JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 103.69.85.12

103.69.85.12 was found in our database!

This IP was reported 33 times. Confidence of Abuse is 52%: ?

52%

ISP	ANZIX Joint Stock Company
Usage Type	Commercial
ASN	AS150884
Domain Name	vnnic.vn
Country	🇻🇳 Viet Nam
City	Ho Chi Minh City, Ho Chi Minh City (HCMC)

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 103.69.85.12

Whois 103.69.85.12

IP Abuse Reports for 103.69.85.12:

This IP address has been reported a total of 33 times from 26 distinct sources. 103.69.85.12 was first reported on May 11th 2026, and the most recent report was 2 weeks ago.

Old Reports: The most recent abuse report for this IP address is from 2 weeks ago . It is possible that this IP is no longer involved in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇩🇪 ghostwarriors	2026-05-31 09:50:11 (2 weeks ago)	Webpage scraping	Brute-Force Bad Web Bot Web App Attack
🇩🇪 ghostwarriors	2026-05-29 01:20:20 (2 weeks ago)	Webpage scraping	Brute-Force Bad Web Bot Web App Attack
🇩🇪 ghostwarriors	2026-05-22 17:20:36 (3 weeks ago)	Webpage scraping	Brute-Force Bad Web Bot Web App Attack
🇩🇪 ghostwarriors	2026-05-15 08:50:31 (1 month ago)	Webpage scraping	Brute-Force Bad Web Bot Web App Attack
🇺🇸 LSPCCU	2026-05-13 21:25:19 (1 month ago)	TSEC Honeypot Network report. Threat score: 100/100. Categories: Port Scan, Hacking, Brute-Force, We ... show more TSEC Honeypot Network report. Threat score: 100/100. Categories: Port Scan, Hacking, Brute-Force, Web App Attack, SSH, IoT Targeted. Honeypot: cowrie, ssh-telnet. Context: 103. show less	Port Scan Hacking Brute-Force Web App Attack SSH IoT Targeted
Anonymous	2026-05-13 20:52:47 (1 month ago)	Unauthorized connection attempt on Port 23	Port Scan Hacking Exploited Host
🇨🇳 ThreatBook.io	2026-05-13 00:24:58 (1 month ago)	ThreatBook Intelligence: iot_device,Dynamic IP more details on https://threatbook.io/ip/103.69.85.12	Brute-Force
🇳🇱 big-cloud.nl	2026-05-12 23:35:14 (1 month ago)	Unauthorized SSH connection attempt	SSH
🇺🇸 TPI-Abuse	2026-05-12 23:21:54 (1 month ago)	(mod_security) mod_security (id:218420) triggered by 103.69.85.12 (-): 1 in the last 300 secs; Ports ... show more (mod_security) mod_security (id:218420) triggered by 103.69.85.12 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue May 12 19:21:47.771348 2026] [security2:error] [pid 4930:tid 4930] [client 103.69.85.12:56586] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i)php://(std(in\|out\|err)\|(in\|out)put\|fd\|memory\|temp\|filter)" at ARGS_NAMES:\\xadd allow_url_include=1 \\xadd auto_prepend_file=php://input. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/21_PHP_PHPGen.conf"] [line "22"] [id "218420"] [rev "2"] [msg "COMODO WAF: PHP Injection Attack: I/O Stream Found\|\|192.64.150.28:80\|F\|2"] [data "Matched Data: php://input found within ARGS_NAMES:\\x5cxadd allow_url_include=1 \\x5cxadd auto_prepend_file=php://input: \\xadd allow_url_include=1 \\xadd auto_prepend_file=php://input"] [severity "CRITICAL"] [tag "CWAF"] [tag "PHPGen"] [hostname "192.64.150.28"] [uri "/hello.world"] [unique_id "agO2C77c84WAevFroU6LSgAAAA0"] show less	Brute-Force Bad Web Bot Web App Attack
