JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 140.213.128.69

140.213.128.69 was found in our database!

This IP was reported 8 times. Confidence of Abuse is 18%: ?

18%

ISP	PT XLSMART Telecom Sejahtera Tbk
Usage Type	Mobile ISP
ASN	AS24203
Domain Name	xl.co.id
Country	🇮🇩 Indonesia
City	Jakarta, Jakarta

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 140.213.128.69

Whois 140.213.128.69

IP Abuse Reports for 140.213.128.69:

This IP address has been reported a total of 8 times from 4 distinct sources. 140.213.128.69 was first reported on May 27th 2024, and the most recent report was 1 hour ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇮🇩 sockominfo	2026-09-02 08:01:02 (1 hour ago)	User access to sensitive menu from bad reputation IP 140.213.128.69.. Threat Score: 8.7/10 (CRITICAL ... show more User access to sensitive menu from bad reputation IP 140.213.128.69.. Threat Score: 8.7/10 (CRITICAL). Confidence: 70%. CVSS v3.1: 10/10 (Critical). CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H. Bayesian Probability: 87%. MITRE ATT&CK: T1566 (Phishing). Tactic: TA0001. Freshness: Fresh. Source Reputation: KNOWN_MALICIOUS. Methodology: CVSS 3.1 + Bayesian + Temporal + Environmental + MITRE ATT&CK + OWASP. Standards: ISO/IEC 27065:2022, NIST SP 800-30, IEEE S&P 2020. Reported by TangerangKota-CSIRT. Status: MALICIOUS show less	Hacking Web App Attack
🇮🇩 sockominfo	2026-09-02 07:00:33 (2 hours ago)	Reported by TangerangKota-CSIRT. Status: MALICIOUS	Hacking Web App Attack
🇮🇩 sockominfo	2026-09-02 06:00:09 (3 hours ago)	User access to sensitive menu from bad reputation IP 140.213.128.69.. Threat Score: 7.7/10 (HIGH). R ... show more User access to sensitive menu from bad reputation IP 140.213.128.69.. Threat Score: 7.7/10 (HIGH). Reported by TangerangKota-CSIRT. Status: MALICIOUS show less	Hacking Web App Attack
🇮🇩 sockominfo	2026-08-21 14:00:57 (1 week ago)	User login to application from malicious IP 140.213.128.69.. Threat Score: 3.9/10 (LOW). Confidence: ... show more User login to application from malicious IP 140.213.128.69.. Threat Score: 3.9/10 (LOW). Confidence: 30%. CVSS v3.1: 0/10 (None). CVSS Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:N. Bayesian Probability: 40%. MITRE ATT&CK: T1016 (System Network Configuration Discovery). Tactic: TA0001. Freshness: Very Fresh. Source Reputation: UNKNOWN. Methodology: CVSS 3.1 + Bayesian + Temporal + Environmental + MITRE ATT&CK + OWASP. Standards: ISO/IEC 27065:2022, NIST SP 800-30, IEEE S&P 2020. Reported by TangerangKota-CSIRT show less	Hacking Web App Attack
🇩🇪 ghostwarriors	2026-08-15 02:50:13 (2 weeks ago)	Webpage scraping	Brute-Force Bad Web Bot Web App Attack
🇩🇪 FD-IX	2026-08-15 02:32:17 (2 weeks ago)	Brute-force login attack detected by WordPress firewall.	Brute-Force Web App Attack
