JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 103.218.240.172

103.218.240.172 was found in our database!

This IP was reported 801 times. Confidence of Abuse is 100%: ?

100%

ISP	UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED
Usage Type	Content Delivery Network
ASN	AS135377
Domain Name	ucloud.cn
Country	🇭🇰 Hong Kong
City	Hong Kong

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 103.218.240.172

Whois 103.218.240.172

IP Abuse Reports for 103.218.240.172:

This IP address has been reported a total of 801 times from 229 distinct sources. 103.218.240.172 was first reported on April 25th 2024, and the most recent report was 13 minutes ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇺🇸 ras07	2026-06-13 08:00:10 (13 minutes ago)	Brute force SSH login attempts.	Brute-Force SSH
🇪🇸 librebit	2026-06-13 05:21:50 (2 hours ago)	Listed IP in blacklist by postfix/dnsblog	Spoofing
🇩🇪 anycast_ac	2026-06-13 03:34:57 (4 hours ago)	[mirai-detector honeypot] Inbound attack against our honeypot on tcp/8080 (http). Commands captured: ... show more [mirai-detector honeypot] Inbound attack against our honeypot on tcp/8080 (http). Commands captured: $ ÿ show less	DDoS Attack IoT Targeted Brute-Force
🇺🇸 donarev419	2026-06-13 02:50:09 (5 hours ago)	Port scan detected on port 8524 (connection without data transfer)	Port Scan
🇩🇪 NewGastroline	2026-06-12 16:16:13 (15 hours ago)	Malicious request blocked by CrowdSec on gastro-prod1.boreus.de	Bad Web Bot Web App Attack
🇭🇰 sandra361	2026-06-12 11:12:22 (21 hours ago)	Port scan detected: 16 attempts across 1 ports (8519). \| Evidence: GHOST_SCAN: IN=eth0 SRC=103.218.2 ... show more Port scan detected: 16 attempts across 1 ports (8519). \| Evidence: GHOST_SCAN: IN=eth0 SRC=103.218.240.172 LEN=60 TOS=0x14 PREC=0x00 TTL=49 ID=60035 DF PROTO=TCP SPT=52500 DPT=8519 WINDOW=1412 RES=0x00 SYN URGP=0 show less	Port Scan
🇵🇱 sefinek.net	2026-06-11 22:41:54 (1 day ago)	Honeypot hit: Unauthorized traffic (44 bytes of payload); 1194 [6] TCP Reported by: https://github.c ... show more Honeypot hit: Unauthorized traffic (44 bytes of payload); 1194 [6] TCP Reported by: https://github.com/sefinek/T-Pot-To-AbuseIPDB show less	Port Scan
🇩🇪 dispaisyenterprises	2026-06-11 22:15:49 (1 day ago)	Honeypot [fra-de-honeypot]: HTTP/1.1 request on 9080 GET / Accept: /; 9080 [6] TCP Reported by Di ... show more Honeypot [fra-de-honeypot]: HTTP/1.1 request on 9080 GET / Accept: /; 9080 [6] TCP Reported by DisPaisy Enterprises (dispaisy.systems) using: https://github.com/sefinek/T-Pot-To-AbuseIPDB show less	Hacking Bad Web Bot
🇫🇷 0xNath	2026-06-11 19:56:15 (1 day ago)	2026-06-11T21:56:13.761585+02:00 srv1.renaudna.fr dovecot[1615]: imap-login: Disconnected: Connectio ... show more 2026-06-11T21:56:13.761585+02:00 srv1.renaudna.fr dovecot[1615]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=103.218.240.172, lip=192.168.1.253, TLS, session=<hE6gwP9Tulxn2vCs> 2026-06-11T21:56:14.337731+02:00 srv1.renaudna.fr dovecot[1615]: imap-login: Disconnected: Connection closed: