AbuseIPDB » 118.195.130.163

118.195.130.163 was found in our database!

This IP was reported 372 times. Confidence of Abuse is 93%: ?

93%

ISP	Tencent Cloud Computing (Beijing) Co. Ltd
Usage Type	Data Center/Web Hosting/Transit
Domain Name	tencent.com
Country	China
City	Liuzhou, Guangxi Zhuangzu

IP info including ISP, Usage Type, and Location provided by IP2Location. Updated monthly.

Report 118.195.130.163

Whois 118.195.130.163

IP Abuse Reports for 118.195.130.163:

This IP address has been reported a total of 372 times from 94 distinct sources. 118.195.130.163 was first reported on November 6th 2023, and the most recent report was 3 hours ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp in UTC	Comment	Categories
TPI-Abuse	2024-08-02 08:45:08 (1 month ago)	(mod_security) mod_security (id:240335) triggered by 118.195.130.163 (-): 1 in the last 300 secs; Po ... show more(mod_security) mod_security (id:240335) triggered by 118.195.130.163 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Aug 02 04:44:59.424644 2024] [security2:error] [pid 12502:tid 12502] [client 118.195.130.163:50008] [client 118.195.130.163] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 118.195.130.163 (+1 hits since last alert)\|nesetsv.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "nesetsv.com"] [uri "/xmlrpc.php"] [unique_id "Zqyci_yUpokkjo5AwxqITAAAAAQ"] show less	Brute-Force Bad Web Bot Web App Attack
TPI-Abuse	2024-08-02 06:33:32 (1 month ago)	(mod_security) mod_security (id:240335) triggered by 118.195.130.163 (-): 1 in the last 300 secs; Po ... show more(mod_security) mod_security (id:240335) triggered by 118.195.130.163 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Aug 02 02:33:21.260912 2024] [security2:error] [pid 534651:tid 534738] [client 118.195.130.163:54341] [client 118.195.130.163] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 118.195.130.163 (+1 hits since last alert)\|www.busybeerestaurant.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "www.busybeerestaurant.com"] [uri "/xmlrpc.php"] [unique_id "Zqx9sYkugo_A142lp2MGOQAAAkg"] show less	Brute-Force Bad Web Bot Web App Attack
Anonymous	2024-08-01 23:39:54 (1 month ago)	wordpress-trap	Web App Attack
paulshipley.com.au	2024-07-31 17:26:29 (1 month ago)	levellapromotions.com.au:443 118.195.130.163 - - [01/Aug/2024:03:24:51 +1000] "GET /?author=1 HTTP/1 ... show morelevellapromotions.com.au:443 118.195.130.163 - - [01/Aug/2024:03:24:51 +1000] "GET /?author=1 HTTP/1.1" 404 138768 "-" "Apache-HttpClient/4.5.2 (Java/1.8.0_161)" levellapromotions.com.au:443 118.195.130.163 - - [01/Aug/2024:03:24:55 +1000] "GET /?author=2 HTTP/1.1" 404 138768 "-" "Apache-HttpClient/4.5.2 (Java/1.8.0_161)" levellapromotions.com.au:443 118.195.130.163 - - [01/Aug/2024:03:25:04 +1000] "GET /?author=3 HTTP/1.1" 404 138910 "-" "Apache-HttpClient/4.5.2 (Java/1.8.0_161)" levellapromotions.com.au:443 118.195.130.163 - - [01/Aug/2024:03:25:08 +1000] "GET /?author=4 HTTP/1.1" 404 138768 "-" "Apache-HttpClient/4.5.2 (Java/1.8.0_161)" levellapromotions.com.au:443 118.195.130.163 - - [01/Aug/2024:03:25:16 +1000] "GET /?author=6 HTTP/1.1" 404 138768 "-" "Apache-HttpClient/4.5.2 (Java/1.8.0_161)" levellapromotions.com.au:443 118.195.130.163 - - [01/Aug/2024:03:25:22 +1000] "GET /?author=7 HTTP/1.1" 404 138768 "-" "Apache-HttpClient/4.5.2 (Java/1.8.0_161)" levellapromotions.com.au:443 ... show less	Web App Attack
nationaleventpros.com	2024-07-29 16:00:33 (1 month ago)	WordPress login attempt	Brute-Force
URAN Publishing Service	2024-07-29 12:22:03 (1 month ago)	118.195.130.163 - - [29/Jul/2024:15:21:07 +0300] "GET /wp-login.php HTTP/1.1" 404 286 "-" "Apache-Ht ... show more118.195.130.163 - - [29/Jul/2024:15:21:07 +0300] "GET /wp-login.php HTTP/1.1" 404 286 "-" "Apache-HttpClient/4.5.2 (Java/1.8.0_161)" 118.195.130.163 - - [29/Jul/2024:15:22:01 +0300] "GET /wp-login.php HTTP/1.1" 404 272 "-" "Apache-HttpClient/4.5.2 (Java/1.8.0_161)" ... show less	Web App Attack
