JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

125.166.0.95

Activity Trending Down

Abuse confidence score ?

6% Caution

14 reports

6 reporters · latest 1 month ago

ISP	PT TELKOM INDONESIA
Usage Type	Fixed Line ISP
ASN	AS7713
Domain Name	telkom.co.id
Country	🇮🇩 Indonesia
City	Malang, East Java

ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report Whois

Reports Activity

Example preview

Report Categories (Last 60 Days)

Example preview

Top Reporter Countries (Last 60 Days)

Example preview

Account required for the enhanced features Log in Sign up

IP Abuse Reports for 125.166.0.95

Export CSV

This IP address has been reported a total of 14 times from 6 distinct sources. 125.166.0.95 was first reported on August 6th 2021, and the most recent report was 1 month ago. In the last 60 days, the only reporter location was: United States of America with 2 reports. The most common categories in these recent reports were: Bad Web Bot 2 times; DDoS Attack 1 time.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇺🇸 kosada.com	2026-08-25 05:03:38 (1 month ago)	Web bot: denial-of-service flood	DDoS Attack Bad Web Bot
🇺🇸 鬼影233	2026-08-23 13:16:02 (1 month ago)	Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Sa ... show more Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 show less	Bad Web Bot
🇺🇸 kosada.com	2026-08-01 04:08:45 (2 months ago)	Web bot: denial-of-service flood	DDoS Attack Bad Web Bot
🇮🇩 hermawan	2025-10-13 03:24:55 (1 year ago)	[Mon Oct 13 10:23:53.129096 2025] [security2:error] [pid 965104:tid 139978444048064] [client 125.166 ... show more [Mon Oct 13 10:23:53.129096 2025] [security2:error] [pid 965104:tid 139978444048064] [client 125.166.0.95:10122] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i),.?[\\"'\\\\)0-9`-f][\\"'`](?:[\\"'`].?[\\"'`]\|(?:\\\\r?\\\\n)?\\\\z\|[^\\"'`]+)\|[^0-9A-Z_a-z]select.+[^0-9A-Z_a-z]?from\|(?:alter\|(?:(?:cre\|trunc\|upd)at\|renam)e\|d(?:e(?:lete\|sc)\|rop)\|(?:inser\|selec)t\|load)[\\\\s\\\\x0b]?\\\\([\\\\s\\\\x0b]?space[\\\\s\\\\x0b]?\\\\(" at REQUEST_HEADERS:User-Agent. [file "/etc/modsecurity/coreruleset-4.16.0/rules/REQUEST-942-APPLICATION-ATTACK-SQLI.conf"] [line "2129"] [id "942200"] [msg "Detects MySQL comment-/space-obfuscated injections and backtick termination"] [data " Matched Data ARGS charset: - Matched Data TX.1: found within Content-Type multipart form Matched Data: , like Gecko) Mobile/15E148 OcIdWebView ({\\x22appVersion\\x22:\\x22389.2.814818472\\x22, found within REQUEST_HEADERS:User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 18_6_2 like Mac OS X) AppleWeb ... show less	Hacking Web App Attack
🇻🇪 VenCERT	2024-03-04 02:43:36 (2 years ago)	trying to access non-authorized port	Port Scan
🇮🇩 NOC Monitoring KAI	2023-08-24 04:06:46 (3 years ago)	attack ke arah PT KAI	Port Scan Web App Attack
