JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 103.216.221.111

103.216.221.111 was found in our database!

This IP was reported 27 times. Confidence of Abuse is 44%: ?

44%

ISP	Host Universal Pty Ltd
Usage Type	Data Center/Web Hosting/Transit
ASN	AS136557
Domain Name	hostuniversal.com.au
Country	🇸🇬 Singapore
City	Singapore

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 103.216.221.111

Whois 103.216.221.111

IP Abuse Reports for 103.216.221.111:

This IP address has been reported a total of 27 times from 16 distinct sources. 103.216.221.111 was first reported on December 15th 2025, and the most recent report was 1 day ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇨🇭 4server	2026-07-20 06:30:55 (1 day ago)	[MonJul2008:30:49.5368772026][security2:error][pid369208:tid369643][client103.216.221.111:0]ModSecur ... show more [MonJul2008:30:49.5368772026][security2:error][pid369208:tid369643][client103.216.221.111:0]ModSecurity:Accessdeniedwithcode403\(phase1\).Stringmatch\"/xmlrpc.php\"atREQUEST_URI.[file\"/etc/apache2/conf.d/modsec_custom_rules.conf\"][line\"368\"][id\"960024\"][msg\"XML-RPCdisabled\"][hostname\"piffarerio.ch\"][uri\"/xmlrpc.php\"][unique_id\"al3AmWWgVp5sjBoS92RJMgAAAVg\"] show less	Hacking Web App Attack
🇺🇸 TPI-Abuse	2026-07-19 23:53:53 (2 days ago)	(mod_security) mod_security (id:225170) triggered by 103.216.221.111 (-): 1 in the last 300 secs; Po ... show more (mod_security) mod_security (id:225170) triggered by 103.216.221.111 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Jul 19 19:53:49.478634 2026] [security2:error] [pid 14154:tid 14154] [client 103.216.221.111:28482] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)\|\|grexicon.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "grexicon.com"] [uri "/wp-json/wp/v2/users"] [unique_id "al1jjZtGL389bsU7ztuEBAAAAAE"] show less	Brute-Force Bad Web Bot Web App Attack
🇨🇦 1gz	2026-07-18 06:59:31 (3 days ago)	Triggered Cloudflare WAF (firewallCustom) from SG. Action taken: BLOCK Protocol: HTTP/2 (GET method) ... show more Triggered Cloudflare WAF (firewallCustom) from SG. Action taken: BLOCK Protocol: HTTP/2 (GET method) Endpoint: /english/neomalesorja-to-euractiv-we-believe-in-european-values-but-we-do-not-support-the-government-the-eu-should-not-see-rama-as-albanias-only-voice/916731/ UA: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 This report was generated by: https://github.com/sefinek/Cloudflare-WAF-To-AbuseIPDB show less	Bad Web Bot
🇫🇷 Tilellit.PRO	2026-07-17 05:39:10 (4 days ago)	WooCommerce YITH AJAX Filder product_cat filter flood attempt with taxonomies	DDoS Attack Bad Web Bot
🇺🇸 stechusa	2026-07-15 01:10:15 (1 week ago)	ELEVATED_THREAT \| 11 IPs targeting /category.html \| Facet request during elevated threat (facet_rati ... show more ELEVATED_THREAT \| 11 IPs targeting /category.html \| Facet request during elevated threat (facet_ratio=0.92, unique_ips=595) \| Recv-Q=1489 bytes on ESTABLISHED connection (threshold=1000) show less	Bad Web Bot DDoS Attack
🇺🇸 stechusa	2026-07-12 14:09:13 (1 week ago)	[Askari] \| Behavior: Slow-read attack, HTTP/1.1 over TLS, Concurrent page load during attack, Target ... show more [Askari] \| Behavior: Slow-read attack, HTTP/1.1 over TLS, Concurrent page load during attack, Targeting specific pages, URL template abuse show less	Bad Web Bot DDoS Attack
🇺🇸 stechusa	2026-07-12 14:09:13 (1 week ago)	ELEVATED_THREAT \| 639 IPs targeting /brand.html \| URL template shared by 217 IPs: /brand.html?bulb_s ... show more ELEVATED_THREAT \| 639 IPs targeting /brand.html \| URL template shared by 217 IPs: /brand.html?bulb_shape_type=&bulb_shape=&bulb_type=&mode=list&p= \| Facet request during elevated threat (facet_ratio=0.99, unique_ips=863) show less	Bad Web Bot DDoS Attack
🇺🇸 kosada.com	2026-07-06 18:14:01 (2 weeks ago)	Web bot: denial-of-service flood	DDoS Attack Bad Web Bot
🇺🇸 TPI-Abuse	2026-06-23 07:56:16 (4 weeks ago)	(mod_security) mod_security (id:225170) triggered by 103.216.221.111 (-): 1 in the last 300 secs; Po ... show more (mod_security) mod_security (id:225170) triggered by 103.216.221.111 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jun 23 03:56:10.006869 2026] [security2:error] [pid 16774:tid 16774] [client 103.216.221.111:10652] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)\|\|thingstodonude.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "thingstodonude.com"] [uri "/wp-json/wp/v2/users"] [unique_id "ajo8GiQEc2KiJFY8vSuGqQAAABA"] show less	Brute-Force Bad Web Bot Web App Attack
🇮🇩 hermawan	2026-06-06 08:44:51 (1 month ago)	1780735479.660229 103.216.221.111 103.166.156.58 64240_2-4-8-1-3_1460_8 2026-06-06 15:44:39 WIB ...	Email Spam Hacking
🇦🇺 MAGIC	2026-05-28 01:31:05 (1 month ago)	VM1 Bad user agents ignoring web crawling rules. Draing bandwidth	DDoS Attack Bad Web Bot
🇨🇭 ALPHANET	2026-05-08 11:10:05 (2 months ago)	Botnet or web spider not respecting robots.txt	DDoS Attack Exploited Host
🇦🇺 oncord	2026-05-06 03:34:00 (2 months ago)	Form spam	Web Spam
🇩🇪 filstal.org	2026-05-02 02:42:04 (2 months ago)	Bad web bot: Spoofed/obsolete UA (Mozilla/5.0 (compatible; MSIE 5.0; Windows CE; Trident/3.1)). Mass ... show more Bad web bot: Spoofed/obsolete UA (Mozilla/5.0 (compatible; MSIE 5.0; Windows CE; Trident/3.1)). Mass-scanning WordPress plugin. Coordinated large-scale bot attack. show less	Bad Web Bot Web App Attack
🇺🇸 oncord	2026-04-24 05:35:15 (2 months ago)	Form spam	Web Spam

Showing 1 to 15 of 27 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇰🇷 211.106.133.202

🇺🇦 194.156.249.154

🇬🇧 193.176.29.22

🇳🇱 192.253.248.59

🇨🇴 186.112.1.243

🇵🇱 176.53.159.197

🇺🇸 162.241.239.241

🇭🇰 152.32.171.213

🇭🇰 152.32.171.99

🇨🇳 124.239.169.52

🇵🇭 120.29.108.189

🇭🇰 118.193.36.205

🇭🇰 118.193.34.44

🇭🇰 118.193.33.216

🇷🇴 92.118.39.14

🇷🇺 87.117.32.22

🇯🇵 72.63.109.42

🇺🇸 69.12.80.254

🇺🇸 54.172.145.72

🇺🇸 48.223.209.110