JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 158.140.166.104

158.140.166.104 was found in our database!

This IP was reported 19 times. Confidence of Abuse is 30%: ?

30%

ISP	PT. Eka Mas Republik
Usage Type	Fixed Line ISP
ASN	AS63859
Hostname(s)	host-158.140.166-104.myrepublic.co.id
Domain Name	myrepublic.co.id
Country	🇮🇩 Indonesia
City	Semarang, Central Java

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 158.140.166.104

Whois 158.140.166.104

IP Abuse Reports for 158.140.166.104:

This IP address has been reported a total of 19 times from 16 distinct sources. 158.140.166.104 was first reported on March 1st 2021, and the most recent report was 18 hours ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇫🇷 Sklurk	2026-07-10 09:27:55 (18 hours ago)	Web App Attack	Web App Attack
🇺🇸 kosada.com	2026-07-07 05:03:13 (3 days ago)	Web bot: denial-of-service flood	DDoS Attack Bad Web Bot
🇮🇩 sockominfo	2026-06-28 13:00:52 (1 week ago)	User login to application from malicious IP 158.140.166.104.. Threat Score: 4.4/10 (MEDIUM). Confide ... show more User login to application from malicious IP 158.140.166.104.. Threat Score: 4.4/10 (MEDIUM). Confidence: 55%. CVSS v3.1: 0/10 (None). CVSS Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:N. Bayesian Probability: 88%. MITRE ATT&CK: T1016 (System Network Configuration Discovery). Tactic: TA0001. Freshness: Fresh. Source Reputation: UNKNOWN. Methodology: CVSS 3.1 + Bayesian + Temporal + Environmental + MITRE ATT&CK + OWASP. Standards: ISO/IEC 27065:2022, NIST SP 800-30, IEEE S&P 2020. Reported by TangerangKota-CSIRT. Status: MALICIOUS show less	Hacking Web App Attack
🇮🇩 sockominfo	2026-06-28 12:00:52 (1 week ago)	User login to application from malicious IP 158.140.166.104.. Threat Score: 4.6/10 (MEDIUM). Confide ... show more User login to application from malicious IP 158.140.166.104.. Threat Score: 4.6/10 (MEDIUM). Confidence: 55%. CVSS v3.1: 0/10 (None). CVSS Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:N. Bayesian Probability: 88%. MITRE ATT&CK: T1016 (System Network Configuration Discovery). Tactic: TA0001. Freshness: Fresh. Source Reputation: UNKNOWN. Methodology: CVSS 3.1 + Bayesian + Temporal + Environmental + MITRE ATT&CK + OWASP. Standards: ISO/IEC 27065:2022, NIST SP 800-30, IEEE S&P 2020. Reported by TangerangKota-CSIRT. Status: MALICIOUS show less	Hacking Web App Attack
🇮🇩 sockominfo	2026-06-28 10:00:08 (1 week ago)	User login to application from malicious IP 158.140.166.104.. Threat Score: 0/10 (INFORMATIONAL). Re ... show more User login to application from malicious IP 158.140.166.104.. Threat Score: 0/10 (INFORMATIONAL). Reported by TangerangKota-CSIRT show less	Hacking Web App Attack
🇮🇩 hermawan	2026-05-29 14:17:08 (1 month ago)	[Fri May 29 21:17:07.868634 2026] [authz_core:error] [pid 38325:tid 140230001657536] [client 158.140 ... show more [Fri May 29 21:17:07.868634 2026] [authz_core:error] [pid 38325:tid 140230001657536] [client 158.140.166.104:50936] AH01630: client denied by server configuration: /var/www/images/Klimatologi/Infografis/Infografis-Iklim/Perubahan_Iklim/Infografis_Perubahan_Iklim_Jawa_Timur.webp [staklim-jatim.bmkg.go.id] [staklim-jatim.bmkg.go.id] top=[38334] [YZj2fzXFwe4] [ahmf41Wx_RYjLdeLrzUq-gAARQg] keep_alive=[1] [2026-05-29 21:17:07.868638] [R:ahmf41Wx_RYjLdeLrzUq-gAARQg] UA:'Mozilla/5.0 (Linux; Android 8.0.0; LG-H870DS Build/OPR1.170623.032) AppleWebKit/537.37 (KHTML, like Gecko) Chrome/68.0.3440.91 Mobile Safari/537.36' Host:'staklim-jatim.bmkg.go.id:443' ACCEPT:'/' Accept-Encoding:'gzip, deflate, br Accept-Language:'en-US,en;q=0.8 ... show less	Email Spam Hacking
