JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

157.66.56.140

Neutral Activity

Abuse confidence score ?

0% Low Risk

26 reports

9 reporters · latest 1 year ago

ISP	Argon Data Communication
Usage Type	Fixed Line ISP
ASN	AS58477
Domain Name	argonhost.com
Country	🇮🇩 Indonesia
City	Jakarta, Jakarta

ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report Whois

No reports in the last 60 days

157.66.56.140 has been reported 26 times. The most recent report is from 1 year ago.

The full history is preserved below and remains searchable. A 0% score reflects the absence of recent activity, but this is not a guarantee that earlier reports were invalid. Abuse confidence score decays, naturally, over time, when the abusive activity stops.

IP Abuse Reports for 157.66.56.140

Export CSV

This IP address has been reported a total of 26 times from 9 distinct sources. 157.66.56.140 was first reported on April 21st 2025, and the most recent report was 1 year ago.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇮🇩 hermawan	2025-05-21 06:37:17 (1 year ago)	[Wed May 21 12:16:23.271872 2025] [security2:error] [pid 341436:tid 140661546264256] [client 157.66. ... show more [Wed May 21 12:16:23.271872 2025] [security2:error] [pid 341436:tid 140661546264256] [client 157.66.56.140:32790] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "Mozlila" at REQUEST_HEADERS:User-Agent. [file "/etc/modsecurity/coreruleset-4.14.0/rules/REQUEST-913-SCANNER-DETECTION.conf"] [line "59"] [id "913100"] [msg "Found User-Agent associated with security scanner"] [data " Matched Data ARGS charset: - Matched Data TX.1: found within Content-Type multipart form Matched Data: Mozlila found within REQUEST_HEADERS:User-Agent: Mozlila/5.0 (Linux; Android 7.0; SM-G892A Bulid/NRD90M; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/60.0.3112.107 Moblie Safari/537.36 request_line = GET /wp-content/uploads/ HTTP/1.1 Request URI RAW = /wp-content/uploads/ Request Basename = "] [severity "CRITICAL"] [ver "OWASP_CRS/4.14.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-reputation-scanner"] [tag "paranoia-level/1"] [tag ... show less	Hacking Web App Attack
🇺🇸 etu brutus	2025-05-17 11:39:35 (1 year ago)	157.66.56.140 has been banned for [WebApp Attack] ...	Hacking Bad Web Bot Web App Attack
Anonymous	2025-05-17 03:18:18 (1 year ago)	<comment>	Brute-Force Web App Attack
🇮🇩 satpam.bsn	2025-05-16 01:04:00 (1 year ago)	Alert 242254: Generic protection for php code injection 2	SQL Injection Web App Attack
🇮🇩 hermawan	2025-05-16 00:05:48 (1 year ago)	[Fri May 16 06:47:04.833306 2025] [security2:error] [pid 66605:tid 140680244491968] [client 157.66.5 ... show more [Fri May 16 06:47:04.833306 2025] [security2:error] [pid 66605:tid 140680244491968] [client 157.66.56.140:38604] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "phpunit" at REQUEST_FILENAME. [file "/etc/modsecurity/coreruleset-4.14.0/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "52"] [id "448101"] [msg "BAD REQUEST FILENAME - Detected and Blocked"] [data "Matched Data: phpunit found within REQUEST_FILENAME: /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php request_line = POST /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1"] [severity "NOTICE"] [hostname "staklim-jatim.bmkg.go.id"] [uri "/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "aCZ8-GtlMvG5FaJ5pzFoRgAAANs"] [staklim-jatim.bmkg.go.id] [staklim-jatim.bmkg.go.id] top=[66684] [zrxrSK1dgds] [aCZ8-GtlMvG5FaJ5pzFoRgAAANs] keep_alive=[0] [2025-05-16 06:47:04.833312] [R:aCZ8-GtlMvG5FaJ5pzFoRgAAANs] UA:'Mozilla/5.0 (Windows NT 10.0; Win64; x64)' Host:'staklim-jatim.bmkg.go.id' Ac ... show less	Hacking Web App Attack
