JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 125.164.18.115

125.164.18.115 was found in our database!

This IP was reported 15 times. Confidence of Abuse is 0%: ?

ISP	PT TELKOM INDONESIA
Usage Type	Fixed Line ISP
ASN	AS7713
Domain Name	telkom.co.id
Country	🇮🇩 Indonesia
City	Malang, East Java

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 125.164.18.115

Whois 125.164.18.115

IP Abuse Reports for 125.164.18.115:

This IP address has been reported a total of 15 times from 11 distinct sources. 125.164.18.115 was first reported on October 20th 2021, and the most recent report was 1 year ago.

Old Reports: The most recent abuse report for this IP address is from 1 year ago . It is possible that this IP is no longer involved in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇹🇷 Domainhizmetleri.com	2025-02-20 10:45:56 (1 year ago)	MS-SQL	Port Scan SQL Injection Brute-Force
🇺🇸 TPI-Abuse	2024-06-20 07:45:25 (2 years ago)	(mod_security) mod_security (id:225170) triggered by 125.164.18.115 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:225170) triggered by 125.164.18.115 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jun 20 03:45:16.079633 2024] [security2:error] [pid 11273] [client 125.164.18.115:1311] [client 125.164.18.115] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)\|\|www.newdirectionsinmusic.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "www.newdirectionsinmusic.com"] [uri "/wp-json/wp/v2/users/1"] [unique_id "ZnPeDPCLI1FdKUx3DhutdgAAABE"] show less	Brute-Force Bad Web Bot Web App Attack
🇧🇷 diego	2024-05-20 12:16:02 (2 years ago)	[rede-arem1] 05/20/2024-09:16:02.585186, 125.164.18.115, Protocol: 6, ET SCAN Suspicious inbound to ... show more [rede-arem1] 05/20/2024-09:16:02.585186, 125.164.18.115, Protocol: 6, ET SCAN Suspicious inbound to mySQL port 3306 show less	Hacking
🇧🇷 diego	2024-05-20 10:37:29 (2 years ago)	[rede-164-29] 05/20/2024-07:37:29.238973, 125.164.18.115, Protocol: 6, ET SCAN Suspicious inbound to ... show more [rede-164-29] 05/20/2024-07:37:29.238973, 125.164.18.115, Protocol: 6, ET SCAN Suspicious inbound to mySQL port 3306 show less	Hacking
🇮🇩 ISMUNANDI .	2024-04-08 07:44:00 (2 years ago)	Attack Signature : /phpmyadmin/ dir access (/phpmyadmin/) GET /phpmyadmin/ HTTP/1.1 User-Agent: Mo ... show more Attack Signature : /phpmyadmin/ dir access (/phpmyadmin/) GET /phpmyadmin/ HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0 X-Forwarded-For: 125.164.18.115, 125.164.18.115, 125.164.18.115 X-Real-IP: 125.164.18.115 show less	Hacking Web App Attack
Anonymous	2024-02-17 13:26:00 (2 years ago)	"HTTP Parser Attack"	Web App Attack
🇺🇦 URAN Publishing Service	2023-12-21 12:30:09 (2 years ago)	125.164.18.115 - - [21/Dec/2023:14:30:06 +0200] "GET //xmlrpc.php?rsd HTTP/1.1" 404 2910 "-" "Mozill ... show more 125.164.18.115 - - [21/Dec/2023:14:30:06 +0200] "GET //xmlrpc.php?rsd HTTP/1.1" 404 2910 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36" 125.164.18.115 - - [21/Dec/2023:14:30:09 +0200] "GET /xmlrpc.php?rsd HTTP/1.1" 404 495 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36" ... show less	Web App Attack
🇺🇸 TPI-Abuse	2023-12-20 11:06:14 (2 years ago)	(mod_security) mod_security (id:225170) triggered by 125.164.18.115 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:225170) triggered by 125.164.18.115 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Dec 20 06:06:03.629653 2023] [security2:error] [pid 3000] [client 125.164.18.115:1049] [client 125.164.18.115] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)\|\|www.healthybutgoodcary.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "www.healthybutgoodcary.com"] [uri "/wp-json/wp/v2/users/"] [unique_id "ZYLKm6_K0wOS5qivXLjK6AAAAAQ"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 MPL	2023-11-05 21:57:08 (2 years ago)	tcp/8080	Port Scan
🇺🇸 MPL	2023-11-05 21:57:08 (2 years ago)	tcp/8080	Port Scan
🇺🇸 MPL	2022-10-01 07:20:14 (3 years ago)	tcp/1433 (4 or more attempts)	Port Scan
Anonymous	2022-08-30 01:14:24 (3 years ago)	2022-08-29T22:09:15.250168monitor sshd[471213]: Invalid user oleta from 125.164.18.115 port 22189 20 ... show more 2022-08-29T22:09:15.250168monitor sshd[471213]: Invalid user oleta from 125.164.18.115 port 22189 2022-08-29T22:10:46.063231monitor sshd[471358]: Invalid user mysql2 from 125.164.18.115 port 10187 2022-08-29T22:14:23.655261monitor sshd[471858]: Invalid user user from 125.164.18.115 port 12789 ... show less	Brute-Force SSH
🇺🇸 Nazgul	2022-08-29 22:50:53 (3 years ago)	SSH brute force attempt (f1)	Brute-Force SSH
🇯🇵 h3zjp	2022-08-29 17:44:56 (3 years ago)	2022-08-30T06:43:53.447657vps-web01.h3z.jp sshd[1360914]: Invalid user zhang from 125.164.18.115 por ... show more 2022-08-30T06:43:53.447657vps-web01.h3z.jp sshd[1360914]: Invalid user zhang from 125.164.18.115 port 25461 2022-08-30T06:44:43.046796vps-web01.h3z.jp sshd[1360950]: Invalid user ftpuser from 125.164.18.115 port 8480 2022-08-30T06:44:55.458941vps-web01.h3z.jp sshd[1360953]: Invalid user public from 125.164.18.115 port 30855 ... show less	Brute-Force SSH
🇿🇦 IrisFlower	2021-10-20 15:33:40 (4 years ago)	Unauthorized connection attempt detected from IP address 125.164.18.115 to port 80 [J]	Port Scan Hacking

Showing 1 to 15 of 15 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇨🇴 200.10.29.236

🇩🇪 185.220.101.22

🇨🇳 180.76.53.175

🇹🇼 165.154.227.8

🇺🇸 152.32.235.69

🇱🇻 81.30.98.49

🇧🇷 18.231.103.185

🇯🇵 8.216.5.224

🇺🇸 205.210.31.64

🇹🇼 198.235.24.12

🇰🇪 197.248.179.127

🇳🇱 192.178.118.150

🇧🇷 179.109.53.143

🇨🇳 112.86.225.140

🇳🇱 104.23.166.24

🇮🇳 103.177.204.4

🇩🇴 45.172.152.74

🇧🇬 5.188.206.66

🇬🇧 2a06:4880:4000::56

🇲🇦 196.75.241.179