🇩🇪 SMARTNET	2026-05-27 06:03:53 (1 month ago)	Aisuru(Mirai variant) DDoS \| Incident ID: 5b730afc-5cec-4742-843f-18085cc64e5c	DDoS Attack
Anonymous	2026-05-16 04:34:55 (1 month ago)	Attack Signature Blocked: /brands/shopby/manufacturer-extron-rcf-vmware-avaya-lsi-infocus-ask_proxim ... show more Attack Signature Blocked: /brands/shopby/manufacturer-extron-rcf-vmware-avaya-lsi-infocus-ask_proxima-projectiondesign-xyz.html (Magento Site) (Botnet activity attributed to: Angara Technologies Group / mikhail-smirnov-79830322) show less	Web App Attack
🇩🇪 milcraft.nl	2026-05-11 04:13:10 (2 months ago)	Suspicious WooCommerce query combination detected. Not default available on websites. Matched combi ... show more Suspicious WooCommerce query combination detected. Not default available on websites. Matched combi patterns: filter_, add-to-cart=, orderby=, product_count=. Activity is consistent with high-volume request abuse. show less	DDoS Attack Web App Attack
🇩🇪 filstal.org	2026-03-31 06:22:27 (3 months ago)	Brute-force/Enumeration: Multiple login attempts for non-existent mail accounts (Honeytrap).	Email Spam Brute-Force
🇸🇪 triplecode	2026-03-30 16:01:50 (3 months ago)	Reported from hMailServer	Hacking
Anonymous	2026-03-14 20:43:50 (3 months ago)	ModSecurity rejected a query	Bad Web Bot Web App Attack
🇳🇱 Mangelot Hosting	2026-03-03 12:49:33 (4 months ago)	(modsecurity) srv103 ModSecurity 158.140.166.104 (ID/Indonesia/host-158.140.166-104.myrepublic.co.id ... show more (modsecurity) srv103 ModSecurity 158.140.166.104 (ID/Indonesia/host-158.140.166-104.myrepublic.co.id): 10 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: show less	Web App Attack
🇺🇸 TPI-Abuse	2026-02-05 18:26:03 (5 months ago)	(mod_security) mod_security (id:225170) triggered by 158.140.166.104 (host-158.140.166-104.myrepubli ... show more (mod_security) mod_security (id:225170) triggered by 158.140.166.104 (host-158.140.166-104.myrepublic.co.id): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Feb 05 13:25:57.290071 2026] [security2:error] [pid 17300:tid 17300] [client 158.140.166.104:5125] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)\|\|capriexpress.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "capriexpress.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aYTgtf9wdonHGHhv6XLtQwAAAAA"] show less	Brute-Force Bad Web Bot Web App Attack
🇬🇧 spamverify.com	2026-02-03 16:29:13 (5 months ago)	Honeypot Hit: Port Scan (443) HTTPS	Web Spam Blog Spam Bad Web Bot Web App Attack

Showing 1 to 15 of 19 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇫🇮 147.185.133.165

🇨🇳 221.15.7.54

🇩🇪 217.60.245.175

🇳🇱 193.176.31.208

🇩🇪 167.94.145.16

🇻🇳 160.22.170.38

🇫🇮 147.185.133.206

🇺🇸 147.182.225.86

🇨🇳 110.249.202.72

🇷🇸 109.245.162.15

🇹🇷 94.154.43.230

🇧🇬 78.128.112.6

🇸🇬 68.183.177.63

🇺🇸 66.132.195.53

🇫🇮 45.87.249.146

🇧🇪 34.77.199.125

🇨🇳 14.103.126.104

10.90.234.1

🇺🇸 2a09:bac5:624c:281e::3ff:23

🇳🇱 2a09:bac1:5520::3e4:39