149.105

🇧🇷 189.90.193.57

🇦🇷 181.47.9.103

🇸🇬 172.188.218.162

🇭🇰 139.198.113.29

🇧🇷 138.122.53.235

🇨🇳 125.34.171.202

🇺🇸 103.143.11.150

🇫🇷 51.68.226.87

🇳🇱 45.198.224.7

🇰🇷 211.253.37.225