🇦🇺 GE	2026-05-12 22:29:57 (1 month ago)	2026-05-13T09:29:04.027984+11:00 smtp.geddy.au sshd-session[909131]: Failed password for invalid use ... show more 2026-05-13T09:29:04.027984+11:00 smtp.geddy.au sshd-session[909131]: Failed password for invalid user admin from 103.69.85.12 port 47816 ssh2 2026-05-13T09:29:54.918548+11:00 smtp.geddy.au sshd-session[909133]: Invalid user orangepi from 103.69.85.12 port 60518 2026-05-13T09:29:54.921014+11:00 smtp.geddy.au sshd-session[909133]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.69.85.12 2026-05-13T09:29:56.490234+11:00 smtp.geddy.au sshd-session[909133]: Failed password for invalid user orangepi from 103.69.85.12 port 60518 ssh2 ... show less	SSH
🇩🇪 piticu iuli	2026-05-12 20:28:13 (1 month ago)	(mod_security) mod_security triggered on hostname [redacted] 103.69.85.12 (VN/Vietnam/-)	SQL Injection
🇺🇸 bigscoots.com	2026-05-12 19:37:20 (1 month ago)	(sshd) Failed SSH login from 103.69.85.12 (VN/Vietnam/-): 5 in the last 3600 secs; Ports: ; Directi ... show more (sshd) Failed SSH login from 103.69.85.12 (VN/Vietnam/-): 5 in the last 3600 secs; Ports: ; Direction: 1; Trigger: LF_SSHD; Logs: May 12 14:35:38 14176 sshd[17882]: Invalid user admin from 103.69.85.12 port 43100 May 12 14:35:40 14176 sshd[17882]: Failed password for invalid user admin from 103.69.85.12 port 43100 ssh2 May 12 14:36:25 14176 sshd[17959]: Invalid user orangepi from 103.69.85.12 port 48150 May 12 14:36:27 14176 sshd[17959]: Failed password for invalid user orangepi from 103.69.85.12 port 48150 ssh2 May 12 14:37:10 14176 sshd[18031]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.69.85.12 user=root show less	Brute-Force SSH
🇺🇸 MPL	2026-05-12 19:13:51 (1 month ago)	tcp/2222 (2 or more attempts)	Port Scan
🇩🇪 gcl046	2026-05-12 19:11:21 (1 month ago)	2026-05-12T21:10:00.627977+02:00 zg0iiuob sshd-session[167013]: Invalid user admin from 103.69.85.12 ... show more 2026-05-12T21:10:00.627977+02:00 zg0iiuob sshd-session[167013]: Invalid user admin from 103.69.85.12 port 43716 2026-05-12T21:10:01.232687+02:00 zg0iiuob sshd-session[167013]: Connection closed by invalid user admin 103.69.85.12 port 43716 [preauth] 2026-05-12T21:10:41.954949+02:00 zg0iiuob sshd-session[167019]: Invalid user orangepi from 103.69.85.12 port 40374 2026-05-12T21:10:42.330316+02:00 zg0iiuob sshd-session[167019]: Connection closed by invalid user orangepi 103.69.85.12 port 40374 [preauth] 2026-05-12T21:11:20.523541+02:00 zg0iiuob sshd-session[167029]: Connection closed by authenticating user root 103.69.85.12 port 58738 [preauth] ... show less	Brute-Force SSH
🇷🇺 6o6ep	2026-05-12 19:06:15 (1 month ago)	connection via IP or to a non-existent subdomain: /bin/sh trap	Port Scan Hacking Web App Attack

Showing 1 to 15 of 33 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇺🇸 20.169.49.86

🇸🇬 194.164.107.6

🇮🇩 118.99.114.224

🇮🇩 110.35.80.116

🇪🇸 93.93.115.224

🇫🇷 92.205.225.165

🇩🇪 89.36.76.140

🇩🇪 79.220.98.22

🇺🇸 65.49.1.113

🇧🇪 35.195.174.116

🇺🇸 2a00:1450:4864:20::632

🇺🇸 199.245.176.134

🇰🇷 115.178.75.243

🇰🇷 112.184.50.152

🇳🇱 45.148.10.147

🇺🇸 107.150.98.168

🇹🇭 202.29.224.230

🇧🇪 130.211.60.154

🇰🇷 121.132.27.238

🇹🇯 109.75.55.168