This IP address has been reported a total of
8
times from
8 distinct
sources.
195.63.20.103 was first reported on
March 10th 2026 , and the most recent report was
1 day ago United States of America
with 2
reports;
Australia
with 1
report;
Ireland
with 1
report.
The most common categories in these recent reports were:
Web App Attack
5
times;
SSH
1
time;
Open Proxy
1
time;
Hacking
1
time;
Bad Web Bot
1
time;
Other
1
time.
Recent Reports
We have received reports of abusive activity from this IP address within the last week. It is
potentially still actively engaged in abusive activities.
Reporter
IoA Timestamp (UTC)
Comment
Categories
🇮🇪
AutosOnShow
2026-10-14 04:26:05
(1 day ago)
blocked for webapp attack | path requested: /.env | seen at 2026-10-14 04:25:06.111 |
Web App Attack
🇺🇸
cwytech
2026-10-13 23:36:21
(1 day ago)
Fleet-wide ban from the Ghostfleet 👻. Triggered by scenario: cwy/wordpress-login-lockdown-high.
Bad Web Bot
Web App Attack
🇺🇸
Rayulcifer
2026-10-13 17:39:01
(1 day ago)
195.63.20.103 - - [13/Oct/2026:12:39:00 -0500] "GET http://34.198.82.189/.env HTTP/1.1" 403 400 "-" ...
show more
195.63.20.103 - - [13/Oct/2026:12:39:00 -0500] "GET http://34.198.82.189/.env HTTP/1.1" 403 400 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36"
...
show less
Open Proxy
Port Scan
Hacking
Web App Attack
SSH
🇦🇺
Bay13
2026-10-09 18:33:42
(5 days ago)
CrowdSec:custom/http-sensitive-files
Web App Attack
🇮🇹
CoreTech srl
2026-08-24 14:09:43
(1 month ago)
cloudlinux2 fail2ban: 2026-08-24 16:05:01,585 fail2ban.filter [1464]: INFO [plesk-modsecu ...
show more
cloudlinux2 fail2ban: 2026-08-24 16:05:01,585 fail2ban.filter [1464]: INFO [plesk-modsecurity] Found 104.28.245.232 - 2026-08-24 16:05:01cloudlinux2 fail2ban: 2026-08-24 16:06:06,262 fail2ban.actions [1464]: NOTICE [plesk-wordpress] Unban 104.28.208.82cloudlinux2 fail2ban: 2026-08-24 16:06:25,381 fail2ban.filter [1464]: INFO [plesk-modsecurity] Found 104.28.245.232 - 2026-08-24 16:06:25cloudlinux2 fail2ban: 2026-08-24 16:06:35,704 fail2ban.filter [1464]: INFO [plesk-modsecurity] Found 104.28.245.232 - 2026-08-24 16:06:35cloudlinux2 fail2ban: 2026-08-24 16:06:36,170 fail2ban.actions [1464]: NOTICE [plesk-modsecurity] Ban 104.28.245.232cloudlinux2 fail2ban: 2026-08-24 16:06:36,177 fail2ban.filter [1464]: INFO [recidive] Found 104.28.245.232 - 2026-08-24 16:06:36cloudlinux2 fail2ban: 2026-08-24 16:07:21,567 fail2ban.actions [1464]: NOTICE [plesk-wordpress] Unban 104.28.240.82cloudlinux2 fail2ban: 2026-08-24 16:07:26,658 fail2ban.filter [
show less
Web App Attack
🇺🇸
xxkodedxx
2026-07-16 11:47:48
(2 months ago)
[Zorvexus edge-defense] GET .env / WordPress honeypot probe
Trigger: 1× honeypot-get in 10m window.
...
show more
[Zorvexus edge-defense] GET .env / WordPress honeypot probe
Trigger: 1× honeypot-get in 10m window.
Active: 11:46:48 UTC
Volume: 1 honeypot probe(s)
Bait taken: /.env
UA: "Mozilla/5.0 (Windows NT 10.0; Win64; x64)"
Auto-banned 30d. zorvexus-banner.
show less
Bad Web Bot
Web App Attack
🇬🇧
Oakley
2026-07-08 07:15:31
(3 months ago)
(confirmed_bot_sig) Confirmed bot
Hacking
🇺🇸
TPI-Abuse
2026-03-10 06:59:36
(7 months ago)
(mod_security) mod_security (id:210350) triggered by 195.63.20.103 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210350) triggered by 195.63.20.103 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Mar 10 02:59:31.768259 2026] [security2:error] [pid 20389:tid 20389] [client 195.63.20.103:13278] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||ultratecnologia.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "ultratecnologia.com"] [uri "/wp-login.php"] [unique_id "aa_BUyDn9E2AvMIP5i4ciwAAAAs"], referer: https://ultratecnologia.com/wp-login.php
show less
Brute-Force
Bad Web Bot
Web App Attack
Showing 1 to
8
of 8 reports