Anonymous	2025-05-14 01:32:48 (1 year ago)	Aggressive web scan	Web App Attack
🇮🇩 hermawan	2025-05-12 11:01:41 (1 year ago)	[Mon May 12 17:54:32.080477 2025] [security2:error] [pid 5442:tid 140132594198208] [client 157.66.56 ... show more [Mon May 12 17:54:32.080477 2025] [security2:error] [pid 5442:tid 140132594198208] [client 157.66.56.140:60006] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp" at REQUEST_FILENAME. [file "/etc/modsecurity/coreruleset-4.14.0/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "52"] [id "448101"] [msg "BAD REQUEST FILENAME - Detected and Blocked"] [data "Matched Data: /sftp found within REQUEST_FILENAME: /sftp.json request_line = GET /sftp.json HTTP/1.1"] [severity "NOTICE"] [hostname "staklim-jatim.bmkg.go.id"] [uri "/sftp.json"] [unique_id "aCHTaOf5OWMf0rHKxgrhUgAAASA"] [staklim-jatim.bmkg.go.id] [staklim-jatim.bmkg.go.id] top=[5526] [QZ8OJDbggDg] [aCHTaOf5OWMf0rHKxgrhUgAAASA] keep_alive=[0] [2025-05-12 17:54:32.080483] [R:aCHTaOf5OWMf0rHKxgrhUgAAASA] UA:'Mozila/5.0' Host:'staklim-jatim.bmkg.go.id' ACCEPT:'/' Accept-Encoding:'gzip ... show less	Hacking Web App Attack
🇮🇩 hermawan	2025-05-11 16:12:56 (1 year ago)	[Sun May 11 23:12:24.986025 2025] [security2:error] [pid 1373974:tid 140403714008768] [client 157.66 ... show more [Sun May 11 23:12:24.986025 2025] [security2:error] [pid 1373974:tid 140403714008768] [client 157.66.56.140:56496] ModSecurity: Access denied with code 403 (phase 1). Matched phrase ".env" at REQUEST_FILENAME. [file "/etc/modsecurity/coreruleset-4.14.0/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "52"] [id "448101"] [msg "BAD REQUEST FILENAME - Detected and Blocked"] [data "Matched Data: .env found within REQUEST_FILENAME: /aws.env request_line = GET /aws.env HTTP/1.1"] [severity "NOTICE"] [hostname "staklim-jatim.bmkg.go.id"] [uri "/aws.env"] [unique_id "aCDMaHBAxFWezrQed9DzOQAAAI4"] [staklim-jatim.bmkg.go.id] [staklim-jatim.bmkg.go.id] top=[1374040] [rvAMd4ZQaPQ] [aCDMaHBAxFWezrQed9DzOQAAAI4] keep_alive=[0] [2025-05-11 23:12:24.986029] [R:aCDMaHBAxFWezrQed9DzOQAAAI4] UA:'Mozila/5.0' Host:'staklim-jatim.bmkg.go.id' ACCEPT:'/' Accept-Encoding:'gzip ... show less	Hacking Web App Attack
🇮🇩 Ridwan Na'im	2025-05-10 01:10:24 (1 year ago)	Possible unauthorized access attempt to WordPress admin - Password Guessing	Hacking Web App Attack
🇮🇩 aaKenshin	2025-05-09 22:50:48 (1 year ago)	Suspicious activity detected from IP 157.66.56.140 based on web server logs. Sample logs: [cloud] 1 ... show more Suspicious activity detected from IP 157.66.56.140 based on web server logs. Sample logs: [cloud] 157.66.56.140 - [04/May/2025:01:55:29 +0800] "GET /info.php HTTP/1.1" 404 47 "-" "Mozilla/5.0 (iPad; CPU OS 7_1_1 like Mac OS X) AppleWebKit/537.51.2 (KHTML, like Gecko) Version/7.0 Mobile/11D201 Safari/9537.53" "-" [cloud] 157.66.56.140 - [04/May/2025:01:55:39 +0800] "GET /.vscode/sftp.json HTTP/1.1" 404 183 "-" "Mozilla/5.0 (iPad; CPU OS 7_1_1 like Mac OS X) AppleWebKit/537.51.2 (KHTML, like Gecko) Version/7.0 Mobile/11D201 Safari/9537.53" "-" [cloud] 157.66.56.140 - [04/May/2025:01:55:49 +0800] "GET /sftp-config.json HTTP/1.1" 404 183 "-" "Mozilla/5.0 (iPad; CPU OS 7_1_1 like Mac OS X) AppleWebKit/537.51.2 (KHTML, like Gecko) Version/7.0 Mobile/11D201 Safari/9537.53" "-" Reported automatically by fail2ban service. show less	Hacking