read(size=599) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=103.218.240.172, lip=192.168.1.253, TLS handshaking: read(size=599) failed: Connection reset by peer, session=<chmpwP9TMl5n2vCs> 2026-06-11T21:56:14.701183+02:00 srv1.renaudna.fr dovecot[1615]: imap-login: Disconnected: Connection closed: read(size=599) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=103.218.240.172, lip=192.168.1.253, TLS handshaking: read(size=599) failed: Connection reset by peer, session=<MaWuwP9Tkl5n2vCs> ... show less	Brute-Force
🇸🇦 azzuwayed	2026-06-11 11:11:26 (1 day ago)	2026-06-11 14:10:57.451 [746541] no MAIL in SMTP connection from [103.218.240.172]:35396 I=[10.0.0.4 ... show more 2026-06-11 14:10:57.451 [746541] no MAIL in SMTP connection from [103.218.240.172]:35396 I=[10.0.0.42]:587 D=10s 2026-06-11 14:11:08.965 [746544] no MAIL in SMTP connection from [103.218.240.172]:37040 I=[10.0.0.42]:587 D=10s 2026-06-11 14:11:21.513 [746545] no MAIL in SMTP connection from [103.218.240.172]:39266 I=[10.0.0.42]:587 D=10s 2026-06-11 14:11:22.122 [746546] no MAIL in SMTP connection from [103.218.240.172]:40754 I=[10.0.0.42]:587 D=0.361s 2026-06-11 14:11:25.598 [746547] SMTP protocol error in "AUTH NTLM TlRMTVNTUAABAAAAB4IIAAAAAAAAAAAAAAAAAAAAAAA=" H=(hello) [103.218.240.172]:40802 I=[10.0.0.42]:587 AUTH command used when not advertised show less	Email Spam
🇬🇧 sandra361	2026-06-11 10:26:04 (1 day ago)	Port scan detected: 12 attempts across 1 ports (8983). \| Evidence: GHOST_SCAN: IN=enp1s0f0 SRC=103.2 ... show more Port scan detected: 12 attempts across 1 ports (8983). \| Evidence: GHOST_SCAN: IN=enp1s0f0 SRC=103.218.240.172 LEN=60 TOS=0x00 PREC=0x00 TTL=44 ID=39444 DF PROTO=TCP SPT=20094 DPT=8983 WINDOW=1412 RES=0x00 SYN URGP=0 show less	Port Scan
🇺🇸 ShadowWhisperer	2026-06-11 09:59:41 (1 day ago)	SMB port scan / probe. SMB2 Negotiate	Port Scan Hacking
🇮🇹 kiokoman	2026-06-10 17:09:52 (2 days ago)	Jun 10 19:09:51 nanto postfix/submission/smtpd[9086]: improper command pipelining after CONNECT from ... show more Jun 10 19:09:51 nanto postfix/submission/smtpd[9086]: improper command pipelining after CONNECT from unknown[103.218.240.172]: \377\000\000\000\000\000\000\000\000\177\003\001NULL\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000 ... show less	Email Spam
🇧🇷 diego	2026-06-10 10:35:20 (2 days ago)	[probe-44-49] 2026-06-10 10:20:06, Client: 103.218.240.172, Protocol: 6, Unauthorized activity to HT ... show more [probe-44-49] 2026-06-10 10:20:06, Client: 103.218.240.172, Protocol: 6, Unauthorized activity to HTTP: GET / show less	Web App Attack
🇫🇷 GoodOldTOS	2026-06-10 04:53:36 (3 days ago)	Connection to MSSQL honeypot	Hacking

Showing 1 to 15 of 801 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇺🇸 172.191.157.64

🇨🇳 118.196.48.68

🇺🇬 102.218.89.110

🇺🇸 66.132.224.15

🇷🇴 2.57.122.238

🇰🇷 210.222.46.15

🇯🇵 210.156.0.132

🇭🇰 182.239.80.7

🇺🇸 162.216.149.26

🇯🇵 152.32.146.182

🇨🇳 118.253.182.187

🇺🇸 104.152.52.116

🇯🇴 86.108.22.234

🇸🇬 51.79.251.193

🇹🇼 35.194.146.148

🇧🇪 34.14.124.129

🇨🇳 27.22.65.219

🇺🇸 216.73.217.25

🇪🇸 196.196.150.5

🇱🇧 109.233.21.109