AbuseIPDB » 180.251.152.232
180.251.152.232
This IP was reported 7 times. Confidence of
Abuse
is 14% : ?
ISP
PT TELKOM INDONESIA
Usage Type
Fixed Line ISP
ASN
AS7713
Domain Name
telkom.co.id
Country
🇮🇩
Indonesia
City
Batauga, Southeast Sulawesi
IP info including ISP, Usage Type, and Location provided
by IPInfo . Updated weekly.
IP Abuse Reports for 180.251.152.232 :
This IP address has been reported a total of
7
times from
6 distinct
sources.
180.251.152.232 was first reported on
February 22nd 2024 , and the most recent report was
3 days ago
Recent Reports:
We have received reports of abusive activity from this IP address within the last week. It is
potentially still actively engaged in abusive activities.
Reporter
IoA Timestamp (UTC)
Comment
Categories
🇩🇪
dbmwebdesign
2026-07-16 07:05:24
(3 days ago)
WordPress login brute-force detected by Fail2Ban in plesk-wordpress jail
Brute-Force
Web App Attack
🇺🇸
TPI-Abuse
2026-07-16 04:01:29
(3 days ago)
(mod_security) mod_security (id:240335) triggered by 180.251.152.232 (-): 1 in the last 300 secs; Po ...
show more
(mod_security) mod_security (id:240335) triggered by 180.251.152.232 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jul 16 00:01:13.151756 2026] [security2:error] [pid 22469:tid 22504] [client 180.251.152.232:60271] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)|Source 180.251.152.232 (+1 hits since last alert)|pwihatah.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "pwihatah.com"] [uri "/xmlrpc.php"] [unique_id "alhXiX5sCDd7n_95XmiKuwAAAQQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-07-16 03:21:54
(3 days ago)
(mod_security) mod_security (id:240335) triggered by 180.251.152.232 (-): 1 in the last 300 secs; Po ...
show more
(mod_security) mod_security (id:240335) triggered by 180.251.152.232 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jul 15 23:21:40.355283 2026] [security2:error] [pid 821:tid 821] [client 180.251.152.232:52104] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)|Source 180.251.152.232 (+1 hits since last alert)|servecon.net|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "servecon.net"] [uri "/xmlrpc.php"] [unique_id "alhORAHlAsOr-z2VhpqU8QAAAA8"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇬🇧
Birdo
2026-04-30 15:11:55
(2 months ago)
[Birdo SMB Honeypot] SMB unauthorized attempt
Exploited Host
Brute-Force
Port Scan
Hacking
🇮🇩
hermawan
2025-09-23 00:04:34
(9 months ago)
[Tue Sep 23 07:04:01.441543 2025] [security2:error] [pid 1591832:tid 139914799646400] [client 180.25 ...
show more
[Tue Sep 23 07:04:01.441543 2025] [security2:error] [pid 1591832:tid 139914799646400] [client 180.251.152.232:41006] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "okhttp" at REQUEST_HEADERS:User-Agent. [file "/etc/modsecurity/coreruleset-4.16.0/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "228"] [id "440000"] [msg "BAD BOT - Detected and Blocked"] [data "Matched Data: okhttp found within REQUEST_HEADERS:User-Agent: okhttp/4.12.0 request_line = GET /images/Geofisika/poster_antisipasi_gempa-600.jpg HTTP/2.0"] [severity "NOTICE"] [hostname "staklim-jatim.bmkg.go.id"] [uri "/images/Geofisika/poster_antisipasi_gempa-600.jpg"] [unique_id "aNHj8b5UKvZZrXza2mYuuQADQRc"] [staklim-jatim.bmkg.go.id] [staklim-jatim.bmkg.go.id] top=[1591856] [6zhhrKwmcow] [aNHj8b5UKvZZrXza2mYuuQADQRc] keep_alive=[1] [2025-09-23 07:04:01.441549] [R:aNHj8b5UKvZZrXza2mYuuQADQRc] UA:'okhttp/4.12.0' Host:'staklim-jatim.bmkg.go.id' Accept-Encoding:'gzip
...
show less
Hacking
Web App Attack
🇳🇱
Study Bitcoin 🤗
2024-12-12 03:18:55
(1 year ago)
Port probe to tcp/445 (smb)
[srv132]
Port Scan
Hacking
2024-02-22 08:37:29
(2 years ago)
Unauthorized connection attempt
Port Scan
Hacking
Exploited Host
Showing 1 to
7
of 7 reports
Think this IP has been falsely reported? You may request to have the associated
reports reviewed and removed.
Request Takedown 🚩
Recently Reported IPs: