JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 156.249.138.157

156.249.138.157 was found in our database!

This IP was reported 28 times. Confidence of Abuse is 0%: ?

ISP	Cloud Innovation Ltd
Usage Type	Data Center/Web Hosting/Transit
ASN	AS35916
Domain Name	cloudinnovation.org
Country	🇹🇭 Thailand
City	Bangkok, Bangkok

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 156.249.138.157

Whois 156.249.138.157

IP Abuse Reports for 156.249.138.157:

This IP address has been reported a total of 28 times from 16 distinct sources. 156.249.138.157 was first reported on October 15th 2024, and the most recent report was 9 months ago.

Old Reports: The most recent abuse report for this IP address is from 9 months ago . It is possible that this IP is no longer involved in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
Anonymous	2025-09-15 14:58:30 (9 months ago)	wordpress-trap	Web App Attack
🇧🇪 voormedia	2025-08-29 14:28:29 (9 months ago)	Accessed trap at '/+CSCOE+/logon.html'	Web App Attack
🇩🇪 Carsten	2025-08-28 16:21:58 (9 months ago)	GET [index.php?inhalt=impressum&inhalt=%27]	Port Scan
🇩🇪 london2038.com	2025-08-20 14:40:16 (10 months ago)	Malformed or malicious web request 156.249.138.157 - - [20/Aug/2025:16:40:12 +0200] "GET /c/hellgate ... show more Malformed or malicious web request 156.249.138.157 - - [20/Aug/2025:16:40:12 +0200] "GET /c/hellgate-london/8?no_subcategories=%27&page=%27 HTTP/1.1" 400 12237 "-" "Mozilla/5.0 (Linux; Android 9; ASUS_I005DA Build/PI; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/133.0.6943.122 Mobile" show less	Hacking Web App Attack
Anonymous	2025-07-24 22:37:16 (11 months ago)	XMLRPC Hack Attempts	Hacking Brute-Force
Anonymous	2025-07-24 07:54:33 (11 months ago)	Ports: 80,443; Direction: 0; Trigger: LF_CUSTOMTRIGGER	Brute-Force SSH
🇵🇱 sefinek.net	2025-07-22 23:34:07 (11 months ago)	Triggered Cloudflare WAF (firewallCustom) from DE. Action taken: MANAGED_CHALLENGE Protocol: HTTP/1. ... show more Triggered Cloudflare WAF (firewallCustom) from DE. Action taken: MANAGED_CHALLENGE Protocol: HTTP/1.1 (GET method) Endpoint: /genshin-stella-mod UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:114.0) Gecko/20100101 Firefox/114.0 This report was generated by: https://github.com/sefinek/Cloudflare-WAF-To-AbuseIPDB show less	Bad Web Bot
🇵🇱 sefinek.net	2025-07-04 06:08:15 (11 months ago)	Triggered Cloudflare WAF (firewallCustom) from DE. Action taken: MANAGED_CHALLENGE Protocol: HTTP/1. ... show more Triggered Cloudflare WAF (firewallCustom) from DE. Action taken: MANAGED_CHALLENGE Protocol: HTTP/1.1 (GET method) Endpoint: / UA: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36 This report was generated by: https://github.com/sefinek/Cloudflare-WAF-To-AbuseIPDB show less	Bad Web Bot
🇵🇱 sefinek.net	2025-07-01 06:32:09 (11 months ago)	Triggered Cloudflare WAF (firewallCustom) from DE. Action taken: MANAGED_CHALLENGE Protocol: HTTP/1. ... show more Triggered Cloudflare WAF (firewallCustom) from DE. Action taken: MANAGED_CHALLENGE Protocol: HTTP/1.1 (GET method) Endpoint: / UA: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36 Vivaldi/5.3.2679.68 This report was generated by: https://github.com/sefinek/Cloudflare-WAF-To-AbuseIPDB show less	Bad Web Bot
