JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 125.166.79.28

125.166.79.28 was found in our database!

This IP was reported 62 times. Confidence of Abuse is 0%: ?

ISP	PT TELKOM INDONESIA
Usage Type	Fixed Line ISP
ASN	AS7713
Domain Name	telkom.co.id
Country	🇮🇩 Indonesia
City	Jakarta, Jakarta

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 125.166.79.28

Whois 125.166.79.28

IP Abuse Reports for 125.166.79.28:

This IP address has been reported a total of 62 times from 29 distinct sources. 125.166.79.28 was first reported on November 30th 2024, and the most recent report was 1 year ago.

Old Reports: The most recent abuse report for this IP address is from 1 year ago . It is possible that this IP is no longer involved in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇧🇪 cmbplf	2024-12-06 15:25:45 (1 year ago)	153 requests to /phpinfo.php 118 requests to *.env	Brute-Force Bad Web Bot
🇸🇬 Charles	2024-12-06 14:32:06 (1 year ago)	125.166.79.28 - - [06/Dec/2024:22:32:04 +0800] "GET //.env HTTP/1.1" 404 2105 "-" "Mozilla/5.0 (Wind ... show more 125.166.79.28 - - [06/Dec/2024:22:32:04 +0800] "GET //.env HTTP/1.1" 404 2105 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.135 Safari/537.36 Edge/12.246" ... show less	Web Spam Email Spam Brute-Force Bad Web Bot Web App Attack SSH
Anonymous	2024-12-06 09:53:58 (1 year ago)	fail2ban apache-modsecurity web [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [uri "/"]	Web App Attack
🇩🇪 FeG Deutschland	2024-12-05 20:47:47 (1 year ago)	Looking for CMS/PHP/SQL vulnerablilities - 137	Exploited Host Web App Attack
🇦🇹 services.org.pl	2024-12-05 19:26:09 (1 year ago)	open() "/var/www/html/phpinfo" failed (2: No such file or directory), client: 125.166.79.28, server: ... show more open() "/var/www/html/phpinfo" failed (2: No such file or directory), client: 125.166.79.28, server: web.services.org.pl, request: "GET /phpinfo HTTP/1.1", host: "web.services.org.pl" show less	Bad Web Bot Web App Attack
🇦🇺 weblite	2024-12-05 17:57:44 (1 year ago)	WP_EXPLOIT_PROBE WP_MALWARE_PROBE	Hacking Web App Attack
🇺🇸 Anthony Trimble	2024-12-05 06:51:33 (1 year ago)	Probe for vulnerabilities. Path attempted: /phpinfo	Web App Attack
🇩🇪 vtibi	2024-12-04 19:52:51 (1 year ago)	125.166.79.28 - - [04/Dec/2024:20:52:50 +0100] "GET /phpinfo HTTP/1.1" 404 418 "-" "Mozilla/5.0 (Win ... show more 125.166.79.28 - - [04/Dec/2024:20:52:50 +0100] "GET /phpinfo HTTP/1.1" 404 418 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.135 Safari/537.36 Edge/12.246" 125.166.79.28 - - [04/Dec/2024:20:52:50 +0100] "GET /php_info HTTP/1.1" 404 418 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.135 Safari/537.36 Edge/12.246" 125.166.79.28 - - [04/Dec/2024:20:52:50 +0100] "GET //.env HTTP/1.1" 404 418 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.135 Safari/537.36 Edge/12.246" 125.166.79.28 - - [04/Dec/2024:20:52:50 +0100] "GET //_profiler/phpinfo HTTP/1.1" 404 418 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.135 Safari/537.36 Edge/12.246" ... show less	Web App Attack
🇳🇱 Joop	2024-12-04 15:40:40 (1 year ago)	2024-12-04 16:40:37 +0200 s39 /_profiler/php	Web App Attack
Anonymous	2024-12-04 05:42:24 (1 year ago)	fail2ban apache-modsecurity web [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [uri "/"]	Web App Attack
🇺🇸 TPI-Abuse	2024-12-04 04:29:51 (1 year ago)	(mod_security) mod_security (id:210492) triggered by 125.166.79.28 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:210492) triggered by 125.166.79.28 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Dec 03 23:29:38.750498 2024] [security2:error] [pid 12497:tid 12497] [client 125.166.79.28:58696] [client 125.166.79.28] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpcontacts.powerlinemagazine.com"] [uri "/.env"] [unique_id "Z0_asu3DwuntI19ChCg7gwAAAAU"] show less	Brute-Force Bad Web Bot Web App Attack
🇳🇱 BlueWire Hosting	2024-12-03 21:10:07 (1 year ago)	Scanning for Laravel vulnerabilities	Web App Attack
🇺🇸 PlexLads	2024-12-03 21:02:17 (1 year ago)	125.166.79.28 - - [03/Dec/2024:13:02:14 -0800] "GET / HTTP/1.1" 401 4119 "-" "Mozilla/5.0 (Windows N ... show more 125.166.79.28 - - [03/Dec/2024:13:02:14 -0800] "GET / HTTP/1.1" 401 4119 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.135 Safari/537.36 Edge/12.246" 125.166.79.28 - - [03/Dec/2024:13:02:14 -0800] "GET /phpinfo HTTP/1.1" 401 622 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.135 Safari/537.36 Edge/12.246" 125.166.79.28 - - [03/Dec/2024:13:02:15 -0800] "GET /php_info HTTP/1.1" 401 622 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.135 Safari/537.36 Edge/12.246" 125.166.79.28 - - [03/Dec/2024:13:02:15 -0800] "GET //.env HTTP/1.1" 401 622 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.135 Safari/537.36 Edge/12.246" 125.166.79.28 - - [03/Dec/2024:13:02:15 -0800] "GET //_profiler/phpinfo HTTP/1.1" 401 622 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 ... show less	Hacking Web App Attack
🇺🇸 TPI-Abuse	2024-12-03 20:54:27 (1 year ago)	(mod_security) mod_security (id:210492) triggered by 125.166.79.28 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:210492) triggered by 125.166.79.28 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Dec 03 15:54:16.293663 2024] [security2:error] [pid 3475:tid 3475] [client 125.166.79.28:62283] [client 125.166.79.28] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "adlynture.michaelsabbey.org"] [uri "/.env"] [unique_id "Z09v-E0-CfDLzv_1k1SCwQAAAAc"] show less	Brute-Force Bad Web Bot Web App Attack
Anonymous	2024-12-03 18:09:21 (1 year ago)	Restricted File Access Requests	Hacking Brute-Force

Showing 1 to 15 of 62 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇺🇸 204.8.96.175

🇩🇪 43.228.157.8

🇰🇷 43.202.111.159

🇺🇸 20.84.23.222

🇺🇸 172.170.254.20

🇺🇸 172.71.194.250

🇹🇭 118.193.57.121

🇺🇸 104.168.60.41

🇵🇭 103.72.59.3

🇨🇳 27.18.58.202

🇺🇸 2602:80d:1007::b3

🇮🇳 203.145.143.163

🇺🇸 162.243.173.120

🇺🇸 142.147.252.145

🇳🇱 77.239.124.247

🇺🇸 45.56.72.85

🇬🇧 35.203.211.147

🇧🇩 103.177.150.147

🇺🇸 52.34.113.139

🇱🇹 45.227.254.170