Anonymous	2024-07-26 16:48:43 (1 month ago)	wordpress-trap	Web App Attack
URAN Publishing Service	2024-07-25 01:05:49 (1 month ago)	118.195.130.163 - - [25/Jul/2024:04:05:48 +0300] "GET /wp-login.php HTTP/1.1" 404 284 "-" "Apache-Ht ... show more118.195.130.163 - - [25/Jul/2024:04:05:48 +0300] "GET /wp-login.php HTTP/1.1" 404 284 "-" "Apache-HttpClient/4.5.2 (Java/1.8.0_161)" ... show less	Web App Attack
URAN Publishing Service	2024-07-24 05:54:59 (1 month ago)	118.195.130.163 - - [24/Jul/2024:08:54:56 +0300] "GET /wp-login.php HTTP/1.1" 404 274 "-" "Apache-Ht ... show more118.195.130.163 - - [24/Jul/2024:08:54:56 +0300] "GET /wp-login.php HTTP/1.1" 404 274 "-" "Apache-HttpClient/4.5.2 (Java/1.8.0_161)" 118.195.130.163 - - [24/Jul/2024:08:54:58 +0300] "GET /wp-login.php HTTP/1.1" 404 280 "-" "Apache-HttpClient/4.5.2 (Java/1.8.0_161)" ... show less	Web App Attack
TPI-Abuse	2024-07-24 00:50:37 (1 month ago)	(mod_security) mod_security (id:240335) triggered by 118.195.130.163 (-): 1 in the last 300 secs; Po ... show more(mod_security) mod_security (id:240335) triggered by 118.195.130.163 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jul 23 20:50:29.182174 2024] [security2:error] [pid 4158:tid 4158] [client 118.195.130.163:56438] [client 118.195.130.163] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 118.195.130.163 (+1 hits since last alert)\|carolinafootprints.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "carolinafootprints.com"] [uri "/xmlrpc.php"] [unique_id "ZqBP1Qs5jOaxqQAZPq8SZgAAAA8"] show less	Brute-Force Bad Web Bot Web App Attack
TPI-Abuse	2024-07-23 16:04:13 (1 month ago)	(mod_security) mod_security (id:240335) triggered by 118.195.130.163 (-): 1 in the last 300 secs; Po ... show more(mod_security) mod_security (id:240335) triggered by 118.195.130.163 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jul 23 12:04:03.715508 2024] [security2:error] [pid 16012:tid 16695] [client 118.195.130.163:62642] [client 118.195.130.163] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 118.195.130.163 (+1 hits since last alert)\|chelseyrae.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "chelseyrae.com"] [uri "/xmlrpc.php"] [unique_id "Zp_Ucz-H13iCLrz7ShFLXgAAABg"] show less	Brute-Force Bad Web Bot Web App Attack
Anonymous	2024-07-23 05:00:11 (1 month ago)	Ports: 80,443; Direction: 0; Trigger: LF_CUSTOMTRIGGER	Brute-Force SSH
TPI-Abuse	2024-07-22 09:34:15 (1 month ago)	(mod_security) mod_security (id:240335) triggered by 118.195.130.163 (-): 1 in the last 300 secs; Po ... show more(mod_security) mod_security (id:240335) triggered by 118.195.130.163 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jul 22 05:34:02.248339 2024] [security2:error] [pid 10797:tid 10797] [client 118.195.130.163:65219] [client 118.195.130.163] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5965"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 118.195.130.163 (+1 hits since last alert)\|www.teleplussolutions.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "www.teleplussolutions.com"] [uri "/xmlrpc.php"] [unique_id "Zp4niqAp4tBPL6qRGATD3AAAAAU"] show less	Brute-Force Bad Web Bot Web App Attack
applemooz	2024-07-22 01:38:24 (1 month ago)	WordPress XMLRPC Brute Force Attacks ...	Brute-Force Web App Attack
TPI-Abuse	2024-07-20 01:58:13 (1 month ago)	(mod_security) mod_security (id:240335) triggered by 118.195.130.163 (-): 1 in the last 300 secs; Po ... show more(mod_security) mod_security (id:240335) triggered by 118.195.130.163 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jul 19 21:58:03.521305 2024] [security2:error] [pid 1585706:tid 1585706] [client 118.195.130.163:52654] [client 118.195.130.163] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 118.195.130.163 (+1 hits since last alert)\|www.lasertherapyoc.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "www.lasertherapyoc.com"] [uri "/xmlrpc.php"] [unique_id "ZpsZq2ln53C0e-ML6L0mjwAAAAc"] show less	Brute-Force Bad Web Bot Web App Attack