Anonymous	2025-06-30 06:15:33 (11 months ago)	Ports: 80,443; Direction: 0; Trigger: LF_CUSTOMTRIGGER	Brute-Force SSH
🇺🇸 TPI-Abuse	2025-06-18 23:50:46 (1 year ago)	(mod_security) mod_security (id:225170) triggered by 156.249.138.157 (-): 1 in the last 300 secs; Po ... show more (mod_security) mod_security (id:225170) triggered by 156.249.138.157 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jun 18 19:50:38.721291 2025] [security2:error] [pid 2619536:tid 2619536] [client 156.249.138.157:45823] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)\|\|magacine.tv\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "magacine.tv"] [uri "/wp-json/wp/v2/users"] [unique_id "aFNQzgMkpUd5E0_FIHYpyQAAAAY"] show less	Brute-Force Bad Web Bot Web App Attack
🇨🇭 backslash	2025-06-07 20:15:03 (1 year ago)	block ruleset bad bot: wordpress scans 82C095539D4FDAF84E2E2FD6B6FC0664645851A8	Bad Web Bot
🇮🇩 Burayot	2025-05-29 19:18:53 (1 year ago)	LF_MODSEC: (mod_security) mod_security (id:1000001) triggered by 156.249.138.157 (TH/Thailand/-): 1 ... show more LF_MODSEC: (mod_security) mod_security (id:1000001) triggered by 156.249.138.157 (TH/Thailand/-): 1 in the last 3600 secs show less	Web App Attack
🇩🇪 kernel-error.de	2025-05-17 03:33:14 (1 year ago)	::ffff:156.249.138.157 - - [17/May/2025:05:33:09 +0200] "POST /xmlrpc.php HTTP/1.1" 403 227 "-" "Apa ... show more ::ffff:156.249.138.157 - - [17/May/2025:05:33:09 +0200] "POST /xmlrpc.php HTTP/1.1" 403 227 "-" "Apache-HttpClient/4.5.13 (Java/11.0.26)" ::ffff:156.249.138.157 - - [17/May/2025:05:33:11 +0200] "POST /xmlrpc.php HTTP/1.1" 403 227 "-" "Apache-HttpClient/4.5.13 (Java/11.0.26)" ::ffff:156.249.138.157 - - [17/May/2025:05:33:12 +0200] "POST /xmlrpc.php HTTP/1.1" 403 227 "-" "Apache-HttpClient/4.5.13 (Java/11.0.26)" ... show less	Brute-Force Web App Attack
🇺🇸 TPI-Abuse	2025-05-16 13:39:05 (1 year ago)	(mod_security) mod_security (id:225170) triggered by 156.249.138.157 (-): 1 in the last 300 secs; Po ... show more (mod_security) mod_security (id:225170) triggered by 156.249.138.157 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri May 16 09:39:00.194654 2025] [security2:error] [pid 3859492:tid 3859492] [client 156.249.138.157:12391] [client 156.249.138.157] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)\|\|gulftelecom.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "gulftelecom.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aCc_9K1Vj22Hjzne25rpvwAAAAY"], referer: https://www.google.com show less	Brute-Force Bad Web Bot Web App Attack

Showing 1 to 15 of 28 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇿🇦 197.184.176.160

🇧🇷 186.219.162.154

🇺🇸 173.28.121.213

🇯🇵 168.138.213.115

🇹🇼 125.230.235.233

🇵🇱 89.144.32.126

🇫🇷 85.217.140.13

🇩🇪 69.5.169.169

🇩🇪 43.228.157.10

🇯🇵 43.133.220.37

🇳🇱 192.253.248.169

🇨🇦 135.136.41.16

🇺🇸 104.196.168.220

🇳🇱 92.63.197.5

🇺🇸 81.30.98.225

🇺🇸 68.186.179.143

🇫🇮 45.87.249.146

🇮🇩 36.95.221.140

🇮🇩 2406:da19:776:6e01:5c0:9c1d:3594:5ddb

🇨🇳 218.0.56.78