JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 157.85.212.129

157.85.212.129 was found in our database!

This IP was reported 15 times. Confidence of Abuse is 58%: ?

58%

ISP	PT XLSMART Telecom Sejahtera, TBK
Usage Type	Fixed Line ISP
ASN	AS139994
Domain Name	xlsmart.co.id
Country	🇮🇩 Indonesia
City	Soreang, West Java

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 157.85.212.129

Whois 157.85.212.129

IP Abuse Reports for 157.85.212.129:

This IP address has been reported a total of 15 times from 9 distinct sources. 157.85.212.129 was first reported on July 9th 2026, and the most recent report was 14 hours ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇺🇸 TPI-Abuse	2026-07-11 10:23:55 (14 hours ago)	(mod_security) mod_security (id:240335) triggered by 157.85.212.129 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:240335) triggered by 157.85.212.129 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Jul 11 06:23:51.105121 2026] [security2:error] [pid 7133:tid 7133] [client 157.85.212.129:44376] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5965"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 157.85.212.129 (+1 hits since last alert)\|celebritybikinigossip.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "celebritybikinigossip.com"] [uri "/xmlrpc.php"] [unique_id "alIZty3sXr9eBz_5ra4fAgAAAAg"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-07-11 03:38:57 (21 hours ago)	(mod_security) mod_security (id:225170) triggered by 157.85.212.129 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:225170) triggered by 157.85.212.129 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jul 10 23:38:51.824379 2026] [security2:error] [pid 15334:tid 15334] [client 157.85.212.129:42770] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)\|\|jdeloa.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "jdeloa.com"] [uri "/wp-json/wp/v2/users"] [unique_id "alG6y-f15xrtZbn9JlL2MwAAAAY"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 IndigoRidge	2026-07-10 14:33:16 (1 day ago)	157.85.212.129 - - [10/Jul/2026:10:30:02 -0400] "POST /xmlrpc.php HTTP/1.0" 200 5263 "-" "WordPress. ... show more 157.85.212.129 - - [10/Jul/2026:10:30:02 -0400] "POST /xmlrpc.php HTTP/1.0" 200 5263 "-" "WordPress.com; https://wordpress.com" 157.85.212.129 - - [10/Jul/2026:10:30:13 -0400] "POST /xmlrpc.php HTTP/1.0" 200 5263 "-" "WordPress.com; https://wordpress.com" 157.85.212.129 - - [10/Jul/2026:10:31:28 -0400] "POST /xmlrpc.php HTTP/1.0" 200 5263 "-" "WordPress.com; https://wordpress.com" 157.85.212.129 - - [10/Jul/2026:10:32:54 -0400] "POST /xmlrpc.php HTTP/1.0" 200 5263 "-" "WordPress.com; https://wordpress.com" 157.85.212.129 - - [10/Jul/2026:10:33:15 -0400] "POST /xmlrpc.php HTTP/1.0" 200 5263 "-" "WordPress.com; https://wordpress.com" ... show less	Web App Attack
🇺🇸 cwytech	2026-07-10 10:56:43 (1 day ago)	Fleet-wide ban from the Ghostfleet 👻. Triggered by scenario: cwy/wp-us-login-only-high.	Bad Web Bot Web App Attack
🇩🇪 ghostwarriors	2026-07-10 10:21:36 (1 day ago)	Webpage scraping	Brute-Force Bad Web Bot Web App Attack
🇪🇸 masterguru	2026-07-10 05:22:00 (1 day ago)	(xmlrpc) Failed xmlrpc access from 157.85.212.129 (ID/Indonesia/-): 5 in the last 3600 secs (0-122)	Hacking
Anonymous	2026-07-10 04:48:44 (1 day ago)	[redacted] 157.85.212.129 - - [10/Jul/2026:06:47:46 +0200] "POST /xmlrpc.php HTTP/1.1" 405 428 "-" " ... show more [redacted] 157.85.212.129 - - [10/Jul/2026:06:47:46 +0200] "POST /xmlrpc.php HTTP/1.1" 405 428 "-" "Jetpack/12.0; WordPress/6.2; http://site21964547.com" [redacted] 157.85.212.129 - - [10/Jul/2026:06:47:56 +0200] "POST /xmlrpc.php HTTP/1.1" 405 428 "-" "WordPress.com; https://wordpress.com" [redacted] 157.85.212.129 - - [10/Jul/2026:06:48:22 +0200] "POST /xmlrpc.php HTTP/1.1" 405 428 "-" "Jetpack/13.0; WordPress/6.4; http://site74008246.com" [redacted] 157.85.212.129 - - [10/Jul/2026:06:48:28 +0200] "POST /xmlrpc.php HTTP/1.1" 405 428 "-" "Jetpack by WordPress.com (Jetpack 12.0; WordPress 6.1)" [redacted] 157.85.212.129 - - [10/Jul/2026:06:48:42 +0200] "POST /xmlrpc.php HTTP/1.1" 405 428 "-" "Jetpack by WordPress.com" ... show less	Hacking Web App Attack
