JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 125.164.18.61

125.164.18.61

Neutral Activity

23 reports found in our database

0% Low Risk

Abuse confidence score ?

ISP

PT TELKOM INDONESIA

Usage Type

Fixed Line ISP

ASN

AS7713

Domain Name

telkom.co.id

Country

🇮🇩 Indonesia

City

Malang, East Java

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report Whois

No reports in the last 60 days

125.164.18.61 has been reported 23 times. The most recent report is from 4 months ago.

The full history is preserved below and remains searchable. A 0% score reflects the absence of recent activity, but this is not a guarantee that earlier reports were invalid. Abuse confidence score decays, naturally, over time, when the abusive activity stops.

IP Abuse Reports for 125.164.18.61:

This IP address has been reported a total of 23 times from 16 distinct sources. 125.164.18.61 was first reported on November 11th 2021, and the most recent report was 4 months ago.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇧🇷 Sipo Chutão	2026-04-29 03:00:01 (4 months ago)	/.env	Hacking
🇳🇱 jjnxpct	2026-04-24 03:50:38 (4 months ago)	Automated security incident from hosting server. ModSecurity blocked suspicious request targeting UR ... show more Automated security incident from hosting server. ModSecurity blocked suspicious request targeting URI: /.htaccess (Rule ID: 930130) - Restricted File Access Attempt show less	Web App Attack Hacking
🇳🇱 homeshowdomain.nl	2026-04-23 22:00:26 (4 months ago)	Auto-ban: single probe for restricted files (.env / backups / admin endpoints). Likely mass-scan on ... show more Auto-ban: single probe for restricted files (.env / backups / admin endpoints). Likely mass-scan on 2026-04-22. show less	Web App Attack SSH Hacking
🇺🇸 TPI-Abuse	2026-04-23 03:32:30 (4 months ago)	(mod_security) mod_security (id:210492) triggered by 125.164.18.61 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:210492) triggered by 125.164.18.61 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Apr 22 23:32:24.314835 2026] [security2:error] [pid 21569:tid 21572] [client 125.164.18.61:19091] ModSecurity: Access denied with code 403 (phase 1). Matched phrase ".htaccess" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "192.64.150.79"] [uri "/.htaccess"] [unique_id "aemSyNhl_jqVQOHlvz_DnwAAAAA"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-04-22 21:44:24 (4 months ago)	(mod_security) mod_security (id:210492) triggered by 125.164.18.61 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:210492) triggered by 125.164.18.61 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Apr 22 17:44:18.929341 2026] [security2:error] [pid 1839554:tid 1839554] [client 125.164.18.61:30828] ModSecurity: Access denied with code 403 (phase 1). Matched phrase ".htaccess" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "lobibilisim.com"] [uri "/.htaccess"] [unique_id "aelBMkE5yu4NiRrreJ0JKAAAAAg"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-04-22 21:14:58 (4 months ago)	(mod_security) mod_security (id:210492) triggered by 125.164.18.61 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:210492) triggered by 125.164.18.61 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Apr 22 17:14:53.302437 2026] [security2:error] [pid 2771567:tid 2771567] [client 125.164.18.61:17477] ModSecurity: Access denied with code 403 (phase 1). Matched phrase ".htaccess" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.stocks.nautos-usa.com"] [uri "/.htaccess"] [unique_id "aek6TZKsjBhve5FFnOFnRAAAAAQ"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-04-22 19:43:54 (4 months ago)	(mod_security) mod_security (id:210492) triggered by 125.164.18.61 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:210492) triggered by 125.164.18.61 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Apr 22 15:43:49.407289 2026] [security2:error] [pid 1898299:tid 1898299] [client 125.164.18.61:9827] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.furball.global"] [uri "/.env"] [unique_id "aekk9ciLpuAXdZCTm2YRvwAAAB8"] show less	Brute-Force Bad Web Bot Web App Attack
🇩🇪 betternews.app	2026-04-22 14:47:14 (4 months ago)	"a web request contained keyword "aws"; Suspicious URL: /aws-exports.js"	Web Spam Blog Spam Brute-Force Bad Web Bot Web App Attack
🇨🇭 backslash	2026-04-22 14:36:00 (4 months ago)	block ruleset bad bot: misc bad content F608233CC4C86EE814CE8DDDA9C4A0D3C79882F6	Bad Web Bot
🇧🇪 voormedia	2026-04-22 10:57:39 (4 months ago)	Accessed trap at '/phpinfo.php'	Web App Attack
🇩🇪 expandmade.com	2026-04-18 17:58:51 (4 months ago)	trolling for resource vulnerabilities [18/Apr/2026:17:58:51 "GET /wp-content/plugins/cleantalk-spam- ... show more trolling for resource vulnerabilities [18/Apr/2026:17:58:51 "GET /wp-content/plugins/cleantalk-spam-protect/readme.txt"] show less	Web App Attack
Anonymous	2025-10-10 16:00:22 (10 months ago)	Unauthorized connection attempt	Port Scan Hacking Exploited Host
Anonymous	2025-10-07 08:43:04 (10 months ago)	Unauthorized connection attempt	Port Scan Hacking Exploited Host
🇧🇷 diego	2024-03-13 06:13:51 (2 years ago)	[rede-164-29] 03/13/2024-03:13:51.134956, 125.164.18.61, Protocol: 6, ET SCAN Suspicious inbound to ... show more [rede-164-29] 03/13/2024-03:13:51.134956, 125.164.18.61, Protocol: 6, ET SCAN Suspicious inbound to MSSQL port 1433 show less	Hacking
🇧🇷 diego	2023-12-20 02:20:07 (2 years ago)	[rede-164-29]12/19/2023-23:20:07.090998, 125.164.18.61, Protocol: 6, ET SCAN Suspicious inbound to m ... show more [rede-164-29]12/19/2023-23:20:07.090998, 125.164.18.61, Protocol: 6, ET SCAN Suspicious inbound to mySQL port 3306 show less	Hacking

Showing 1 to 15 of 23 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇬🇧 193.176.29.2

🇭🇺 188.157.62.67

🇨🇴 187.73.176.19

🇨🇱 181.43.241.55

🇷🇺 178.176.80.188

🇳🇱 172.71.102.165

🇻🇳 171.250.167.37

🇨🇳 117.68.234.174

🇨🇳 116.179.37.97

🇫🇷 91.231.89.85

🇬🇧 35.203.210.25

🇧🇷 34.39.200.97

🇬🇧 34.39.114.205

🇮🇷 217.11.23.245

🇺🇸 216.25.89.129

🇺🇸 172.183.133.248

🇩🇪 167.94.146.56

🇨🇳 121.229.156.90

🇨🇳 116.179.37.33

🇬🇧 92.207.4.157