JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 125.166.12.182

125.166.12.182 was found in our database!

This IP was reported 19 times. Confidence of Abuse is 28%: ?

28%

ISP	PT TELKOM INDONESIA
Usage Type	Fixed Line ISP
ASN	AS7713
Domain Name	telkom.co.id
Country	🇮🇩 Indonesia
City	Malang, East Java

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 125.166.12.182

Whois 125.166.12.182

IP Abuse Reports for 125.166.12.182:

This IP address has been reported a total of 19 times from 12 distinct sources. 125.166.12.182 was first reported on October 3rd 2022, and the most recent report was 21 hours ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇩🇪 k1nzu	2026-07-02 00:01:09 (21 hours ago)	RDP brute-force login attempts (Windows event 4625) against our VPS. Auto-banned by firewall.	SSH Brute-Force
🇩🇪 k1nzu	2026-06-29 00:00:56 (3 days ago)	RDP brute-force login attempts (Windows event 4625) against our VPS. Auto-banned by firewall.	SSH Brute-Force
🇩🇪 k1nzu	2026-06-26 00:01:35 (6 days ago)	RDP brute-force login attempts (Windows event 4625) against our VPS. Auto-banned by firewall.	SSH Brute-Force
🇩🇪 k1nzu	2026-06-23 00:02:12 (1 week ago)	RDP brute-force login attempts (Windows event 4625) against our VPS. Auto-banned by firewall.	SSH Brute-Force
🇩🇪 k1nzu	2026-06-19 18:02:12 (1 week ago)	RDP brute-force login attempts (Windows event 4625) against our VPS. Auto-banned by firewall.	SSH Brute-Force
🇺🇸 podril1ak2.ru	2026-06-12 04:54:09 (2 weeks ago)	Blocked by UFW on reporterUS [1433/tcp] \| SPT: 20525 \| TTL: 117 \| LEN: 52 \| TOS: 0x00 • Reported by: ... show more Blocked by UFW on reporterUS [1433/tcp] \| SPT: 20525 \| TTL: 117 \| LEN: 52 \| TOS: 0x00 • Reported by: github.com/sefinek/UFW-AbuseIPDB-Reporter show less	Port Scan
🇺🇸 Ghost Rider	2026-06-10 07:55:02 (3 weeks ago)	RdpGuard detected brute-force attempt on RDP	Brute-Force
🇩🇪 iNetWorker	2026-06-10 03:41:21 (3 weeks ago)	firewall-block, port(s): 135/tcp, 1433/tcp	Port Scan
🇷🇸 Smel	2026-06-09 06:08:03 (3 weeks ago)	SQL/MH Probe, Scan, Hack -	Port Scan Hacking SQL Injection
🇫🇷 Hiigara	2026-06-08 08:00:57 (3 weeks ago)	connection attempt : 125.166.12.182 on port : tcp/1433 (MSSQL)	Port Scan
🇫🇷 Sklurk	2026-05-27 02:22:56 (1 month ago)	Web App Attack	Web App Attack
🇮🇩 hermawan	2025-09-27 11:19:54 (9 months ago)	[Sat Sep 27 18:19:22.954274 2025] [security2:error] [pid 2235525:tid 140132741965504] [client 125.16 ... show more [Sat Sep 27 18:19:22.954274 2025] [security2:error] [pid 2235525:tid 140132741965504] [client 125.166.12.182:23859] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i),.?[\\"'\\\\)0-9`-f][\\"'`](?:[\\"'`].?[\\"'`]\|(?:\\\\r?\\\\n)?\\\\z\|[^\\"'`]+)\|[^0-9A-Z_a-z]select.