🇮🇩 hermawan	2025-05-09 07:10:09 (1 year ago)	[Fri May 09 14:08:38.131827 2025] [security2:error] [pid 723080:tid 140164949063360] [client 157.66. ... show more [Fri May 09 14:08:38.131827 2025] [security2:error] [pid 723080:tid 140164949063360] [client 157.66.56.140:37537] ModSecurity: Access denied with code 403 (phase 1). Match of "pm AppleWebKit Android" against "REQUEST_HEADERS:User-Agent" required. [file "/etc/modsecurity/coreruleset-4.14.0/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "2731"] [id "920300"] [msg "Request Missing an Accept Header"] [data " Matched Data ARGS charset: - Matched Data TX.1: found within Content-Type multipart form Matched Data: accept-encoding found within REQUEST_HEADERS:User-Agent: Mozila/5.0 request_line = GET / HTTP/1.1 Request URI RAW = / Request Basename = "] [severity "NOTICE"] [ver "OWASP_CRS/4.14.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/3"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "staklim-jatim.bmkg.go.id"] [uri "/"] [unique_id "aB2p9iUewyGgI ... show less	Hacking Web App Attack
🇦🇺 Burayot	2025-05-06 17:04:36 (1 year ago)	LF_MODSEC: (mod_security) mod_security (id:949110) triggered by 157.66.56.140 (ID/Indonesia/-): 2 in ... show more LF_MODSEC: (mod_security) mod_security (id:949110) triggered by 157.66.56.140 (ID/Indonesia/-): 2 in the last 3600 secs show less	Web App Attack
🇮🇩 Ridwan Na'im	2025-05-06 00:49:45 (1 year ago)	Multiple web server 400 error codes from same source ip. - Vulnerability Scanning	Hacking Web App Attack
🇮🇩 hermawan	2025-05-05 19:57:42 (1 year ago)	[Tue May 06 02:56:56.852492 2025] [security2:error] [pid 1065338:tid 139974614976192] [client 157.66 ... show more [Tue May 06 02:56:56.852492 2025] [security2:error] [pid 1065338:tid 139974614976192] [client 157.66.56.140:40012] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp" at REQUEST_FILENAME. [file "/etc/modsecurity/coreruleset-4.13.0/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "52"] [id "448101"] [msg "BAD REQUEST FILENAME - Detected and Blocked"] [data "Matched Data: /sftp found within REQUEST_FILENAME: /sftp.json request_line = GET /sftp.json HTTP/1.1"] [severity "NOTICE"] [hostname "staklim-jatim.bmkg.go.id"] [uri "/sftp.json"] [unique_id "aBkYCF3aj4ykjd5PU2pgNAAAAAU"] [staklim-jatim.bmkg.go.id] [staklim-jatim.bmkg.go.id] top=[1065395] [sw795lDQkp8] [aBkYCF3aj4ykjd5PU2pgNAAAAAU] keep_alive=[0] [2025-05-06 02:56:56.852495] [R:aBkYCF3aj4ykjd5PU2pgNAAAAAU] UA:'Mozila/5.0' Host:'staklim-jatim.bmkg.go.id' ACCEPT:'/' Accept-Encoding:'gzip ... show less	Hacking Web App Attack
🇮🇩 hermawan	2025-05-03 00:16:57 (1 year ago)	[Sat May 03 07:16:57.003850 2025] [security2:error] [pid 276722:tid 140283001947840] [client 157.66. ... show more [Sat May 03 07:16:57.003850 2025] [security2:error] [pid 276722:tid 140283001947840] [client 157.66.56.140:41854] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/info.php" at REQUEST_FILENAME. [file "/etc/modsecurity/coreruleset-4.13.0/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "52"] [id "448101"] [msg "BAD REQUEST FILENAME - Detected and Blocked"] [data "Matched Data: /info.php found within REQUEST_FILENAME: /info.php request_line = GET /info.php HTTP/1.1"] [severity "NOTICE"] [hostname "staklim-jatim.bmkg.go.id"] [uri "/info.php"] [unique_id "aBVgecunNE82vBzj-mICswAAAA0"] [staklim-jatim.bmkg.go.id] [staklim-jatim.bmkg.go.id] top=[276787] [YVlOLyjUolY] [aBVgecunNE82vBzj-mICswAAAA0] keep_alive=[0] [2025-05-03 07:16:57.003856] [R:aBVgecunNE82vBzj-mICswAAAA0] UA:'Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.2)' Host:' ... show less	Hacking Web App Attack

Showing 1 to 15 of 26 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇺🇸 154.16.112.232

🇺🇸 129.121.115.119

🇩🇪 109.160.32.126

🇵🇭 49.149.198.35

🇳🇱 213.124.221.2

🇲🇦 196.217.125.172

🇳🇱 185.224.128.16

🇫🇮 147.185.133.86

🇧🇩 118.179.183.119

🇺🇸 72.240.125.133

🇺🇸 66.240.192.82

🇺🇸 64.207.225.55

🇺🇸 54.225.181.161

🇳🇱 5.188.86.237

🇧🇷 177.121.136.86

🇭🇰 152.32.216.247

🇹🇭 147.50.227.79

🇮🇳 125.19.218.50

🇱🇰 112.135.214.89

🇫🇷 104.23.225.54