JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 117.18.20.104

117.18.20.104 was found in our database!

This IP was reported 22 times. Confidence of Abuse is 20%: ?

20%

ISP	PT Data Buana Nusantara
Usage Type	Fixed Line ISP
ASN	AS138886
Domain Name	ptdbn.com
Country	🇮🇩 Indonesia
City	Kertosono, East Java

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 117.18.20.104

Whois 117.18.20.104

IP Abuse Reports for 117.18.20.104:

This IP address has been reported a total of 22 times from 15 distinct sources. 117.18.20.104 was first reported on May 27th 2025, and the most recent report was 3 weeks ago.

Old Reports: The most recent abuse report for this IP address is from 3 weeks ago . It is possible that this IP is no longer involved in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇫🇮 YF	2026-06-21 16:00:29 (3 weeks ago)	xmlrpc.php Potential DDoS or brute force	DDoS Attack Brute-Force
🇫🇷 masterguru	2026-06-07 14:44:04 (1 month ago)	xmlrpc request blocked, no referer. Pattern match "xmlrpc.php" at REQUEST_URI. (88010-201)	Hacking
🇫🇷 dynamix	2026-06-07 14:10:51 (1 month ago)	WordPress XMLRPC Brute Force Attack	Brute-Force Web App Attack
🇺🇸 TPI-Abuse	2026-06-07 11:15:30 (1 month ago)	(mod_security) mod_security (id:240335) triggered by 117.18.20.104 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:240335) triggered by 117.18.20.104 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Jun 07 07:15:17.518977 2026] [security2:error] [pid 4322:tid 4322] [client 117.18.20.104:59212] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 117.18.20.104 (+1 hits since last alert)\|cajunpicasso.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "cajunpicasso.com"] [uri "/xmlrpc.php"] [unique_id "aiVSxcRKiqxL7y_e7dPYuwAAAAE"] show less	Brute-Force Bad Web Bot Web App Attack
Anonymous	2026-06-07 11:08:40 (1 month ago)	Attac	Brute-Force
🇮🇩 hermawan	2026-05-24 08:22:39 (1 month ago)	1779610938.962221 117.18.20.104 103.166.156.58 65535_2-4-8-1-3_1432_9 2026-05-24 15:22:18 WIB ...	Email Spam Hacking
🇨🇦 Paulo Henrique dos Santos Nichio	2026-05-09 09:53:14 (2 months ago)	(ls_brute) LiteSpeed Brute Force Attack 117.18.20.104 (ID/Indonesia/-): 3 in the last 600 secs; Port ... show more (ls_brute) LiteSpeed Brute Force Attack 117.18.20.104 (ID/Indonesia/-): 3 in the last 600 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: 2026-05-09 06:52:41.306869 [WARN] [3425834] [T0] [117.18.20.104:54746-28#APVH_www.defesadisciplinar.com.br:443] Brute force detected for IP [117.18.20.104], throttle. 2026-05-09 06:52:52.302379 [WARN] [3425834] [T0] [117.18.20.104:54746-29#APVH_www.defesadisciplinar.com.br:443] Brute force detected for IP [117.18.20.104], throttle. 2026-05-09 06:53:02.300390 [WARN] [3425834] [T0] [117.18.20.104:54746-30#APVH_www.defesadisciplinar.com.br:443] Brute force detected for IP [117.18.20.104], throttle. show less	Port Scan
🇩🇪 Tha_14	2026-05-08 14:05:22 (2 months ago)	Limit on login attempts is reached	Brute-Force
🇺🇸 TPI-Abuse	2026-05-08 12:52:49 (2 months ago)	(mod_security) mod_security (id:240335) triggered by 117.18.20.104 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:240335) triggered by 117.18.20.104 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri May 08 08:52:34.470559 2026] [security2:error] [pid 26408:tid 26408] [client 117.18.20.104:58814] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5965"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 117.18.20.104 (+1 hits since last alert)\|emailaegis.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "emailaegis.com"] [uri "/xmlrpc.php"] [unique_id "af3ckvUMD4a0QSdmw6To-wAAAA0"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-05-05 19:30:32 (2 months ago)	(mod_security) mod_security (id:240335) triggered by 117.18.20.104 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:240335) triggered by 117.18.20.104 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue May 05 15:30:17.700761 2026] [security2:error] [pid 5100:tid 5100] [client 117.18.20.104:58853] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 117.18.20.104 (+1 hits since last alert)\|ucommsi.