JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 180.252.89.49

180.252.89.49 was found in our database!

This IP was reported 23 times. Confidence of Abuse is 61%: ?

61%

ISP	PT TELKOM INDONESIA
Usage Type	Fixed Line ISP
ASN	AS7713
Domain Name	telkom.co.id
Country	🇮🇩 Indonesia
City	Ciampea, West Java

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 180.252.89.49

Whois 180.252.89.49

IP Abuse Reports for 180.252.89.49:

This IP address has been reported a total of 23 times from 17 distinct sources. 180.252.89.49 was first reported on March 1st 2022, and the most recent report was 8 hours ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇫🇷 masterguru	2026-07-17 12:51:11 (8 hours ago)	(xmlrpc) Apache: Failed xmlrpc access from 180.252.89.49 (ID/Indonesia/-): 10 in the last 3600 secs ... show more (xmlrpc) Apache: Failed xmlrpc access from 180.252.89.49 (ID/Indonesia/-): 10 in the last 3600 secs (0-201) show less	Hacking
🇩🇪 LRob	2026-07-17 12:20:36 (8 hours ago)	CrowdSec: crowdsecurity/http-bf-wordpress_bf_xmlrpc \| req: /xmlrpc.php \| UA: WordPress.com; https:// ... show more CrowdSec: crowdsecurity/http-bf-wordpress_bf_xmlrpc \| req: /xmlrpc.php \| UA: WordPress.com; https://wordpress.com show less	Brute-Force Web App Attack
🇺🇸 TPI-Abuse	2026-07-17 11:52:47 (9 hours ago)	(mod_security) mod_security (id:240335) triggered by 180.252.89.49 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:240335) triggered by 180.252.89.49 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jul 17 07:52:38.320078 2026] [security2:error] [pid 16415:tid 16415] [client 180.252.89.49:52765] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 180.252.89.49 (+1 hits since last alert)\|handankoc.net\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "handankoc.net"] [uri "/xmlrpc.php"] [unique_id "aloXht5LMP8s0ZQS0FBsDwAAAAo"] show less	Brute-Force Bad Web Bot Web App Attack
🇮🇩 Burayot	2026-07-17 08:29:02 (12 hours ago)	LF_MODSEC: (mod_security) mod_security (id:1000001) triggered by 180.252.89.49 (ID/Indonesia/-): 1 i ... show more LF_MODSEC: (mod_security) mod_security (id:1000001) triggered by 180.252.89.49 (ID/Indonesia/-): 1 in the last 3600 secs show less	Web App Attack
Anonymous	2026-07-16 13:21:43 (1 day ago)	[redacted] 180.252.89.49 - - [16/Jul/2026:15:20:59 +0200] "POST /xmlrpc.php HTTP/1.1" 405 415 "-" "J ... show more [redacted] 180.252.89.49 - - [16/Jul/2026:15:20:59 +0200] "POST /xmlrpc.php HTTP/1.1" 405 415 "-" "Jetpack by WordPress.com (Jetpack 12.0; WordPress 6.3)" [redacted] 180.252.89.49 - - [16/Jul/2026:15:21:09 +0200] "POST /xmlrpc.php HTTP/1.1" 405 415 "-" "WordPress.com; https://wordpress.com" [redacted] 180.252.89.49 - - [16/Jul/2026:15:21:20 +0200] "POST /xmlrpc.php HTTP/1.1" 405 415 "-" "Jetpack by WordPress.com" [redacted] 180.252.89.49 - - [16/Jul/2026:15:21:32 +0200] "POST /xmlrpc.php HTTP/1.1" 405 415 "-" "Jetpack by WordPress.com (Jetpack 13.0; WordPress 6.4)" [redacted] 180.252.89.49 - - [16/Jul/2026:15:21:42 +0200] "POST /xmlrpc.php HTTP/1.1" 405 415 "-" "Jetpack/12.1; WordPress/6.2; http://site93819026.com" ... show less	Hacking Web App Attack
🇦🇺 screwlooseit.com.au	2026-07-16 13:21:29 (1 day ago)	Blocked by CSF 13 firewall - Rule: XMLRPC ID/Indonesia/-	Web App Attack
🇫🇷 SpaceHost-Server	2026-07-16 12:34:55 (1 day ago)	180.252.89.49 - - [16/Jul/2026:14:34:32 +0200] "POST /xmlrpc.php HTTP/1.1" 200 6476 "-" "WordPress.c ... show more 180.252.89.49 - - [16/Jul/2026:14:34:32 +0200] "POST /xmlrpc.php HTTP/1.1" 200 6476 "-" "WordPress.com; https://wordpress.com" 180.252.89.49 - - [16/Jul/2026:14:34:42 +0200] "POST /xmlrpc.php HTTP/1.1" 200 6476 "-" "Jetpack by WordPress.com (Jetpack 12.1; WordPress 6.1)" 180.252.89.49 - - [16/Jul/2026:14:34:52 +0200] "POST /xmlrpc.php HTTP/1.1" 200 6476 "-" "Jetpack/12.0; WordPress/6.2; http://site19188976.com" show less	Hacking Web App Attack
