JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 103.59.160.186

103.59.160.186 was found in our database!

This IP was reported 22 times. Confidence of Abuse is 96%: ?

96%

ISP	PT Gunung Sedayu Sentosa
Usage Type	Data Center/Web Hosting/Transit
ASN	AS150493
Hostname(s)	ip-103-59-160-186.indovm.com
Domain Name	gss.biz.id
Country	🇮🇩 Indonesia
City	Jakarta, Jakarta

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 103.59.160.186

Whois 103.59.160.186

IP Abuse Reports for 103.59.160.186:

This IP address has been reported a total of 22 times from 20 distinct sources. 103.59.160.186 was first reported on November 8th 2025, and the most recent report was 7 hours ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇬🇧 openstrike.co.uk	2026-07-31 05:13:35 (7 hours ago)	10 attacks on PHP URLs: POST /index.php?option=com_sppagebuilder&task=asset.uploadCustomIcon HTTP/1. ... show more 10 attacks on PHP URLs: POST /index.php?option=com_sppagebuilder&task=asset.uploadCustomIcon HTTP/1.1 show less	Web App Attack
🇺🇸 TPI-Abuse	2026-07-30 19:46:52 (17 hours ago)	(mod_security) mod_security (id:210730) triggered by 103.59.160.186 (ip-103-59-160-186.indovm.com): ... show more (mod_security) mod_security (id:210730) triggered by 103.59.160.186 (ip-103-59-160-186.indovm.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jul 30 15:46:44.588275 2026] [security2:error] [pid 27219:tid 27219] [client 103.59.160.186:64493] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy\|\|1st-advantage-arkansas-real-estate-school.com\|F\|2"] [data ".com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "1st-advantage-arkansas-real-estate-school.com"] [uri "/home/cturedp1/1st-advantage-arkansas-real-estate-school.com"] [unique_id "amuqJPhhclluxAloBQd9NgAAAA8"] show less	Brute-Force Bad Web Bot Web App Attack
Anonymous	2026-07-30 16:00:49 (21 hours ago)	Scanning/Probing activity detected.	Bad Web Bot Web App Attack
🇬🇧 consul.to	2026-07-30 12:47:20 (1 day ago)	Web attack/malicious scanning detected	Web App Attack
🇺🇸 TPI-Abuse	2026-07-29 15:42:43 (1 day ago)	(mod_security) mod_security (id:210730) triggered by 103.59.160.186 (ip-103-59-160-186.indovm.com): ... show more (mod_security) mod_security (id:210730) triggered by 103.59.160.186 (ip-103-59-160-186.indovm.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jul 29 11:42:36.689674 2026] [security2:error] [pid 771011:tid 771011] [client 103.59.160.186:53225] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy\|\|destintoday.com\|F\|2"] [data ".com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "destintoday.com"] [uri "/home/tancedi1/destintoday.com"] [unique_id "amofbIWmN-Me27c4HhIN6wAAAAU"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 deskpass.com	2026-07-29 13:33:40 (1 day ago)	POST /index.php	Web App Attack
🇵🇱 mscode.pl	2026-07-29 06:13:40 (2 days ago)	Triggered Cloudflare WAF (firewallCustom) from ID. Action taken: BLOCK ASN: 150493 (PT Gunung Sedayu ... show more Triggered Cloudflare WAF (firewallCustom) from ID. Action taken: BLOCK ASN: 150493 (PT Gunung Sedayu Sentosa) Protocol: HTTP/1.1 (POST method) Zone: cp.mscode.pl Endpoint: /index.php UA: Mozilla/5.0 (X11; Linux x86_64) sppb-rce-poc show less	Bad Web Bot
Anonymous	2026-07-29 05:04:56 (2 days ago)	Attempt to scan vulnerabilities	Hacking
🇫🇷 rellik	2026-07-28 12:00:00 (3 days ago)	Scanning Critical File	Hacking Web App Attack
🇸🇪 SkyDancer	2026-07-27 20:31:32 (3 days ago)	Multiple intrusion attempts via http/https on known vulnerable url offsets. Attack automatically blo ... show more Multiple intrusion attempts via http/https on known vulnerable url offsets. Attack automatically blocked by SkyDancer Ai(web-X). show less	Hacking Brute-Force
🇱🇻 garmtech.com	2026-07-27 14:29:38 (3 days ago)	IM360 WAF: Unauthenticated file upload / RCE in Joomla SP Page Builder asset.uploadCustomIcon (CVE-2 ... show more IM360 WAF: Unauthenticated file upload / RCE in Joomla SP Page Builder asset.uploadCustomIcon (CVE-2026-48908) MV:/index.php show less	Hacking
🇬🇧 consul.to	2026-07-27 12:13:21 (4 days ago)	Web attack/malicious scanning detected	Web App Attack
🇬🇧 Interceptor_HQ	2026-07-27 11:26:43 (4 days ago)	request_uri: /index.php?option=com_sppagebuilder&task=asset.uploadCustomIcon -- automatic report ... show more request_uri: /index.php?option=com_sppagebuilder&task=asset.uploadCustomIcon -- automatic report -- show less	Brute-Force Hacking
🇺🇸 jcbriar	2026-07-27 06:50:14 (4 days ago)	Searching for vulnerable scripts	Hacking Web App Attack
🇫🇷 dynamix	2026-07-26 22:06:14 (4 days ago)	Multiple WAF Violations	Web App Attack

Showing 1 to 15 of 22 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇳🇱 192.142.28.77

🇫🇮 147.185.133.254

🇨🇳 1.204.206.182

🇯🇴 176.29.122.17

🇨🇦 162.219.178.250

🇺🇸 162.216.149.254

🇺🇦 176.109.10.49

🇮🇳 157.48.112.127

🇩🇴 138.255.250.32

🇹🇼 110.25.109.58

🇧🇩 103.129.236.242

🇷🇴 92.118.39.210

🇷🇴 80.94.92.206

🇺🇸 74.249.177.184

🇩🇪 213.209.159.227

🇰🇷 211.106.137.135

🇨🇴 190.99.188.150

🇧🇷 179.209.140.137

🇨🇳 118.145.246.44

🇻🇳 116.110.9.128