JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 157.85.209.118

157.85.209.118 was found in our database!

This IP was reported 35 times. Confidence of Abuse is 83%: ?

83%

ISP	PT XLSMART Telecom Sejahtera, TBK
Usage Type	Fixed Line ISP
ASN	AS139994
Domain Name	xlsmart.co.id
Country	🇮🇩 Indonesia
City	Soreang, West Java

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 157.85.209.118

Whois 157.85.209.118

IP Abuse Reports for 157.85.209.118:

This IP address has been reported a total of 35 times from 22 distinct sources. 157.85.209.118 was first reported on November 8th 2025, and the most recent report was 4 days ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇦🇺 screwlooseit.com.au	2026-06-27 03:19:31 (4 days ago)	Blocked by CSF 13 firewall - Rule: XMLRPC AU/Australia/-	Web App Attack
🇺🇸 WeekendWeb	2026-06-27 01:02:44 (4 days ago)	Wordpress Vunerability attack	Web App Attack
🇩🇪 rh24	2026-06-27 01:02:18 (4 days ago)	(xmlrpc_405) XMLRPC-Bot 405 157.85.209.118 (ID/Indonesia/-)	Hacking
🇺🇸 TPI-Abuse	2026-06-26 15:46:24 (5 days ago)	(mod_security) mod_security (id:240335) triggered by 157.85.209.118 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:240335) triggered by 157.85.209.118 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jun 26 11:46:18.294325 2026] [security2:error] [pid 1776:tid 1776] [client 157.85.209.118:19757] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 157.85.209.118 (+1 hits since last alert)\|geodogs.org\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "geodogs.org"] [uri "/xmlrpc.php"] [unique_id "aj6eynd94-DzsLAbNieGUgAAABE"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-06-26 15:23:09 (5 days ago)	(mod_security) mod_security (id:240335) triggered by 157.85.209.118 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:240335) triggered by 157.85.209.118 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jun 26 11:23:05.013619 2026] [security2:error] [pid 11870:tid 11870] [client 157.85.209.118:16835] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 157.85.209.118 (+1 hits since last alert)\|j3pr.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "j3pr.com"] [uri "/xmlrpc.php"] [unique_id "aj6ZWYhSbU3HECCvQo1ZXgAAAAk"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-06-26 12:01:57 (5 days ago)	(mod_security) mod_security (id:240335) triggered by 157.85.209.118 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:240335) triggered by 157.85.209.118 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jun 26 08:01:54.298015 2026] [security2:error] [pid 28680:tid 28680] [client 157.85.209.118:24303] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 157.85.209.118 (+1 hits since last alert)\|vintageamptubes.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "vintageamptubes.com"] [uri "/xmlrpc.php"] [unique_id "aj5qMpz6IvwqZ4OLlz_rzAAAABY"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-06-26 09:26:02 (5 days ago)	(mod_security) mod_security (id:240335) triggered by 157.85.209.118 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:240335) triggered by 157.85.209.118 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jun 26 05:25:53.966687 2026] [security2:error] [pid 11385:tid 11539] [client 157.85.209.118:13186] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 157.85.209.118 (+1 hits since last alert)\|campingcosmetics.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "campingcosmetics.com"] [uri "/xmlrpc.php"] [unique_id "aj5FoWf-KJ-D7ykFpnffqQAAAgY"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-06-26 08:59:23 (5 days ago)	(mod_security) mod_security (id:240335) triggered by 157.85.209.118 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:240335) triggered by 157.85.209.118 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jun 26 04:59:16.458644 2026] [security2:error] [pid 21769:tid 21769] [client 157.85.209.118:19721] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 157.85.209.118 (+1 hits since last alert)\|pleaseaddbacon.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "pleaseaddbacon.com"] [uri "/xmlrpc.php"] [unique_id "aj4_ZDc6HDLwSMOldwnxLAAAABY"] show less	Brute-Force Bad Web Bot Web App Attack