🇫🇷 SpaceHost-Server	2026-07-16 12:19:27 (1 day ago)	180.252.89.49 - - [16/Jul/2026:14:19:05 +0200] "POST /xmlrpc.php HTTP/1.1" 200 6476 "-" "Jetpack/13. ... show more 180.252.89.49 - - [16/Jul/2026:14:19:05 +0200] "POST /xmlrpc.php HTTP/1.1" 200 6476 "-" "Jetpack/13.0; WordPress/6.1; http://site56824136.com" 180.252.89.49 - - [16/Jul/2026:14:19:15 +0200] "POST /xmlrpc.php HTTP/1.1" 200 6476 "-" "Jetpack by WordPress.com" 180.252.89.49 - - [16/Jul/2026:14:19:26 +0200] "POST /xmlrpc.php HTTP/1.1" 200 6476 "-" "WordPress.com; https://wordpress.com" show less	Hacking Web App Attack
🇫🇷 dynamix	2026-07-16 09:46:07 (1 day ago)	WordPress XMLRPC Brute Force Attack	Brute-Force Web App Attack
Anonymous	2026-07-16 02:45:56 (1 day ago)	[redacted] 180.252.89.49 - - [16/Jul/2026:04:45:12 +0200] "POST /xmlrpc.php HTTP/1.1" 405 428 "-" "J ... show more [redacted] 180.252.89.49 - - [16/Jul/2026:04:45:12 +0200] "POST /xmlrpc.php HTTP/1.1" 405 428 "-" "Jetpack by WordPress.com" [redacted] 180.252.89.49 - - [16/Jul/2026:04:45:22 +0200] "POST /xmlrpc.php HTTP/1.1" 405 428 "-" "Jetpack/12.0; WordPress/6.4; http://site55439968.com" [redacted] 180.252.89.49 - - [16/Jul/2026:04:45:33 +0200] "POST /xmlrpc.php HTTP/1.1" 405 428 "-" "WordPress.com; https://wordpress.com" [redacted] 180.252.89.49 - - [16/Jul/2026:04:45:44 +0200] "POST /xmlrpc.php HTTP/1.1" 405 428 "-" "WordPress.com; https://wordpress.com" [redacted] 180.252.89.49 - - [16/Jul/2026:04:45:55 +0200] "POST /xmlrpc.php HTTP/1.1" 405 428 "-" "Jetpack by WordPress.com (Jetpack 12.1; WordPress 6.4)" ... show less	Hacking Web App Attack
🇺🇸 TPI-Abuse	2026-07-15 23:32:40 (1 day ago)	(mod_security) mod_security (id:240335) triggered by 180.252.89.49 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:240335) triggered by 180.252.89.49 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jul 15 19:32:36.825025 2026] [security2:error] [pid 13374:tid 13390] [client 180.252.89.49:55331] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 180.252.89.49 (+1 hits since last alert)\|thecraftsycat.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "thecraftsycat.com"] [uri "/xmlrpc.php"] [unique_id "algYlBHa6m3TqMftN73DsAAAAM0"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 kosada.com	2026-07-14 06:18:06 (3 days ago)	Web bot: denial-of-service flood	DDoS Attack Bad Web Bot
🇮🇩 hermawan	2025-07-08 10:55:02 (1 year ago)	[Tue Jul 08 17:55:01.370101 2025] [security2:error] [pid 406106:tid 139798313383616] [client 180.252 ... show more [Tue Jul 08 17:55:01.370101 2025] [security2:error] [pid 406106:tid 139798313383616] [client 180.252.89.49:44654] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "utf-8" at REQUEST_HEADERS:Accept-Charset. [file "/etc/modsecurity/coreruleset-4.15.0/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "332"] [id "440015"] [msg "Bot Accept-Charset utf-8"] [data "Matched Data: utf-8 found within REQUEST_HEADERS:Accept-Charset: UTF-8 request_line = GET /images/Klimatologi/Prakiraan/04_Prakiraan_6_Bulanan/Prakiraan_Musim/Prakiraan_Musim_Kemarau/Provinsi_Jawa_Timur/2023/Peta_Prakiraan_Puncak_Musim_Kemarau_Tahun_2023_Zona_Musim_di_Provinsi_Jawa_Timur.jpg HTTP/2.0"] [severity "NOTICE"] [hostname "staklim-jatim.bmkg.go.id"] [uri "/images/Klimatologi/Prakiraan/04_Prakiraan_6_Bulanan/Prakiraan_Musim/Prakiraan_Musim_Kemarau/Provinsi_Jawa_Timur/2023/Peta_Prakiraan_Puncak_Musim_Kemarau_Tahun_2023_Zona_Musim_di_Provinsi_Jawa_Timur.jpg"] [unique_id "aGz5BU8v2g4t8j85XiQkmwABiw4"] [stak ... show less	Hacking Web App Attack
🇦🇹 urnilxfgbez	2024-07-19 22:45:00 (1 year ago)	Last 24 Hours suspicious: (DPT=445\|DPT=3389\|DPT=22\|DPT=3306\|DPT=8080\|DPT=23\|DPT=5900\|DPT=1433)	Port Scan
🇩🇪 IP Analyzer	2024-07-19 02:30:29 (1 year ago)	Unauthorized connection attempt from IP address 180.252.89.49 on Port 445(SMB)	Port Scan

Showing 1 to 15 of 23 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇨🇦 2400:cb00:785:1000:1035:4b9e:e7c1:b137

🇩🇪 167.71.32.67

🇫🇷 92.205.57.72

🇺🇸 40.80.200.186

🇬🇧 35.203.211.42

🇺🇸 205.210.31.102

172.22.35.186

🇩🇪 165.227.172.206

🇺🇸 162.216.149.172

🇫🇷 91.231.89.181

🇫🇷 91.231.89.176

🇬🇧 77.68.29.20

🇧🇪 198.235.24.248

🇩🇪 195.63.31.42

192.168.212.221

172.23.150.56

🇺🇸 162.216.150.123

🇩🇪 84.172.181.174

🇱🇹 77.90.185.20

🇺🇦 31.42.184.154