This IP address has been reported a total of
115
times from
84 distinct
sources.
103.99.38.128 was first reported on
, and the most recent report was
.
Recent Reports:
We have received reports of abusive activity from this IP address within the last week. It is
potentially still actively engaged in abusive activities.
This IP address carried out 107 port scanning attempts on 07-07-2026. For more information or to rep ...
show moreThis IP address carried out 107 port scanning attempts on 07-07-2026. For more information or to report interesting / incorrect findings, give me a shoutout @parthmaniar on Twitter.
show less
This IP address carried out 22 SSH credential attack (attempts) on 07-07-2026. For more information ...
show moreThis IP address carried out 22 SSH credential attack (attempts) on 07-07-2026. For more information or to report interesting / incorrect findings, give me a shoutout @parthmaniar on Twitter.
show less
2026-07-08T08:34:25.927696cowgrassland sshd[212190]: Disconnected from authenticating user root 103. ...
show more2026-07-08T08:34:25.927696cowgrassland sshd[212190]: Disconnected from authenticating user root 103.99.38.128 port 54008 [preauth]
2026-07-08T08:45:19.312819cowgrassland sshd[222441]: Disconnected from authenticating user root 103.99.38.128 port 33700 [preauth]
2026-07-08T08:48:26.141319cowgrassland sshd[225352]: Disconnected from authenticating user root 103.99.38.128 port 34220 [preauth]
2026-07-08T08:51:28.744123cowgrassland sshd[229406]: Disconnected from authenticating user root 103.99.38.128 port 58212 [preauth]
show less
Jul 8 10:37:50 mail6 sshd-session[410825]: Failed password for invalid user root from 103.99.38.128 ...
show moreJul 8 10:37:50 mail6 sshd-session[410825]: Failed password for invalid user root from 103.99.38.128 port 45972 ssh2
Jul 8 10:45:57 mail6 sshd-session[415734]: User root from 103.99.38.128 not allowed because not listed in AllowUsers
Jul 8 10:45:57 mail6 sshd-session[415734]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.99.38.128 user=root
Jul 8 10:45:59 mail6 sshd-session[415734]: Failed password for invalid user root from 103.99.38.128 port 41554 ssh2
Jul 8 10:49:03 mail6 sshd-session[417439]: User root from 103.99.38.128 not allowed because not listed in AllowUsers
...
show less
2026-07-08T10:43:00.006247+02:00 r2d2 sshd-session[217093]: error: maximum authentication attempts e ...
show more2026-07-08T10:43:00.006247+02:00 r2d2 sshd-session[217093]: error: maximum authentication attempts exceeded for root from 103.99.38.128 port 49782 ssh2 [preauth]
...
show less
2026-07-08T15:38:15.952242+08:00 nekoaru-shanghai-1 sshd-session[702006]: Connection from 103.99.38. ...
show more2026-07-08T15:38:15.952242+08:00 nekoaru-shanghai-1 sshd-session[702006]: Connection from 103.99.38.128 port 56306 on 192.168.12.24 port 41022 rdomain ""
2026-07-08T15:38:17.042791+08:00 nekoaru-shanghai-1 sshd-session[702006]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.99.38.128 user=root
2026-07-08T15:38:18.674543+08:00 nekoaru-shanghai-1 sshd-session[702006]: Failed password for root from 103.99.38.128 port 56306 ssh2
...
show less
2026-07-08T09:34:24.136013+02:00 canterlot.jotoma.de sshd[69298]: Disconnected from authenticating u ...
show more2026-07-08T09:34:24.136013+02:00 canterlot.jotoma.de sshd[69298]: Disconnected from authenticating user root 103.99.38.128 port 52642 [preauth]
2026-07-08T09:37:35.296447+02:00 canterlot.jotoma.de sshd[72259]: Invalid user testmail from 103.99.38.128 port 60346
2026-07-08T09:37:35.455943+02:00 canterlot.jotoma.de sshd[72259]: Disconnected from invalid user testmail 103.99.38.128 port 60346 [preauth]
...
show less
2026-07-08T08:58:47.728278+02:00 gaia sshd[393643]: Failed password for invalid user guest from 103. ...
show more2026-07-08T08:58:47.728278+02:00 gaia sshd[393643]: Failed password for invalid user guest from 103.99.38.128 port 37586 ssh2
2026-07-08T09:01:43.085445+02:00 gaia sshd[395213]: Connection from 103.99.38.128 port 53716 on 23.88.28.109 port 22 rdomain ""
2026-07-08T09:01:44.416043+02:00 gaia sshd[395213]: Invalid user admin from 103.99.38.128 port 53716
...
show less
2026-07-08T08:29:18.439991+02:00 gaia sshd[381740]: Failed password for invalid user user from 103.9 ...
show more2026-07-08T08:29:18.439991+02:00 gaia sshd[381740]: Failed password for invalid user user from 103.99.38.128 port 41698 ssh2
2026-07-08T08:32:18.079205+02:00 gaia sshd[382979]: Connection from 103.99.38.128 port 48938 on 23.88.28.109 port 22 rdomain ""
2026-07-08T08:32:18.894978+02:00 gaia sshd[382979]: Invalid user test from 103.99.38.128 port 48938
...
show less
2026-07-08T08:08:07.207802+02:00 gaia sshd[373523]: Failed password for invalid user ubuntu from 103 ...
show more2026-07-08T08:08:07.207802+02:00 gaia sshd[373523]: Failed password for invalid user ubuntu from 103.99.38.128 port 60478 ssh2
2026-07-08T08:16:42.411296+02:00 gaia sshd[376872]: Connection from 103.99.38.128 port 48644 on 23.88.28.109 port 22 rdomain ""
2026-07-08T08:16:46.503846+02:00 gaia sshd[376872]: Invalid user debian from 103.99.38.128 port 48644
...
show less
Brute-Force
SSH
Showing 1 to
15
of 115 reports
Think this IP has been falsely reported? You may request to have the associated
reports reviewed and removed.
Request Takedown 🚩