JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 163.7.11.7

163.7.11.7 was found in our database!

This IP was reported 44 times. Confidence of Abuse is 100%: ?

100%

ISP	BYTEPLUS
Usage Type	Data Center/Web Hosting/Transit
ASN	AS150436
Domain Name	bytedance.com
Country	🇮🇩 Indonesia
City	Jakarta, Jakarta

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 163.7.11.7

Whois 163.7.11.7

IP Abuse Reports for 163.7.11.7:

This IP address has been reported a total of 44 times from 33 distinct sources. 163.7.11.7 was first reported on July 7th 2026, and the most recent report was 8 hours ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇮🇩 soc-yk	2026-07-07 23:42:11 (8 hours ago)	Type: web_scanning Risk: 75 Events: 12529 Evidence: - Automated hostile web probing detected - Repe ... show more Type: web_scanning Risk: 75 Events: 12529 Evidence: - Automated hostile web probing detected - Repeated web scanning activity observed - Multi-event operational persistence identified - Threat escalation behavior observed show less	Web App Attack
🇺🇸 H24	2026-07-07 22:56:53 (9 hours ago)	/credentials.json /secrets.json /.git/config /.aliyun/credentials	Web App Attack
🇨🇦 electronico	2026-07-07 22:27:43 (9 hours ago)	163.7.11.7 - - [08/Jul/2026:09:27:42 +1100] "GET /aliyun.yml HTTP/1.1" 404 5912 "-" "Mozilla/5.0 (Ma ... show more 163.7.11.7 - - [08/Jul/2026:09:27:42 +1100] "GET /aliyun.yml HTTP/1.1" 404 5912 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 Chrome/120.0.0.0 Safari/537.36" 163.7.11.7 - - [08/Jul/2026:09:27:42 +1100] "GET /.git/config HTTP/1.1" 404 5912 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0" 163.7.11.7 - - [08/Jul/2026:09:27:42 +1100] "GET /.env HTTP/1.1" 404 5912 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 Chrome/120.0.0.0 Safari/537.36" 163.7.11.7 - - [08/Jul/2026:09:27:42 +1100] "GET /.env.production HTTP/1.1" 404 5912 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Chrome/120.0.0.0 Safari/537.36" 163.7.11.7 - - [08/Jul/2026:09:27:42 +1100] "GET /config.ini HTTP/1.1" 404 5912 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 Chrome/120.0.0.0 Safari/537.36" 163.7.11.7 - - [08/Jul/2026:09:27:42 +1100] "GET /oss.yml HTTP/1.1" 404 5912 "-" "Mozilla/5.0 (Macintos ... show less	Brute-Force Web App Attack
🇫🇷 Safronus	2026-07-07 22:20:35 (10 hours ago)	Banned by fail2ban jail=nginx-noscript match=$f2bV_matches	Bad Web Bot Web App Attack
🇦🇺 2000cn.com.au	2026-07-07 22:05:54 (10 hours ago)	This IP was detected by CrowdSec triggering crowdsecurity/http-probing	Web App Attack Hacking
🇬🇧 gurnip	2026-07-07 21:56:35 (10 hours ago)	Vulnerability probe of page /.env, not found on server.	Brute-Force Web App Attack
🇳🇱 tmiland	2026-07-07 21:52:59 (10 hours ago)	(nginx_404) Dot directory Honeypot Trap 163.7.11.7 (ID/Indonesia/-): 2 in the last 3600 secs; IP: 16 ... show more (nginx_404) Dot directory Honeypot Trap 163.7.11.7 (ID/Indonesia/-): 2 in the last 3600 secs; IP: 163.7.11.7; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: 163.7.11.7 - - [07/Jul/2026:23:52:55 +0200] "GET /.env.local HTTP/1.1" 404 2992 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0" 163.7.11.7 - - [07/Jul/2026:23:52:55 +0200] "GET /.env.staging HTTP/1.1" 404 2992 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 Chrome/120.0.0.0 Safari/537.36" show less	Brute-Force
🇺🇸 TPI-Abuse	2026-07-07 21:51:48 (10 hours ago)	(mod_security) mod_security (id:210730) triggered by 163.7.11.7 (-): 1 in the last 300 secs; Ports: ... show more (mod_security) mod_security (id:210730) triggered by 163.7.11.7 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jul 07 17:51:41.214759 2026] [security2:error] [pid 2231:tid 2231] [client 163.7.11.7:48958] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy\|\|mail.soulwolf.com\|F\|2"] [data ".conf"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "mail.soulwolf.com"] [uri "/appsettings.conf"] [unique_id "ak107fqsp25gMhNLxQYn-gAAAAc"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 nasset	2026-07-07 21:31:04 (10 hours ago)	163.7.11.7 - - [07/Jul/2026:14:31:04 -0700] "GET /.env.staging/../..;/ HTTP/1.1" 403 6456 "-" "Mozil ... show more 163.7.11.7 - - [07/Jul/2026:14:31:04 -0700] "GET /.env.staging/../..;/ HTTP/1.1" 403 6456 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0" 163.7.11.7 - - [07/Jul/2026:14:31:04 -0700] "GET /.git/config/../..;/ HTTP/1.1" 403 6456 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Chrome/120.0.0.0 Safari/537.36" 163.7.11.7 - - [07/Jul/2026:14:31:04 -0700] "GET /.env/..%00/ HTTP/1.1" 404 6380 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Chrome/120.0.0.0 Safari/537.36" 163.7.11.7 - - [07/Jul/2026:14:31:04 -0700] "GET /.env.production/.;/ HTTP/1.1" 403 6456 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0" 163.7.11.7 - - [07/Jul/2026:14:31:04 -0700] "GET /.env.local/..%00/ HTTP/1.1" 404 6380 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 Chrome/120.0.0.0 Safari/537.36" ... show less	Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-07-07 21:30:52 (10 hours ago)	(mod_security) mod_security (id:210492) triggered by 163.7.11.7 (-): 1 in the last 300 secs; Ports: ... show more (mod_security) mod_security (id:210492) triggered by 163.7.11.7 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jul 07 17:30:41.215525 2026] [security2:error] [pid 18226:tid 18226] [client 163.7.11.7:60030] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.grancanariaholidays.com"] [uri "/.env"] [unique_id "ak1wAa8GPsmxQyfBThCfpQAAAAY"] show less	Brute-Force Bad Web Bot Web App Attack
🇮🇩 soc-yk	2026-07-07 20:54:13 (11 hours ago)	Type: suspicious_network_activity Risk: 100 Events: 296 Evidence: - Persistent suspicious network a ... show more Type: suspicious_network_activity Risk: 100 Events: 296 Evidence: - Persistent suspicious network activity detected - Repeated hostile operational behavior observed - Multi-event operational persistence identified - Threat escalation behavior observed show less	Port Scan Hacking
🇳🇱 middelkoopcc	2026-07-07 20:50:05 (11 hours ago)	2026-07-07 22:45:07 [remote 163.7.11.7:39790] AH01071: Got error 'Primary script unknown' && 2026-07 ... show more 2026-07-07 22:45:07 [remote 163.7.11.7:39790] AH01071: Got error 'Primary script unknown' && 2026-07-07 22:45:07 [remote 163.7.11.7:39934] AH01071: Got error 'Primary script unknown' && 2026-07-07 22:45:07 [remote 163.7.11.7:39812] AH01071: Got error 'Primary script unknown' && 577 more within 20 minutes show less	Web App Attack
🇩🇪 bsoft.de	2026-07-07 20:16:11 (12 hours ago)	163.7.11.7 - - [07/Jul/2026:22:15:44 +0200] "GET /xmlrpc.php HTTP/1.1" 405 42 "-" "Mozilla/5.0 (Maci ... show more 163.7.11.7 - - [07/Jul/2026:22:15:44 +0200] "GET /xmlrpc.php HTTP/1.1" 405 42 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 Chrome/120.0.0.0 Safari/537.36" 163.7.11.7 - - [07/Jul/2026:22:15:54 +0200] "GET /xmlrpc.php HTTP/1.1" 405 42 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Chrome/120.0.0.0 Safari/537.36" 163.7.11.7 - - [07/Jul/2026:22:16:11 +0200] "POST /xmlrpc.php HTTP/1.1" 200 206 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Chrome/120.0.0.0 Safari/537.36" show less	Web App Attack
Anonymous	2026-07-07 19:39:37 (12 hours ago)	163.7.11.7 - - [07/Jul/2026:19:39:36 +0000] "GET /.env.staging HTTP/1.1" 404 4136 "-" "Mozilla/5.0 ( ... show more 163.7.11.7 - - [07/Jul/2026:19:39:36 +0000] "GET /.env.staging HTTP/1.1" 404 4136 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Chrome/120.0.0.0 Safari/537.36" ... show less	Bad Web Bot Web App Attack
🇳🇱 ReyhZhao	2026-07-07 19:09:12 (13 hours ago)	Bunkerweb ModSecurity alert: Potential Remote Command Execution (RCE) detected. Unix shell code was ... show more Bunkerweb ModSecurity alert: Potential Remote Command Execution (RCE) detected. Unix shell code was identified within the request arguments, triggering a security rule designed to prevent application attacks. show less	Brute-Force

Showing 1 to 15 of 44 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇲🇽 187.134.192.1

🇧🇷 187.110.238.50

🇸🇬 172.188.89.41

🇭🇰 103.56.115.187

🇫🇷 84.247.136.70

🇺🇸 54.173.255.233

🇺🇸 17.241.75.42

🇺🇸 215.121.152.171

🇺🇸 205.210.31.47

🇲🇩 195.178.106.224

🇧🇷 186.251.71.202

🇧🇷 186.208.231.41

🇪🇨 186.68.83.104

🇺🇸 162.241.132.172

🇬🇧 157.245.34.56

🇺🇸 134.123.212.242

🇺🇸 132.148.155.138

🇮🇳 103.241.45.120

🇨🇳 101.126.30.240

🇺🇸 64.62.197.8