🇮🇩 hermawan	2022-05-25 13:48:06 (4 years ago)	[Thu May 26 00:48:04.125343 2022] [-:error] [pid 109590:tid 140735283902208] [client 125.166.0.95:51 ... show more [Thu May 26 00:48:04.125343 2022] [-:error] [pid 109590:tid 140735283902208] [client 125.166.0.95:5110] [client 125.166.0.95] ModSecurity: Access denied with code 403 (phase 1). Match of "pm applebot bingbot https://yandex.com/ https://www.google.com.tw facebookbot https://www.ecosia.org/ https://duckduckgo.com/ facebookcatalog facebookexternalhit Googlebot/2.1; +http://www.google.com/bot.html twitterbot TelegramBot youtube.com dareboost.c ..." against "REQUEST_HEADERS:Referer" required. [file "/etc/modsecurity/coreruleset-4.0.0-rc1/rules/custom_user.conf"] [line "15"] [id "1000067"] [msg "BAD Referer"] [data "Matched Data: AppleWebKit/605.1.15 found within REQUEST_HEADERS:Referer: request_line = GET /OneSignalSDKWorker.js HTTP/2.0"] [severity "NOTICE"] [hostname "karangploso.jatim.bmkg.go.id"] [uri "/OneSignalSDKWorker.js"] [unique_id "Yo5r1LjxMSzoAzziO6Vu2AAAxAE"] [karangploso.jatim.bmkg.go.id] [karangploso.jatim.bmkg.go.id] top=[109986] [196-1] [Yo5r1LjxMSzoAzziO6Vu2AAAxAE] keep_al ... show less	Hacking Web App Attack
🇮🇩 hermawan	2022-05-12 08:15:56 (4 years ago)	[Thu May 12 19:15:53.711838 2022] [access_compat:error] [pid 5493:tid 140735408731904] [client 125.1 ... show more [Thu May 12 19:15:53.711838 2022] [access_compat:error] [pid 5493:tid 140735408731904] [client 125.166.0.95:19328] AH01797: client denied by server configuration: /var/www/index.php, referer https://karangploso.jatim.bmkg.go.id/ [staklim-malang.info] [staklim-malang.info] top=[5732] [501-15] [Ynz6eTsKtVD9p2ovD562iAAB9Q8] keep_alive=[1] [2022-05-12 19:15:53.711843] [R:Ynz6eTsKtVD9p2ovD562iAAB9Q8] UA:'Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:100.0) Gecko/20100101 Firefox/100.0' ... show less	Hacking Web App Attack
🇮🇩 hermawan	2022-05-11 14:07:53 (4 years ago)	[Thu May 12 01:07:52.575545 2022] [proxy_fcgi:error] [pid 543810:tid 140735282841344] [client 125.16 ... show more [Thu May 12 01:07:52.575545 2022] [proxy_fcgi:error] [pid 543810:tid 140735282841344] [client 125.166.0.95:6141] AH01071: Got error 'Primary script unknown' [matomo.staklim-malang.info] [matomo.staklim-malang.info] top=[544072] [151-15] [Ynv7eGvkdfKL408c85_mdwAAlwA] keep_alive=[1] [2022-05-12 01:07:52.575554] [R:Ynv7eGvkdfKL408c85_mdwAAlwA] UA:'Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:100.0) Gecko/20100101 Firefox/100.0' ... show less	Hacking Web App Attack
🇮🇩 hermawan	2022-05-11 11:49:51 (4 years ago)	[Wed May 11 22:49:48.645403 2022] [access_compat:error] [pid 451659:tid 140735349987072] [client 125 ... show more [Wed May 11 22:49:48.645403 2022] [access_compat:error] [pid 451659:tid 140735349987072] [client 125.166.0.95:14690] AH01797: client denied by server configuration: /var/www/index.php, referer https://karangploso.jatim.bmkg.go.id/ [staklim-malang.info] [staklim-malang.info] top=[451772] [188-15] [YnvbHLyHtL_QU7GUVQ22pgAAvAg] keep_alive=[1] [2022-05-11 22:49:48.645409] [R:YnvbHLyHtL_QU7GUVQ22pgAAvAg] UA:'Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:100.0) Gecko/20100101 Firefox/100.0' ... show less	Hacking Web App Attack
