JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

103.99.3.148

Neutral Activity

Abuse Confidence Score

0% Low Risk

382 reports

200 reporters · latest 6 months ago

ISP: VPSONLINE Ltd
Usage Type: Fixed Line ISP
ASN: AS135905
Domain Name: vietserver.vn
Country: 🇻🇳 Viet Nam
City: Hanoi, Hanoi

ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report Whois

No reports in the last 60 days

103.99.3.148 has been reported 382 times. The most recent report is from 6 months ago.

The full history is preserved below and remains searchable. A 0% score reflects the absence of recent activity, but this is not a guarantee that earlier reports were invalid. Abuse confidence score decays, naturally, over time, when the abusive activity stops.

Abuse Reports

Export reports CSV

Total reports

382 from 200 distinct reporters

First reported

March 20th 2021

Most recent report

6 months ago

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇫🇷 ar2000	2026-04-22 21:33:34 UTC · (6 months ago)	This IP was detected by CrowdSec triggering crowdsecurity/CVE-2017-9841	Web App Attack
🇨🇭 benii	2025-11-07 13:53:46 UTC · (1 year ago)	Fail2Ban detected activity recidive on web service	Hacking
🇨🇳 ThreatBook.io	2025-10-18 01:14:56 UTC · (1 year ago)	ThreatBook Intelligence: Zombie,Scanner more details on https://threatbook.io/ip/103.99.3.148 2025-10-17 02:30:50 /,{"body":"0x%5B%5D=androxgh0st","content_type":"application/x-www-form-urlencoded","header":{"Accept":["/"],"Accept-Encoding":["gzip, ... show more ThreatBook Intelligence: Zombie,Scanner more details on https://threatbook.io/ip/103.99.3.148 2025-10-17 02:30:50 /,{"body":"0x%5B%5D=androxgh0st","content_type":"application/x-www-form-urlencoded","header":{"Accept":["/"],"Accept-Encoding":["gzip, deflate"],"Connection":["keep-alive"],"Content-Length":["20"],"Content-Type":["application/x-www-form-urlencoded"],"User-Agent":["Mozilla/5.0 (Linux; U; Android 4.4.2; en-US; HM NOTE 1W Build/KOT49H) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 UCBrowser/11.0.5.850 U3/0.8.0 Mobile Safari/534.30"]},"host":"167.148.203.21","method":"POST","proto":"HTTP/1.1","remote_addr":"103.99.3.148:62874","status_code":200,"url":"/","user_agent":"Mozilla/5.0 (Linux; U; Android 4.4.2; en-US; HM NOTE 1W Build/KOT49H) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 UCBrowser/11.0.5.850 U3/0.8.0 Mobile Safari/534.30"} 2025-10-17 02:30:50 /.env show less	Web App Attack
🇷🇺 Reaper	2025-10-16 20:32:34 UTC · (1 year ago)	GET /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php	Web App Attack
🇩🇪 sdos.es	2025-10-16 20:08:34 UTC · (1 year ago)	"Restricted File Access Attempt - Matched Data: /.env found within REQUEST_FILENAME: /.env"	Web App Attack
🇧🇾 lns.bz	2025-10-16 16:59:03 UTC · (1 year ago)	Web app attack	Exploited Host Web App Attack
🇩🇪 Bedios GmbH	2025-10-16 16:31:04 UTC · (1 year ago)	Login credentials theft attempt	Hacking
🇫🇷 Pölkky	2025-10-16 11:03:01 UTC · (1 year ago)	Vulnerability probe blocked from [103.99.3.148]	Port Scan
🇬🇧 Don Felip	2025-10-16 09:04:57 UTC · (1 year ago)	Web Exploiter - Banned by Fail2Ban	Hacking Web App Attack
🇫🇷 HerrWolf	2025-10-16 08:15:02 UTC · (1 year ago)	CrowdSec Detection: crowdsecurity/CVE-2017-9841	Web App Attack