🇦🇺 clapper	2026-07-10 04:03:37 (1 day ago)	(mod_security) mod_security (id:350202) triggered by 157.85.212.129 (ID/Indonesia/-): 5 in the last ... show more (mod_security) mod_security (id:350202) triggered by 157.85.212.129 (ID/Indonesia/-): 5 in the last 600 secs; ID: rub show less	Brute-Force Bad Web Bot
🇺🇸 TPI-Abuse	2026-07-10 00:20:10 (2 days ago)	(mod_security) mod_security (id:240335) triggered by 157.85.212.129 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:240335) triggered by 157.85.212.129 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jul 09 20:20:06.250231 2026] [security2:error] [pid 3179:tid 3195] [client 157.85.212.129:56088] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 157.85.212.129 (+1 hits since last alert)\|leadingedgesupply.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "leadingedgesupply.com"] [uri "/xmlrpc.php"] [unique_id "alA6tnpTUizw01L_Fj1yCAAAAAg"] show less	Brute-Force Bad Web Bot Web App Attack
Anonymous	2026-07-09 15:01:08 (2 days ago)	157.85.212.129 (ID/Indonesia/-)	Brute-Force
🇺🇸 TPI-Abuse	2026-07-09 13:21:46 (2 days ago)	(mod_security) mod_security (id:240335) triggered by 157.85.212.129 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:240335) triggered by 157.85.212.129 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jul 09 09:21:37.672246 2026] [security2:error] [pid 10768:tid 10768] [client 157.85.212.129:51446] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 157.85.212.129 (+1 hits since last alert)\|otraes.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "otraes.com"] [uri "/xmlrpc.php"] [unique_id "ak-gYcXNBlXEcMatu6j39wAAABM"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-07-09 09:04:57 (2 days ago)	(mod_security) mod_security (id:240335) triggered by 157.85.212.129 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:240335) triggered by 157.85.212.129 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jul 09 05:04:54.097148 2026] [security2:error] [pid 19713:tid 19713] [client 157.85.212.129:5865] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 157.85.212.129 (+1 hits since last alert)\|greenmountainfeeds.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "greenmountainfeeds.com"] [uri "/xmlrpc.php"] [unique_id "ak9kNg1ADBioK-vNT3-GOwAAAAk"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TAY	2026-07-09 08:18:47 (2 days ago)	157.85.212.129 - - [09/Jul/2026:16:18:26 +0800] "POST /xmlrpc.php HTTP/1.1" 200 5918 "-" "Jetpack by ... show more 157.85.212.129 - - [09/Jul/2026:16:18:26 +0800] "POST /xmlrpc.php HTTP/1.1" 200 5918 "-" "Jetpack by WordPress.com" 157.85.212.129 - - [09/Jul/2026:16:18:36 +0800] "POST /xmlrpc.php HTTP/1.1" 200 5918 "-" "Jetpack/12.0; WordPress/6.2; http://site47838436.com" 157.85.212.129 - - [09/Jul/2026:16:18:47 +0800] "POST /xmlrpc.php HTTP/1.1" 200 5918 "-" "Jetpack by WordPress.com (Jetpack 13.0; WordPress 6.3)" ... show less	Brute-Force
🇺🇸 TPI-Abuse	2026-07-09 06:33:58 (2 days ago)	(mod_security) mod_security (id:240335) triggered by 157.85.212.129 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:240335) triggered by 157.85.212.129 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jul 09 02:33:54.684371 2026] [security2:error] [pid 28316:tid 28316] [client 157.85.212.129:62728] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 157.85.212.129 (+1 hits since last alert)\|415test.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "415test.com"] [uri "/xmlrpc.php"] [unique_id "ak9A0rOHY0vfeaz7d2ndxgAAAAs"] show less	Brute-Force Bad Web Bot Web App Attack
🇪🇸 masterguru	2026-07-09 00:41:36 (3 days ago)	(xmlrpc) Failed xmlrpc access from 157.85.212.129 (ID/Indonesia/-): 5 in the last 3600 secs (0-122)	Hacking

Showing 1 to 15 of 15 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇫🇷 2001:41d0:33d:9200::402

🇷🇺 194.85.210.40

🇩🇪 188.40.230.41

🇸🇬 111.119.194.113

🇫🇷 62.210.246.122

🇩🇪 45.135.141.15

🇩🇪 43.228.157.9

🇳🇱 204.76.203.231

🇷🇴 185.100.84.174

🇮🇳 159.65.150.202

🇺🇸 103.143.231.24

🇫🇮 83.97.78.224

🇺🇸 73.80.162.93

🇺🇸 65.49.1.135

🇰🇷 59.16.212.232

🇺🇸 47.251.140.69

🇺🇸 34.193.146.178

🇺🇸 2607:f8b0:4001:c79::12d

🇰🇷 211.40.167.121

🇧🇷 205.210.31.218