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "ucommsi.com"] [uri "/xmlrpc.php"] [unique_id "afpFSTQv9kV43FdtyqiN9AAAAAM"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-04-28 13:24:28 (2 months ago)	(mod_security) mod_security (id:240335) triggered by 117.18.20.104 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:240335) triggered by 117.18.20.104 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Apr 28 09:24:13.649750 2026] [security2:error] [pid 15555:tid 15555] [client 117.18.20.104:55072] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 117.18.20.104 (+1 hits since last alert)\|kaldaragroup.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "kaldaragroup.com"] [uri "/xmlrpc.php"] [unique_id "afC0_VtWS3koTI6DA_0E1AAAAAs"] show less	Brute-Force Bad Web Bot Web App Attack
🇫🇷 SpaceHost-Server	2026-04-25 06:58:08 (2 months ago)	117.18.20.104 - - [25/Apr/2026:08:57:48 +0200] "POST /xmlrpc.php HTTP/1.1" 200 430 "-" "Jetpack by W ... show more 117.18.20.104 - - [25/Apr/2026:08:57:48 +0200] "POST /xmlrpc.php HTTP/1.1" 200 430 "-" "Jetpack by WordPress.com" 117.18.20.104 - - [25/Apr/2026:08:57:58 +0200] "POST /xmlrpc.php HTTP/1.1" 200 430 "-" "WordPress.com; https://wordpress.com" 117.18.20.104 - - [25/Apr/2026:08:58:08 +0200] "POST /xmlrpc.php HTTP/1.1" 200 430 "-" "Jetpack by WordPress.com (Jetpack 12.0; WordPress 6.3)" show less	Hacking Web App Attack
🇫🇷 SpaceHost-Server	2026-04-25 06:42:39 (2 months ago)	117.18.20.104 - - [25/Apr/2026:08:42:19 +0200] "POST /xmlrpc.php HTTP/1.1" 200 430 "-" "Jetpack by W ... show more 117.18.20.104 - - [25/Apr/2026:08:42:19 +0200] "POST /xmlrpc.php HTTP/1.1" 200 430 "-" "Jetpack by WordPress.com" 117.18.20.104 - - [25/Apr/2026:08:42:27 +0200] "POST /xmlrpc.php HTTP/1.1" 200 430 "-" "WordPress.com; https://wordpress.com" 117.18.20.104 - - [25/Apr/2026:08:42:38 +0200] "POST /xmlrpc.php HTTP/1.1" 200 430 "-" "Jetpack/12.0; WordPress/6.1; http://site65706177.com" show less	Hacking Web App Attack
🇮🇩 hermawan	2026-02-05 20:24:20 (5 months ago)	[Fri Feb 06 03:23:44.665577 2026] [security2:error] [pid 380713:tid 140184084481728] [client 117.18. ... show more [Fri Feb 06 03:23:44.665577 2026] [security2:error] [pid 380713:tid 140184084481728] [client 117.18.20.104:60386] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "CFNetwork" at REQUEST_HEADERS:User-Agent. [file "/etc/modsecurity/coreruleset-4.22.0/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "253"] [id "440000"] [msg "BAD BOT - Detected and Blocked"] [data "Matched Data: CFNetwork found within REQUEST_HEADERS:User-Agent: com.apple.Safari.SearchHelper/8623.1.14.10.9 CFNetwork/3860.300.31 Darwin/25.2.0 request_line = GET /index.php/component/search/?Itemid=1140&id=4209&format=opensearch HTTP/2.0"] [severity "NOTICE"] [hostname "staklim-jatim.bmkg.go.id"] [uri "/index.php/component/search/"] [unique_id "aYT8UCXIq5px8bYkfGE3OgAERQ4"] [staklim-jatim.bmkg.go.id] [staklim-jatim.bmkg.go.id] top=[380730] [KqL/chkwgUM] [aYT8UCXIq5px8bYkfGE3OgAERQ4] keep_alive=[1] [2026-02-06 03:23:44.665589] [R:aYT8UCXIq5px8bYkfGE3OgAERQ4] UA:'com.apple.Safari.SearchHelper/8623.1.14.10. ... show less	Hacking Web App Attack
🇩🇪 Packets-Decreaser.NET	2025-12-20 18:43:19 (6 months ago)	Incoming Layer 7 Flood Detected	DDoS Attack Web Spam

Showing 1 to 15 of 22 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇺🇸 65.49.1.108

🇧🇷 200.11.122.247

🇪🇹 196.191.249.182

🇦🇷 181.28.101.14

🇸🇬 114.119.152.149

🇮🇩 103.168.135.187

🇨🇦 85.217.149.71

🇩🇪 78.111.67.112

🇬🇧 2a06:4880:c000::f7

🇩🇪 167.94.145.23

🇨🇳 116.181.16.142

🇳🇱 77.239.124.240

🇦🇪 74.162.64.94

🇫🇷 62.210.198.27

🇬🇧 35.203.211.128

🇨🇳 218.74.35.158

🇬🇧 185.247.137.140

🇺🇸 147.185.132.121

🇮🇳 125.23.255.134

🇨🇳 49.235.64.218