Anonymous	2025-10-16 07:21:08 UTC · (1 year ago)	Oct 16 09:21:01 mail2 Nextcloud[212472]: {"reqId":"aPCc3bsQrzE2iYj1HXxDJgAAAUc","level":1,"time":"2025-10-16T07:21:01+00:00","remoteAddr":"103.99.3.148","user":"--","app":"core","method":"GET","url":"/.env","message":"Trusted domain error. \"103.99.3 ... show more Oct 16 09:21:01 mail2 Nextcloud[212472]: {"reqId":"aPCc3bsQrzE2iYj1HXxDJgAAAUc","level":1,"time":"2025-10-16T07:21:01+00:00","remoteAddr":"103.99.3.148","user":"--","app":"core","method":"GET","url":"/.env","message":"Trusted domain error. \"103.99.3.148\" tried to access using \"178.254.3.7\" as host.","userAgent":"Mozilla/5.0 (Linux; U; Android 4.4.2; en-US; HM NOTE 1W Build/KOT49H) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 UCBrowser/11.0.5.850 U3/0.8.0 Mobile Safari/534.30","version":"31.0.9.1","data":{"app":"core"}} Oct 16 09:21:02 mail2 Nextcloud[212482]: {"reqId":"aPCc3rsQrzE2iYj1HXxDJwAAAUo","level":1,"time":"2025-10-16T07:21:02+00:00","remoteAddr":"103.99.3.148","user":"--","app":"core","method":"POST","url":"/","message":"Trusted domain error. \"103.99.3.148\" tried to access using \"178.254.3.7\" as host.","userAgent":"Mozilla/5.0 (Linux; U; Android 4.4.2; en-US; HM NOTE 1W Build/KOT49H) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 UCBrowser/11.0.5.850 U3/0.8.0 ... show less	Brute-Force Web App Attack
🇺🇸 gu-alvareza	2025-10-16 07:05:04 UTC · (1 year ago)	AndroxGh0st.Malware	Hacking Exploited Host
🇺🇸 octageeks.com	2025-10-16 04:07:08 UTC · (1 year ago)	Wordpress malicious attack:[octablocked]	Web App Attack
🇨🇳 ThreatBook.io	2025-10-16 00:10:54 UTC · (1 year ago)	ThreatBook Intelligence: Zombie,Scanner more details on https://threatbook.io/ip/103.99.3.148 2025-10-15 03:23:56 /.env 2025-10-15 03:23:57 /,{"body":"0x%5B%5D=androxgh0st","content_type":"application/x-www-form-urlencoded","header":{"Accept":["/"] ... show more ThreatBook Intelligence: Zombie,Scanner more details on https://threatbook.io/ip/103.99.3.148 2025-10-15 03:23:56 /.env 2025-10-15 03:23:57 /,{"body":"0x%5B%5D=androxgh0st","content_type":"application/x-www-form-urlencoded","header":{"Accept":["/"],"Accept-Encoding":["gzip, deflate"],"Connection":["keep-alive"],"Content-Length":["20"],"Content-Type":["application/x-www-form-urlencoded"],"User-Agent":["Mozilla/5.0 (Linux; U; Android 4.4.2; en-US; HM NOTE 1W Build/KOT49H) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 UCBrowser/11.0.5.850 U3/0.8.0 Mobile Safari/534.30"]},"host":"150.136.79.203","method":"POST","proto":"HTTP/1.1","remote_addr":"103.99.3.148:59689","status_code":200,"url":"/","user_agent":"Mozilla/5.0 (Linux; U; Android 4.4.2; en-US; HM NOTE 1W Build/KOT49H) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 UCBrowser/11.0.5.850 U3/0.8.0 Mobile Safari/534.30"} show less	Web App Attack
🇺🇸 Al Coholic	2025-10-15 18:40:38 UTC · (1 year ago)	Detected By Fail2ban	Hacking Bad Web Bot Web App Attack

Showing 1 to 15 of 382 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown

Recently Reported IPs:

🇸🇽 190.185.83.88

🇩🇪 8.211.46.74

🇺🇸 209.6.226.104

🇳🇱 200.138.46.82

🇫🇮 193.233.199.84

🇧🇷 191.53.213.100

🇵🇱 151.115.97.101

🇳🇱 86.38.187.19

🇧🇬 79.124.58.22

🇧🇷 45.183.216.128

🇳🇱 45.148.10.152

🇧🇩 37.111.221.94

🇯🇵 8.216.13.169

🇺🇸 199.165.159.210

🇦🇹 152.53.32.182

🇳🇱 45.148.10.141

🇫🇷 45.80.27.169

🇦🇷 190.4.118.114

🇳🇱 176.65.148.207

🇸🇳 154.125.228.145