JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 157.85.211.145

157.85.211.145 was found in our database!

This IP was reported 22 times. Confidence of Abuse is 40%: ?

40%

ISP	PT XLSMART Telecom Sejahtera, TBK
Usage Type	Fixed Line ISP
ASN	AS139994
Domain Name	xlsmart.co.id
Country	🇮🇩 Indonesia
City	Takokak, West Java

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 157.85.211.145

Whois 157.85.211.145

IP Abuse Reports for 157.85.211.145:

This IP address has been reported a total of 22 times from 21 distinct sources. 157.85.211.145 was first reported on March 23rd 2026, and the most recent report was 2 hours ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇺🇸 Zestysoft	2026-08-31 09:06:23 (2 hours ago)	2026-08-31T09:06:23.397107+00:00 mail dovecot: auth: passwd-file([email protected],157.85.211.14 ... show more 2026-08-31T09:06:23.397107+00:00 mail dovecot: auth: passwd-file([email protected],157.85.211.145): unknown user (given password: 1z2z3z4z5) ... show less	Brute-Force
🇦🇹 AustrianSimon	2026-08-31 03:07:27 (8 hours ago)	31 Aug 2026 03:07:27UTC:Distributed Brute Force Password Attack (smtp, ftp, imap, pop, ssh) includin ... show more 31 Aug 2026 03:07:27UTC:Distributed Brute Force Password Attack (smtp, ftp, imap, pop, ssh) including ip address 157.85.211.145 show less	Brute-Force
🇮🇹 Progetto1	2026-08-31 03:05:02 (9 hours ago)	Mail - Multiple failed login attempts	Brute-Force Exploited Host
🇫🇷 ingroscart.it	2026-08-31 02:46:04 (9 hours ago)	(smtpauth) Failed SMTP AUTH login from 157.85.211.145 (ID/Indonesia/Banten/Tangerang/-/[redacted])	Brute-Force
🇮🇹 VHosting	2026-08-31 02:20:03 (9 hours ago)	Detected mail brute force attack from different servers	Brute-Force
🇮🇩 sockominfo	2026-07-14 16:00:52 (1 month ago)	Late night login (22:00-05:30) - High risk Jakarta timezone (WIB), Critical: After-hours login detec ... show more Late night login (22:00-05:30) - High risk Jakarta timezone (WIB), Critical: After-hours login detected - Jakarta timezone (WIB). Threat Score: 9.1/10 (CRITICAL). Confidence: 70%. CVSS v3.1: 9.9/10 (Critical). CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. Bayesian Probability: 93%. MITRE ATT&CK: T1078 (Valid Accounts). Tactic: TA0001. Freshness: Very Fresh. Source Reputation: KNOWN_MALICIOUS. Methodology: CVSS 3.1 + Bayesian + Temporal + Environmental + MITRE ATT&CK + OWASP. Standards: ISO/IEC 27065:2022, NIST SP 800-30, IEEE S&P 2020. Reported by TangerangKota-CSIRT. Status: MALICIOUS show less	Hacking Web App Attack
🇺🇸 kosada.com	2026-07-13 19:37:20 (1 month ago)	Web bot: denial-of-service flood	DDoS Attack Bad Web Bot
🇮🇩 sockominfo	2026-06-05 16:00:12 (2 months ago)	Late night login (22:00-05:30) - High risk Jakarta timezone (WIB). Threat Score: 8.6/10 (HIGH). Repo ... show more Late night login (22:00-05:30) - High risk Jakarta timezone (WIB). Threat Score: 8.6/10 (HIGH). Reported by TangerangKota-CSIRT. Status: MALICIOUS show less	Hacking Web App Attack
🇦🇺 2000cn.com.au	2026-05-04 02:14:22 (3 months ago)	This IP was detected by CrowdSec triggering crowdsecurity/mariadb-bf	Web App Attack Brute-Force
🇩🇪 jasperedv.de	2026-03-26 16:59:13 (5 months ago)	Failed IMAP Login - Brutforcing	Email Spam Brute-Force
🇷🇺 DZBOT	2026-03-26 12:59:48 (5 months ago)	DZBOT: Brute-force users IMAP/POP3	Brute-Force
Anonymous	2026-03-25 09:17:01 (5 months ago)	failed imap login	Brute-Force
Anonymous	2026-03-24 20:55:42 (5 months ago)	"POST /xmlrpc.php HTTP/1.1"	Hacking Web App Attack
🇺🇸 TPI-Abuse	2026-03-24 16:53:57 (5 months ago)	(mod_security) mod_security (id:225170) triggered by 157.85.211.145 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:225170) triggered by 157.85.211.145 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Mar 24 12:53:49.853245 2026] [security2:error] [pid 1803:tid 1803] [client 157.85.211.145:1612] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)\|\|integrabroadcast.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "integrabroadcast.com"] [uri "/wp-json/wp/v2/users"] [unique_id "acLBnS4jBjKyQsJ3dIwWOQAAAAs"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 2k11.co.za	2026-03-24 13:23:07 (5 months ago)	157.85.211.145 - - [24/Mar/2026:09:20:39 -0400] "POST /xmlrpc.php HTTP/2.0" 200 207 "-" "Mozilla/5.0 ... show more 157.85.211.145 - - [24/Mar/2026:09:20:39 -0400] "POST /xmlrpc.php HTTP/2.0" 200 207 "-" "Mozilla/5.0 (Windows NT 10.0; x86) AppleWebKit/537.36 (KHTML, like Gecko) Opera/61.0.0.0 Safari/537.36" 157.85.211.145 - - [24/Mar/2026:09:21:56 -0400] "POST /xmlrpc.php HTTP/2.0" 200 207 "-" "Mozilla/5.0 (Windows NT 6.3; x86) AppleWebKit/537.36 (KHTML, like Gecko) Opera/77.0.0.0 Safari/537.36" 157.85.211.145 - - [24/Mar/2026:09:23:06 -0400] "POST /xmlrpc.php HTTP/2.0" 200 207 "-" "Mozilla/5.0 (Windows NT 10.0; arm64) AppleWebKit/537.36 (KHTML, like Gecko) Firefox/96.0.0.0 Safari/537.36" ... show less	Brute-Force

Showing 1 to 15 of 22 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇺🇸 2607:f8b0:400c:c38::121

🇸🇪 195.128.241.4

🇷🇴 193.46.255.86

🇧🇷 189.112.46.15

🇨🇳 183.230.155.13

🇳🇱 176.65.148.107

🇩🇪 167.94.146.72

🇫🇮 155.212.109.212

🇺🇸 92.204.138.187

🇺🇸 85.239.151.10

🇫🇷 85.217.140.23

🇺🇸 74.220.49.50

🇧🇷 45.205.1.231

🇺🇸 35.196.80.147

🇺🇸 20.236.67.111

🇮🇹 2.47.67.191

🇨🇳 221.228.203.3

🇩🇪 213.209.159.11

🇳🇱 204.76.203.4

🇺🇸 195.184.76.64