🇮🇩 hermawan	2025-08-04 03:02:29 (1 year ago)	[Mon Aug 04 10:01:43.269075 2025] [security2:error] [pid 971280:tid 140161055659712] [client 140.213 ... show more [Mon Aug 04 10:01:43.269075 2025] [security2:error] [pid 971280:tid 140161055659712] [client 140.213.128.69:41125] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i),.?[\\"'\\\\)0-9`-f][\\"'`](?:[\\"'`].?[\\"'`]\|(?:\\\\r?\\\\n)?\\\\z\|[^\\"'`]+)\|[^0-9A-Z_a-z]select.+[^0-9A-Z_a-z]?from\|(?:alter\|(?:(?:cre\|trunc\|upd)at\|renam)e\|d(?:e(?:lete\|sc)\|rop)\|(?:inser\|selec)t\|load)[\\\\s\\\\x0b]?\\\\([\\\\s\\\\x0b]?space[\\\\s\\\\x0b]?\\\\(" at REQUEST_HEADERS:User-Agent. [file "/etc/modsecurity/coreruleset-4.16.0/rules/REQUEST-942-APPLICATION-ATTACK-SQLI.conf"] [line "2129"] [id "942200"] [msg "Detects MySQL comment-/space-obfuscated injections and backtick termination"] [data " Matched Data ARGS charset: - Matched Data TX.1: found within Content-Type multipart form Matched Data: , like Gecko) Version/4.0 Chrome/138.0.7204.157 Mobile Safari/537.36 OcIdWebView ({\\x22os\\x22:\\x22Android\\x22, found within REQUEST_HEADERS:User-Agent: Mozilla/5.0 (Linux; Android 9; SM-A105 ... show less	Hacking Web App Attack
🇮🇩 hermawan	2024-05-27 04:43:34 (2 years ago)	[Mon May 27 11:38:32.043213 2024] [security2:error] [pid 1549400:tid 125211426948672] [client 140.21 ... show more [Mon May 27 11:38:32.043213 2024] [security2:error] [pid 1549400:tid 125211426948672] [client 140.213.128.69:64241] [client 140.213.128.69] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i),.?[\\"'\\\\)0-9`-f][\\"'`](?:[\\"'`].?[\\"'`]\|(?:\\\\r?\\\\n)?\\\\z\|[^\\"'`]+)\|[^0-9A-Z_a-z]select.+[^0-9A-Z_a-z]?from\|(?:alter\|(?:(?:cre\|trunc\|upd)at\|renam)e\|d(?:e(?:lete\|sc)\|rop)\|(?:inser\|selec)t\|load)[\\\\s\\\\v]?\\\\([\\\\s\\\\v]?space[\\\\s\\\\v]?\\\\(" at REQUEST_HEADERS:User-Agent. [file "/etc/modsecurity/coreruleset-4.0.0/rules/REQUEST-942-APPLICATION-ATTACK-SQLI.conf"] [line "2109"] [id "942200"] [msg "Detects MySQL comment-/space-obfuscated injections and backtick termination"] [data "Matched Data: , like Gecko) Version/4.0 Chrome/124.0.6367.180 Mobile Safari/537.36 OcIdWebView ({\\x22os\\x22:\\x22Android\\x22, found within REQUEST_HEADERS:User-Agent: Mozilla/5.0 (Linux; Android 11; Redmi Note 8 Build/RKQ1.201004.002; wv) AppleWebKit/537.36 (KHTML, like Gecko) V ... show less	Hacking Web App Attack

Showing 1 to 8 of 8 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇬🇾 190.80.90.243

🇺🇸 162.216.149.75

🇳🇱 160.119.76.35

🇮🇳 152.58.7.95

🇫🇮 147.185.133.13

🇷🇴 92.118.39.49

🇺🇸 72.217.109.13

🇬🇧 217.146.80.122

🇺🇸 216.25.89.65

🇺🇸 164.92.106.15

🇮🇹 82.84.168.211

🇺🇸 45.156.129.67

🇻🇪 38.224.158.71

🇬🇧 35.203.210.72

🇫🇷 2400:cb00:727:1000:600d:8d99:5bda:4bd0

🇧🇪 198.235.24.197

🇬🇧 195.206.182.216

🇺🇸 195.184.76.222

🇺🇸 172.248.177.222

🇰🇷 121.142.200.226