JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 103.225.138.2

103.225.138.2 was found in our database!

This IP was reported 59 times. Confidence of Abuse is 22%: ?

22%

ISP	DCTV Cable Network
Usage Type	Fixed Line ISP
ASN	AS133334
Hostname(s)	static-nat.region5.sorsogon-2-138-225-103.dctv.com.ph
Domain Name	dctv.com.ph
Country	🇵🇭 Philippines
City	Iraya, Bicol Region

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 103.225.138.2

Whois 103.225.138.2

IP Abuse Reports for 103.225.138.2:

This IP address has been reported a total of 59 times from 22 distinct sources. 103.225.138.2 was first reported on January 16th 2024, and the most recent report was 1 day ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇮🇩 hermawan	2026-06-26 06:42:35 (1 day ago)	Captured JA4H: ge20n_0755824e4aff \| Log: 103.225.138.2 - - [26/Jun/2026:13:38:55 +0700] "GET /index. ... show more Captured JA4H: ge20n_0755824e4aff \| Log: 103.225.138.2 - - [26/Jun/2026:13:38:55 +0700] "GET /index.php/profil/meteorologi/list-of-all-tags/buku HTTP/2.0" 200 182814 "-" "Mozilla/5.0 (Linux; Android 6.0.1; SM-J700F) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Mobile Safari/537.36" ge20n_sec-ch-ua,sec-ch-ua-mobile,sec-ch-ua-platform,upgrade-insecure-requests,user-agent,accept,sec-fetch-site,sec-fetch-mode,sec-fetch-user,sec-fetch-dest,accept-encoding,accept-language,save-data,host... ... show less	Email Spam Hacking
🇨🇭 backslash	2026-06-11 00:06:00 (2 weeks ago)	block ruleset bad bot: wordpress scans 82C095539D4FDAF84E2E2FD6B6FC0664645851A8	Bad Web Bot
🇮🇩 hermawan	2026-06-02 18:26:40 (3 weeks ago)	[Wed Jun 03 01:26:36.112200 2026] [security2:error] [pid 128789:tid 139947648128704] [client 103.225 ... show more [Wed Jun 03 01:26:36.112200 2026] [security2:error] [pid 128789:tid 139947648128704] [client 103.225.138.2:24769] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "www.bmkg.go.id" at REQUEST_HEADERS:Referer. [file "/etc/modsecurity/coreruleset-4.26.0/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "582"] [id "440068"] [msg "BAD Referer"] [data "Matched Data: www.bmkg.go.id found within REQUEST_HEADERS:Referer: https://www.bmkg.go.id/ request_line = GET /index.php/profil/meteorologi/list-all-categories HTTP/2.0"] [severity "NOTICE"] [hostname "staklim-jatim.bmkg.go.id"] [uri "/index.php/profil/meteorologi/list-all-categories"] [unique_id "ah8gXH2l4FlYSyXeO7aGOAABigE"], referer https://www.bmkg.go.id/ [staklim-jatim.bmkg.go.id] [staklim-jatim.bmkg.go.id] top=[128807] [A4h+c0nSaCQ] [ah8gXH2l4FlYSyXeO7aGOAABigE] keep_alive=[1] [2026-06-03 01:26:36.112204] [R:ah8gXH2l4FlYSyXeO7aGOAABigE] UA:'Mozilla/5.0 (Linux; Android 16; Pixel 8 Build/BP2A.250805.005) AppleWebKit/537 ... show less	Email Spam Hacking
🇩🇪 SMARTNET	2026-05-27 06:03:53 (1 month ago)	Aisuru(Mirai variant) DDoS \| Incident ID: f33ea243-b344-42fe-b994-8adedb9f85ca	DDoS Attack
Anonymous	2026-05-03 07:17:37 (1 month ago)	Unauthorized connection attempt on Port 2323	Port Scan Hacking Exploited Host
🇦🇺 MAGIC	2026-04-07 00:06:19 (2 months ago)	VM1 Bad user agents ignoring web crawling rules. Draing bandwidth	DDoS Attack Bad Web Bot
🇺🇸 quilla	2026-04-03 03:20:35 (2 months ago)	Botnet infected device observed in honeypot (Vector: TCP)	DDoS Attack