🇮🇩 hermawan	2022-05-10 05:33:37 (4 years ago)	[Tue May 10 16:33:36.309464 2022] [authz_core:error] [pid 42323:tid 140735720806144] [client 125.166 ... show more [Tue May 10 16:33:36.309464 2022] [authz_core:error] [pid 42323:tid 140735720806144] [client 125.166.0.95:22266] AH01630: client denied by server configuration: /var/www/administrator/ [karangploso.jatim.bmkg.go.id] [karangploso.jatim.bmkg.go.id] top=[42704] [176-15] [YnoxcGzNoHBfsTcNWgzOMwAAsDQ] keep_alive=[1] [2022-05-10 16:33:36.309471] [R:YnoxcGzNoHBfsTcNWgzOMwAAsDQ] UA:'Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:100.0) Gecko/20100101 Firefox/100.0' ... show less	Hacking Web App Attack
🇮🇩 hermawan	2022-05-10 01:26:29 (4 years ago)	[Tue May 10 12:26:26.847706 2022] [-:error] [pid 39766:tid 140735334414080] [client 125.166.0.95:278 ... show more [Tue May 10 12:26:26.847706 2022] [-:error] [pid 39766:tid 140735334414080] [client 125.166.0.95:27869] [client 125.166.0.95] ModSecurity: Access denied with code 403 (phase 2). Found 3 byte(s) in REQUEST_URI outside range: 32-36,38-126. [file "/etc/modsecurity/coreruleset-3.3.2/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1481"] [id "920272"] [msg "Invalid character in request (outside of printable chars below ascii 127)"] [data "REQUEST_URI=/images/Klimatologi/Analisis/02-Analisis_Dasarian/Dinamika/2022/04_April_2022/Das-III/Analisis_Dinamika_Atmosfer\\xe2\\x80\\x93Laut_Dan_Prediksi_Curah_Hujan_Update_Dasarian_III_April_2022.jpg"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.2"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "paranoia-level/3"] [hostname "karangploso.jatim.bmkg.go.id"] [uri "/images/Klimatologi/Analisis/02-Analisis_Dasarian/Dinamika/2022/04_April_2022/Das-III/Anali ... show less	Hacking Web App Attack
🇮🇩 hermawan	2022-05-09 07:59:28 (4 years ago)	[Mon May 09 18:59:25.486715 2022] [proxy_fcgi:error] [pid 150023:tid 140735326029568] [client 125.16 ... show more [Mon May 09 18:59:25.486715 2022] [proxy_fcgi:error] [pid 150023:tid 140735326029568] [client 125.166.0.95:28715] AH01071: Got error 'Primary script unknown', referer https://karangploso.jatim.bmkg.go.id/ [matomo.staklim-malang.info] [matomo.staklim-malang.info] top=[150359] [152-11] [YnkCHTIdY2gwbMNxqoIVlAAAmAU] keep_alive=[1] [2022-05-09 18:59:25.486742] [R:YnkCHTIdY2gwbMNxqoIVlAAAmAU] UA:'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.54 Safari/537.36' ... show less	Hacking Web App Attack
🇺🇸 abc	2021-08-06 13:56:11 (5 years ago)		Brute-Force Bad Web Bot

Showing 1 to 14 of 14 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇰🇷 221.161.112.140

🇮🇩 153.76.64.206

🇨🇴 152.200.181.42

🇫🇮 95.133.253.15

🇵🇰 72.255.17.137

🇳🇱 45.148.10.151

🇬🇧 2.57.17.66

🇺🇸 2a03:2880:16ff:4c::

🇬🇧 185.170.109.141

🇺🇸 184.176.134.105

🇪🇸 172.68.135.187

🇺🇸 156.232.13.218

🇭🇰 139.198.113.29

🇺🇸 137.184.220.124

🇵🇭 112.202.113.103

🇵🇰 103.26.86.145

🇱🇹 62.60.130.242

🇬🇧 31.14.254.85

🇬🇧 195.96.139.174

🇺🇸 159.223.185.101