JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 180.245.252.228

180.245.252.228 was found in our database!

This IP was reported 14 times. Confidence of Abuse is 70%: ?

70%

ISP	PT TELKOM INDONESIA
Usage Type	Fixed Line ISP
ASN	AS7713
Domain Name	telkom.co.id
Country	🇮🇩 Indonesia
City	Subang, West Java

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 180.245.252.228

Whois 180.245.252.228

IP Abuse Reports for 180.245.252.228:

This IP address has been reported a total of 14 times from 11 distinct sources. 180.245.252.228 was first reported on June 20th 2026, and the most recent report was 1 day ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇩🇪 big-cloud.nl	2026-06-24 20:03:47 (1 day ago)	Try to access /xmlrpc.php	Web App Attack
🇩🇪 LRob.fr	2026-06-24 19:45:07 (1 day ago)	Repeated requests on blocked xmlrpc.php, blocked by fail2ban in custom-503-xmlrpc jail	Bad Web Bot Web App Attack
🇩🇪 4server	2026-06-24 16:32:16 (1 day ago)	[WedJun2418:32:13.6574792026][security2:error][pid355040:tid355051][client180.245.252.228:0]ModSecur ... show more [WedJun2418:32:13.6574792026][security2:error][pid355040:tid355051][client180.245.252.228:0]ModSecurity:Accessdeniedwithcode403\(phase1\).Stringmatch\"/xmlrpc.php\"atREQUEST_URI.[file\"/etc/apache2/conf.d/modsec_custom_rules.conf\"][line\"170\"][id\"960024\"][msg\"XML-RPCdisabled\"][hostname\"casacarmen.ch\"][uri\"/xmlrpc.php\"][unique_id\"ajwGjS-HgLB2zru5mmNmfwAAAAg\"] show less	Port Scan Brute-Force Web App Attack
🇺🇸 TPI-Abuse	2026-06-23 07:57:23 (2 days ago)	(mod_security) mod_security (id:225170) triggered by 180.245.252.228 (-): 1 in the last 300 secs; Po ... show more (mod_security) mod_security (id:225170) triggered by 180.245.252.228 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jun 23 03:57:15.771319 2026] [security2:error] [pid 10851:tid 10851] [client 180.245.252.228:64097] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)\|\|tenmenband.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "tenmenband.com"] [uri "/wp-json/wp/v2/users"] [unique_id "ajo8W_Ph0IAL55b9p8F9CAAAAAU"] show less	Brute-Force Bad Web Bot Web App Attack
🇫🇮 inlink.ltd	2026-06-23 04:58:26 (3 days ago)	Known malicious PHP file or CMS probe	Web App Attack
🇺🇸 interbiznw.com	2026-06-23 04:37:13 (3 days ago)	malicious-web-requests-vulnerability-scanning	Hacking Brute-Force Exploited Host Web App Attack
🇩🇪 ghostwarriors	2026-06-23 03:20:04 (3 days ago)	Attempts against non-existent wp-login	Brute-Force Web App Attack
Anonymous	2026-06-22 16:55:10 (3 days ago)	Attac	Brute-Force
🇫🇮 stinpriza	2026-06-22 14:38:48 (3 days ago)	Web App Attack	Web App Attack
🇺🇸 TPI-Abuse	2026-06-22 04:26:37 (4 days ago)	(mod_security) mod_security (id:225170) triggered by 180.245.252.228 (-): 1 in the last 300 secs; Po ... show more (mod_security) mod_security (id:225170) triggered by 180.245.252.228 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jun 22 00:26:33.279647 2026] [security2:error] [pid 21731:tid 21731] [client 180.245.252.228:59962] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)\|\|dragonflytunes.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "dragonflytunes.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aji5eRA9NsAq1Kmnhnwj-QAAAAk"] show less	Brute-Force Bad Web Bot Web App Attack
🇮🇹 VHosting	2026-06-21 23:25:04 (4 days ago)	Detected WordPress attack from 4 different servers	Brute-Force Web App Attack
🇩🇪 4server	2026-06-21 23:24:56 (4 days ago)	[MonJun2201:24:52.7218762026][security2:error][pid961248:tid961261][client180.245.252.228:0]ModSecur ... show more [MonJun2201:24:52.7218762026][security2:error][pid961248:tid961261][client180.245.252.228:0]ModSecurity:Accessdeniedwithcode403\(phase1\).Stringmatch\"/xmlrpc.php\"atREQUEST_URI.[file\"/etc/apache2/conf.d/modsec_custom_rules.conf\"][line\"170\"][id\"960024\"][msg\"XML-RPCdisabled\"][hostname\"alessandrolucchini.ch\"][uri\"/xmlrpc.php\"][unique_id\"ajhyxBEDcpGPBZq8EgkNmgAAAEo\"] show less	Port Scan Brute-Force Web App Attack
🇺🇸 TPI-Abuse	2026-06-21 15:51:06 (4 days ago)	(mod_security) mod_security (id:225170) triggered by 180.245.252.228 (-): 1 in the last 300 secs; Po ... show more (mod_security) mod_security (id:225170) triggered by 180.245.252.228 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Jun 21 11:50:57.296926 2026] [security2:error] [pid 12909:tid 12909] [client 180.245.252.228:55301] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)\|\|onlinesuretybonds.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "onlinesuretybonds.com"] [uri "/wp-json/wp/v2/users"] [unique_id "ajgIYWeR1lfgwE2-LXJLdwAAABw"] show less	Brute-Force Bad Web Bot Web App Attack
🇳🇱 maxxsense	2026-06-20 17:40:24 (5 days ago)	(wordpress) Failed wordpress login from 180.245.252.228 (ID/Indonesia/-)	Brute-Force

Showing 1 to 14 of 14 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇺🇸 162.216.150.173

🇮🇩 202.59.204.71

🇬🇧 193.163.125.206

🇳🇱 176.65.139.181

🇮🇳 164.52.200.168

🇺🇸 64.225.17.153

🇧🇷 20.197.238.124

🇺🇸 167.172.245.177

🇩🇪 167.94.146.38

🇮🇩 163.7.11.69

🇺🇸 147.185.132.99

🇫🇷 91.231.89.228

🇳🇱 91.92.40.231

🇪🇸 89.130.176.8

🇭🇺 80.98.155.175

🇺🇸 65.49.1.106

🇲🇾 47.250.55.42

🇬🇧 37.10.113.213

🇳🇱 5.61.209.92

🇺🇸 216.218.206.94