🇩🇪 LRob.fr	2026-03-13 05:45:11 (3 months ago)	Repeated requests on blocked xmlrpc.php, blocked by fail2ban in custom-503-xmlrpc jail	Bad Web Bot Web App Attack
🇺🇸 MPL	2026-01-10 01:05:54 (5 months ago)	tcp/23 (2 or more attempts)	Port Scan
🇺🇸 MPL	2026-01-08 06:46:34 (5 months ago)	tcp/23 (2 or more attempts)	Port Scan
🇺🇸 Psycho Solutions LLC	2025-11-04 01:55:33 (7 months ago)	Detected Wordpress Scanning. - Request Method: GET - Target: {PC} wp-login.php - User Agent: N ... show more Detected Wordpress Scanning. - Request Method: GET - Target: {PC} wp-login.php - User Agent: N/A - Timestamp: 11/4/2025 1:55 am (UTC-6) show less	Web Spam Hacking Bad Web Bot Web App Attack
Anonymous	2025-10-12 10:42:39 (8 months ago)	Oct 12 12:42:21 shubashi sshd[394769]: Failed password for [redacted] from 103.225.138.2 port 16247 ... show more Oct 12 12:42:21 shubashi sshd[394769]: Failed password for [redacted] from 103.225.138.2 port 16247 ssh2 Oct 12 12:42:23 shubashi sshd[394781]: Invalid user [redacted] from 103.225.138.2 port 44239 Oct 12 12:42:23 shubashi sshd[394781]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.225.138.2 Oct 12 12:42:26 shubashi sshd[394781]: Failed password for [redacted] from 103.225.138.2 port 44239 ssh2 Oct 12 12:42:38 shubashi sshd[394943]: Invalid user [redacted] from 103.225.138.2 port 26647 ... show less	Brute-Force SSH
🇮🇹 alph44	2025-10-11 09:00:17 (8 months ago)	SSH brute force attack detected: 5 failed attempts	Brute-Force
🇺🇸 bigscoots.com	2025-09-30 08:32:46 (8 months ago)	(smtpauth) Failed SMTP AUTH login from 103.225.138.2 (PH/Philippines/static-nat.region5.sorsogon-2-1 ... show more (smtpauth) Failed SMTP AUTH login from 103.225.138.2 (PH/Philippines/static-nat.region5.sorsogon-2-138-225-103.dctv.com.ph): 5 in the last 3600 secs; Ports: 25,465,587; Direction: 0; Trigger: LF_SMTPAUTH; Logs: 2025-09-30 04:30:50 dovecot_plain authenticator failed for (isha) [103.225.138.2]:45785: 535 Incorrect authentication data (set_id=darrylwap) 2025-09-30 04:31:01 SMTP call from [103.225.138.2]:1148 dropped: too many syntax or protocol errors (last command was "?\034?\032?\027?\031?\034?\033?\030?\032?\026?\016?\r?\v?\f? ?", NULL) 2025-09-30 04:31:02 dovecot_plain authenticator failed for (isha) [103.225.138.2]:22231: 535 Incorrect authentication data 2025-09-30 04:32:34 dovecot_plain authenticator failed for (isha) [103.225.138.2]:39532: 535 Incorrect authentication data ([email protected]) 2025-09-30 04:32:42 dovecot_plain authenticator failed for (isha) [103.225.138.2]:29070: 535 Incorrect authentication data (set_id=darrylwap) show less	Brute-Force SSH
🇮🇩 BPS-StatisticsIndonesia	2025-09-30 02:48:49 (8 months ago)	WP Login Scan Activities	Web App Attack

Showing 1 to 15 of 59 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇬🇧 193.163.125.233

🇫🇷 185.177.72.49

🇭🇰 154.212.239.217

🇺🇸 147.185.132.167

🇳🇱 104.165.171.182

🇧🇬 79.124.58.218

🇮🇳 61.247.230.105

🇺🇸 47.77.217.16

🇳🇱 45.148.10.157

🇧🇷 45.140.193.156

🇸🇬 43.134.130.2

🇭🇰 8.218.59.157

🇨🇭 185.191.239.92

🇳🇱 176.65.148.88

🇿🇦 105.245.98.25

🇺🇸 44.203.158.110

🇺🇸 209.50.173.166

🇬🇧 193.163.201.14

🇳🇱 185.223.235.26

🇳🇱 185.89.249.3