JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 115.178.128.154

115.178.128.154 was found in our database!

This IP was reported 10 times. Confidence of Abuse is 29%: ?

29%

ISP	PT. Core Mediatech (D-NET)
Usage Type	Data Center/Web Hosting/Transit
ASN	AS9794
Hostname(s)	gateway.pcpexpress.co.id
Domain Name	dnet.net.id
Country	🇮🇩 Indonesia
City	Jakarta, Jakarta

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 115.178.128.154

Whois 115.178.128.154

IP Abuse Reports for 115.178.128.154:

This IP address has been reported a total of 10 times from 4 distinct sources. 115.178.128.154 was first reported on June 12th 2026, and the most recent report was 1 day ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇺🇸 TPI-Abuse	2026-06-13 11:23:48 (1 day ago)	(mod_security) mod_security (id:210492) triggered by 115.178.128.154 (gateway.pcpexpress.co.id): 1 i ... show more (mod_security) mod_security (id:210492) triggered by 115.178.128.154 (gateway.pcpexpress.co.id): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Jun 13 07:23:43.255618 2026] [security2:error] [pid 16544:tid 16544] [client 115.178.128.154:64046] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "mail.sipa.com.hk"] [uri "/.env"] [unique_id "ai09v2yEYvMLpt8spLXP7QAAAC8"] show less	Brute-Force Bad Web Bot Web App Attack
🇩🇪 kommunos	2026-06-13 05:43:53 (2 days ago)	/.env	Web App Attack
🇺🇸 jfz-abuse	2026-06-13 00:30:56 (2 days ago)	fail2ban: apache-filepath-recon ...	Web App Attack
🇺🇸 TPI-Abuse	2026-06-13 00:22:03 (2 days ago)	(mod_security) mod_security (id:210492) triggered by 115.178.128.154 (gateway.pcpexpress.co.id): 1 i ... show more (mod_security) mod_security (id:210492) triggered by 115.178.128.154 (gateway.pcpexpress.co.id): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jun 12 20:21:58.335358 2026] [security2:error] [pid 1301:tid 1301] [client 115.178.128.154:36092] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.zmgmt.net"] [uri "/.env"] [unique_id "aiyipmPp3wkIc2ij2TulXQAAAAE"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-06-12 23:00:55 (2 days ago)	(mod_security) mod_security (id:210492) triggered by 115.178.128.154 (gateway.pcpexpress.co.id): 1 i ... show more (mod_security) mod_security (id:210492) triggered by 115.178.128.154 (gateway.pcpexpress.co.id): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jun 12 19:00:46.517548 2026] [security2:error] [pid 30269:tid 30269] [client 115.178.128.154:30829] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "infrared-heaters.us"] [uri "/.env"] [unique_id "aiyPnm70rAUHYbvW_rXWLgAAAAA"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-06-12 20:15:26 (2 days ago)	(mod_security) mod_security (id:210492) triggered by 115.178.128.154 (gateway.pcpexpress.co.id): 1 i ... show more (mod_security) mod_security (id:210492) triggered by 115.178.128.154 (gateway.pcpexpress.co.id): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jun 12 16:15:19.262164 2026] [security2:error] [pid 10536:tid 10536] [client 115.178.128.154:13708] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.omahareact.rcto.us"] [uri "/.env"] [unique_id "aixo14Qwlqr7vrvJa1HHjwAAAA0"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-06-12 19:55:08 (2 days ago)	(mod_security) mod_security (id:210492) triggered by 115.178.128.154 (gateway.pcpexpress.co.id): 1 i ... show more (mod_security) mod_security (id:210492) triggered by 115.178.128.154 (gateway.pcpexpress.co.id): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jun 12 15:55:05.018296 2026] [security2:error] [pid 13316:tid 13316] [client 115.178.128.154:30093] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.musicshowcase.us"] [uri "/.env"] [unique_id "aixkGeRMI6qx0-xFA8qU_wAAABA"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-06-12 19:39:22 (2 days ago)	(mod_security) mod_security (id:210492) triggered by 115.178.128.154 (gateway.pcpexpress.co.id): 1 i ... show more (mod_security) mod_security (id:210492) triggered by 115.178.128.154 (gateway.pcpexpress.co.id): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jun 12 15:39:17.910870 2026] [security2:error] [pid 1193:tid 1238] [client 115.178.128.154:17922] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.meeker.us"] [uri "/.env"] [unique_id "aixgZcLjHJCva5dtsbdx5gAAAAU"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-06-12 19:22:30 (2 days ago)	(mod_security) mod_security (id:210492) triggered by 115.178.128.154 (gateway.pcpexpress.co.id): 1 i ... show more (mod_security) mod_security (id:210492) triggered by 115.178.128.154 (gateway.pcpexpress.co.id): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jun 12 15:22:23.945298 2026] [security2:error] [pid 24184:tid 24184] [client 115.178.128.154:30288] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.lmv.us"] [uri "/.env"] [unique_id "aixcb6mS-3RXnm-bGSjXlwAAAA4"] show less	Brute-Force Bad Web Bot Web App Attack
🇩🇪 Hary74656	2026-06-12 05:12:04 (3 days ago)	[Fri Jun 12 05:37:50.872439 2026] [security2:error] [pid 216264:tid 216420] [client 115.178.128.154: ... show more [Fri Jun 12 05:37:50.872439 2026] [security2:error] [pid 216264:tid 216420] [client 115.178.128.154:39695] [client 115.178.128.154] ModSecurity: Access denied with code 403 (phase 2). Matched phrase "/.env" at REQUEST_FILENAME. [file "/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.4"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "aschi.at"] [uri "/.env"] [unique_id "ait_DjU9V8r7DK0RdetvEgAAA1k"] [Fri Jun 12 05:46:09.245709 2026] [security2:error] [pid 216335:tid 216605] [client 115.178.128.154:6437] [client 115.178.128.154] ModSecurity: Access denied with code 403 (phase 2). Matched phrase "/.env" at REQUEST_FILENAME. [file "/usr/share/modsec ... show less	Web App Attack

Showing 1 to 10 of 10 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇯🇵 195.172.211.233

🇪🇨 177.234.226.115

🇻🇳 152.32.255.94

🇯🇵 142.111.34.103

🇨🇳 110.166.87.119

🇮🇳 103.145.55.178

🇸🇪 85.228.91.250

🇮🇩 34.101.91.249

🇯🇵 31.59.11.192

🇰🇭 202.62.37.24

🇦🇷 186.123.136.254

🇸🇦 178.73.117.84

🇨🇭 172.253.11.20

🇺🇸 170.106.103.20

🇸🇬 167.172.93.203

🇮🇳 157.35.62.87

🇭🇰 152.32.132.203

🇯🇵 142.111.67.18

🇯🇵 142.111.34.80

🇺🇸 103.234.62.98