🇫🇷 masterguru	2026-06-26 08:57:45 (5 days ago)	xmlrpc request blocked, no referer. Pattern match "xmlrpc.php" at REQUEST_URI. (88010-201)	Hacking
🇺🇸 TPI-Abuse	2026-06-26 05:52:21 (5 days ago)	(mod_security) mod_security (id:240335) triggered by 157.85.209.118 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:240335) triggered by 157.85.209.118 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jun 26 01:52:13.461216 2026] [security2:error] [pid 26774:tid 26774] [client 157.85.209.118:19376] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 157.85.209.118 (+1 hits since last alert)\|internetnameregistration.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "internetnameregistration.com"] [uri "/xmlrpc.php"] [unique_id "aj4TjRsWbW5wKTS6vPj-aAAAAA8"] show less	Brute-Force Bad Web Bot Web App Attack
🇪🇸 masterguru	2026-06-26 05:49:46 (5 days ago)	(xmlrpc) Failed xmlrpc access from 157.85.209.118 (ID/Indonesia/-): 5 in the last 3600 secs (0-122)	Hacking
🇺🇸 TPI-Abuse	2026-06-26 04:35:24 (5 days ago)	(mod_security) mod_security (id:240335) triggered by 157.85.209.118 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:240335) triggered by 157.85.209.118 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jun 26 00:35:17.642017 2026] [security2:error] [pid 27743:tid 27743] [client 157.85.209.118:20032] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 157.85.209.118 (+1 hits since last alert)\|loriarsenault.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "loriarsenault.com"] [uri "/xmlrpc.php"] [unique_id "aj4BhQmYiULJKkdKBuGZcwAAAAg"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-06-25 12:21:12 (6 days ago)	(mod_security) mod_security (id:240335) triggered by 157.85.209.118 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:240335) triggered by 157.85.209.118 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jun 25 08:21:06.876034 2026] [security2:error] [pid 14349:tid 14349] [client 157.85.209.118:42892] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 157.85.209.118 (+1 hits since last alert)\|desertautoworks.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "desertautoworks.com"] [uri "/xmlrpc.php"] [unique_id "aj0dMgviriVu6ZrHeDQ6UwAAAAM"] show less	Brute-Force Bad Web Bot Web App Attack
🇫🇷 dynamix	2026-06-25 08:57:59 (6 days ago)	WordPress XMLRPC Brute Force Attack	Brute-Force Web App Attack
Anonymous	2026-06-25 07:45:40 (6 days ago)	157.85.209.118 - - [25/Jun/2026:09:45:18 +0200] "POST /xmlrpc.php HTTP/1.1" 200 593 "-" "Jetpack by ... show more 157.85.209.118 - - [25/Jun/2026:09:45:18 +0200] "POST /xmlrpc.php HTTP/1.1" 200 593 "-" "Jetpack by WordPress.com" 157.85.209.118 - - [25/Jun/2026:09:45:20 +0200] "POST /xmlrpc.php HTTP/1.1" 200 403 "-" "Jetpack by WordPress.com" 157.85.209.118 - - [25/Jun/2026:09:45:28 +0200] "POST /xmlrpc.php HTTP/1.1" 200 593 "-" "Jetpack by WordPress.com (Jetpack 12.0; WordPress 6.2)" 157.85.209.118 - - [25/Jun/2026:09:45:30 +0200] "POST /xmlrpc.php HTTP/1.1" 200 403 "-" "Jetpack by WordPress.com (Jetpack 12.0; WordPress 6.2)" 157.85.209.118 - - [25/Jun/2026:09:45:38 +0200] "POST /xmlrpc.php HTTP/1.1" 200 593 "-" "Jetpack by WordPress.com (Jetpack 12.1; WordPress 6.3)" ... show less	Brute-Force Web App Attack

Showing 1 to 15 of 35 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇹🇭 58.10.169.128

🇦🇪 5.38.9.232

🇺🇸 3.101.153.151

🇺🇸 209.145.54.172

🇩🇪 194.88.98.126

🇺🇸 173.255.223.89

🇺🇸 153.76.19.128

🇺🇸 153.76.17.16

🇺🇸 153.76.12.113

🇺🇸 153.76.9.28

🇺🇸 152.32.235.160

🇨🇳 113.123.254.115

🇭🇰 65.181.88.245

🇨🇳 60.208.125.156

🇹🇭 49.229.202.154

🇹🇭 49.229.192.161

🇵🇭 49.144.44.46

🇸🇰 46.229.238.131

🇺🇸 23.29.118.224

🇦🇪 5.193.38.214