+[^0-9A-Z_a-z]?from\|(?:alter\|(?:(?:cre\|trunc\|upd)at\|renam)e\|d(?:e(?:lete\|sc)\|rop)\|(?:inser\|selec)t\|load)[\\\\s\\\\x0b]?\\\\([\\\\s\\\\x0b]?space[\\\\s\\\\x0b]?\\\\(" at REQUEST_HEADERS:User-Agent. [file "/etc/modsecurity/coreruleset-4.16.0/rules/REQUEST-942-APPLICATION-ATTACK-SQLI.conf"] [line "2129"] [id "942200"] [msg "Detects MySQL comment-/space-obfuscated injections and backtick termination"] [data " Matched Data ARGS charset: - Matched Data TX.1: found within Content-Type multipart form Matched Data: , like Gecko) Version/4.0 Chrome/140.0.7339.52 Mobile Safari/537.36 OcIdWebView ({\\x22os\\x22:\\x22Android\\x22, found within REQUEST_HEADERS:User-Agent: Mozilla/5.0 (Linux; Android 14; V2207 ... show less	Hacking Web App Attack
🇮🇩 hermawan	2024-09-06 16:59:24 (1 year ago)	[Fri Sep 06 23:59:21.891193 2024] [security2:error] [pid 6634:tid 135362621998784] [client 125.166.1 ... show more [Fri Sep 06 23:59:21.891193 2024] [security2:error] [pid 6634:tid 135362621998784] [client 125.166.12.182:24469] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i)(?:(?:^\|=)[\\\\s\\\\v](?:t[\\"'\\\\)\\\\[-\\\\x5c](?:(?:(?:\\\\\|\\\\\|\|&&)[\\\\s\\\\v])?\\\\$[!#\\\$\\\\\\\\-0-9\\\\?-@_a-\\\\{])?\\\\x5c?i[\\"'\\\$\\\\[-\\\\x5c](?:(?:(?:\\\\\|\\\\\|\|&&)[\\\\s\\\\v])?\\\\$[!#\\\$\\\\\\\\-0-9\\\\?-@_a-\\\\{])?\\\\x5c?m[\\"'\\\$\\\\[-\\\\x5c](?:(?:(?:\\\\\|\\\\\|\|&&)[\\\\s\\\\v]*)?\\ ..." at REQUEST_COOKIES:google-analytics_v4_0bd2___z_ga_audiences. [file "/etc/modsecurity/coreruleset-4.5.0/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "2029"] [id "932245"] [msg "Remote Command Execution: Unix Command Injection (command without evasion)"] [data "Matched Data: fd found within REQUEST_COOKIES:google-analytics_v4_0bd2___z_ga_audiences: fdbd3e1d-6a42-41b2-8ac9-63d45e27489c request_line = GET /index.php/profil/meteorologi/list-of-all-tags/prakiraan-bulanan-inde ... show less	Hacking Web App Attack
Anonymous	2024-07-24 00:01:31 (1 year ago)	Unauthorized connection attempt	Port Scan Hacking Exploited Host
🇧🇷 diego	2024-05-13 07:42:40 (2 years ago)	[rede-164-29] 05/13/2024-04:42:40.458491, 125.166.12.182, Protocol: 6, ET SCAN Suspicious inbound to ... show more [rede-164-29] 05/13/2024-04:42:40.458491, 125.166.12.182, Protocol: 6, ET SCAN Suspicious inbound to mySQL port 3306 show less	Hacking

Showing 1 to 15 of 19 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇺🇸 173.69.160.126

🇨🇳 220.197.85.225

🇸🇬 178.128.95.222

🇲🇽 177.229.197.38

🇺🇦 91.206.32.54

🇺🇸 195.184.76.207

🇳🇱 195.178.110.217

🇺🇸 172.200.228.35

🇺🇸 137.184.181.40

🇺🇸 135.237.126.99

🇧🇦 94.250.61.10

🇳🇱 178.16.54.22

🇩🇪 141.11.107.166

🇺🇸 136.112.139.133

🇫🇷 104.29.144.53

🇳🇱 91.92.40.7

🇳🇱 45.153.34.87

🇰🇪 41.89.96.242

🇺🇸 40.77.167.77

🇺🇸 18.97.26.25