JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 156.249.137.11

156.249.137.11 was found in our database!

This IP was reported 16 times. Confidence of Abuse is 0%: ?

ISP	MADEALA TELECOM TECHNOLOGY INC
Usage Type	Data Center/Web Hosting/Transit
ASN	AS35916
Domain Name	madeala.com
Country	🇹🇭 Thailand
City	Bangkok, Bangkok

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 156.249.137.11

Whois 156.249.137.11

IP Abuse Reports for 156.249.137.11:

This IP address has been reported a total of 16 times from 4 distinct sources. 156.249.137.11 was first reported on October 20th 2024, and the most recent report was 11 months ago.

Old Reports: The most recent abuse report for this IP address is from 11 months ago . It is possible that this IP is no longer involved in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
Anonymous	2025-08-06 14:08:06 (11 months ago)	Ports: 80,443; Direction: 0; Trigger: LF_CUSTOMTRIGGER	Brute-Force SSH
Anonymous	2025-07-24 15:05:29 (11 months ago)	Ports: 80,443; Direction: 0; Trigger: LF_CUSTOMTRIGGER	Brute-Force SSH
Anonymous	2025-07-01 20:23:43 (1 year ago)	Ports: 80,443; Direction: 0; Trigger: LF_CUSTOMTRIGGER	Brute-Force SSH
Anonymous	2025-05-18 05:36:09 (1 year ago)	Ports: 80,443; Direction: 0; Trigger: LF_CUSTOMTRIGGER	Brute-Force SSH
Anonymous	2025-05-02 10:45:17 (1 year ago)	Ports: 80,443; Direction: 0; Trigger: LF_CUSTOMTRIGGER	Brute-Force SSH
Anonymous	2025-04-29 15:19:34 (1 year ago)	Ports: 80,443; Direction: 0; Trigger: LF_CUSTOMTRIGGER	Brute-Force SSH
🇺🇸 TPI-Abuse	2025-04-24 07:12:25 (1 year ago)	(mod_security) mod_security (id:225170) triggered by 156.249.137.11 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:225170) triggered by 156.249.137.11 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Apr 24 03:12:20.634597 2025] [security2:error] [pid 22460:tid 22546] [client 156.249.137.11:10305] [client 156.249.137.11] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)\|\|aldexgroup.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "aldexgroup.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aAnkVGZH8n9p88FO6k9AUgAAANQ"], referer: https://www.google.com show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2025-04-18 16:05:55 (1 year ago)	(mod_security) mod_security (id:225170) triggered by 156.249.137.11 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:225170) triggered by 156.249.137.11 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Apr 18 12:05:51.328117 2025] [security2:error] [pid 16182:tid 16182] [client 156.249.137.11:25873] [client 156.249.137.11] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)\|\|wplusw.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "wplusw.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aAJ4X1JOLyWJzixO-ECFRwAAABg"], referer: https://www.google.com show less	Brute-Force Bad Web Bot Web App Attack
Anonymous	2025-04-16 00:13:18 (1 year ago)	Ports: 80,443; Direction: 0; Trigger: LF_CUSTOMTRIGGER	Brute-Force SSH
🇺🇸 TPI-Abuse	2025-04-11 17:18:03 (1 year ago)	(mod_security) mod_security (id:225170) triggered by 156.249.137.11 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:225170) triggered by 156.249.137.11 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Apr 11 13:17:57.627223 2025] [security2:error] [pid 30107:tid 30107] [client 156.249.137.11:33605] [client 156.249.137.11] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)\|\|turn-keyit.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "turn-keyit.com"] [uri "/wp-json/wp/v2/users"] [unique_id "Z_lOxdcyrCQtq_ja5Yc-9AAAAAU"], referer: https://www.google.com show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2025-04-08 17:15:40 (1 year ago)	(mod_security) mod_security (id:225170) triggered by 156.249.137.11 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:225170) triggered by 156.249.137.11 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Apr 08 13:15:35.842110 2025] [security2:error] [pid 1800419:tid 1800419] [client 156.249.137.11:28305] [client 156.249.137.11] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)\|\|daruwala.net\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "daruwala.net"] [uri "/wp-json/wp/v2/users"] [unique_id "Z_VZt4tWgGe3C4B5Dv2taQAAAA4"], referer: https://www.google.com show less	Brute-Force Bad Web Bot Web App Attack
Anonymous	2025-04-05 04:41:12 (1 year ago)	Ports: 80,443; Direction: 0; Trigger: LF_CUSTOMTRIGGER	Brute-Force SSH
🇺🇸 TPI-Abuse	2025-04-04 21:06:18 (1 year ago)	(mod_security) mod_security (id:210740) triggered by 156.249.137.11 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210740) triggered by 156.249.137.11 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Apr 04 17:06:14.486461 2025] [security2:error] [pid 14026:tid 14033] [client 156.249.137.11:51541] [client 156.249.137.11] ModSecurity: Access denied with code 403 (phase 2). Matched phrase "/Proxy-Connection/" at TX:header_name. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "33"] [id "210740"] [rev "2"] [msg "COMODO WAF: HTTP header is restricted by policy\|\|rawhabitat.com\|F\|4"] [data "/Proxy-Connection/"] [severity "WARNING"] [tag "CWAF"] [tag "HTTP"] [hostname "rawhabitat.com"] [uri "/"] [unique_id "Z_BJxtQcpMsNxpkDnbNJIgAAAAU"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2025-03-30 03:24:13 (1 year ago)	(mod_security) mod_security (id:210740) triggered by 156.249.137.11 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210740) triggered by 156.249.137.11 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Mar 29 23:24:06.055547 2025] [security2:error] [pid 1804932:tid 1804932] [client 156.249.137.11:20701] [client 156.249.137.11] ModSecurity: Access denied with code 403 (phase 2). Matched phrase "/Proxy-Connection/" at TX:header_name. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "33"] [id "210740"] [rev "2"] [msg "COMODO WAF: HTTP header is restricted by policy\|\|firejasstrio.com\|F\|4"] [data "/Proxy-Connection/"] [severity "WARNING"] [tag "CWAF"] [tag "HTTP"] [hostname "firejasstrio.com"] [uri "/"] [unique_id "Z-i5VmUnWOK5qBizFRKSwQAAACQ"] show less	Brute-Force Bad Web Bot Web App Attack
Anonymous	2024-12-29 20:20:14 (1 year ago)	Attempted brute force login to web vpn 2 time(s); last attempt for 2024.12.29 is noted in report tim ... show more Attempted brute force login to web vpn 2 time(s); last attempt for 2024.12.29 is noted in report timestamp show less	Hacking Brute-Force

Showing 1 to 15 of 16 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇲🇽 187.191.39.115

🇰🇿 185.35.223.45

🇮🇩 182.8.104.34

🇸🇬 166.108.227.82

🇭🇰 156.238.243.169

🇨🇳 114.243.111.121

🇨🇦 104.205.177.247

🇮🇳 103.160.71.221

🇮🇳 103.132.243.250

🇨🇳 101.201.63.56

🇮🇹 79.9.131.136

🇳🇱 45.148.10.141

🇭🇰 45.64.74.51

🇨🇳 8.163.8.64

🇨🇳 8.134.82.97

🇮🇱 2.55.84.240

🇨🇳 123.56.152.41

🇹🇭 117.121.212.189

🇸🇬 103.250.11.156

🇹🇷 91.228.227.142