JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 182.11.154.5

182.11.154.5 was found in our database!

This IP was reported 39 times. Confidence of Abuse is 100%: ?

100%

ISP	PT. Telekomunikasi Selular (Telkomsel) Indonesia
Usage Type	Fixed Line ISP
ASN	AS23693
Domain Name	telkomsel.co.id
Country	🇮🇩 Indonesia
City	Pontianak, West Kalimantan

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 182.11.154.5

Whois 182.11.154.5

IP Abuse Reports for 182.11.154.5:

This IP address has been reported a total of 39 times from 28 distinct sources. 182.11.154.5 was first reported on October 13th 2025, and the most recent report was 3 days ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇮🇩 sockominfo	2026-07-24 15:00:53 (3 days ago)	Access to sensitive files detected w/ specific boundary.. Threat Score: 5/10 (MEDIUM). Confidence: 4 ... show more Access to sensitive files detected w/ specific boundary.. Threat Score: 5/10 (MEDIUM). Confidence: 40%. CVSS v3.1: 2.9/10 (Low). CVSS Vector: CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N. Bayesian Probability: 40%. MITRE ATT&CK: T1016 (System Network Configuration Discovery). Tactic: TA0001. Freshness: Fresh. Source Reputation: UNKNOWN. Methodology: CVSS 3.1 + Bayesian + Temporal + Environmental + MITRE ATT&CK + OWASP. Standards: ISO/IEC 27065:2022, NIST SP 800-30, IEEE S&P 2020. Reported by TangerangKota-CSIRT. Status: MALICIOUS show less	Hacking Web App Attack
🇮🇩 sockominfo	2026-07-24 14:00:11 (3 days ago)	Access to sensitive files detected w/ specific boundary.. Threat Score: 5.7/10 (MEDIUM). Reported by ... show more Access to sensitive files detected w/ specific boundary.. Threat Score: 5.7/10 (MEDIUM). Reported by TangerangKota-CSIRT show less	Hacking Web App Attack
🇮🇩 sockominfo	2026-07-24 13:00:08 (3 days ago)	Access to sensitive files detected w/ specific boundary.. Threat Score: 5.8/10 (MEDIUM). Reported by ... show more Access to sensitive files detected w/ specific boundary.. Threat Score: 5.8/10 (MEDIUM). Reported by TangerangKota-CSIRT show less	Hacking Web App Attack
🇺🇸 xmission.com	2026-07-24 10:51:47 (3 days ago)	Blocked by UFW (TCP on 443) Source port: 10056 TTL: 43 Packet length: 60 TOS: 0x00 This report (for ... show more Blocked by UFW (TCP on 443) Source port: 10056 TTL: 43 Packet length: 60 TOS: 0x00 This report (for 182.11.154.5) was generated by: https://github.com/sefinek/UFW-AbuseIPDB-Reporter show less	Port Scan Web App Attack
🇦🇺 paulshipley.com.au	2026-07-24 09:07:27 (3 days ago)	[Fri Jul 24 19:07:26.932129 2026] [security2:error] [pid 622950] [client 182.11.154.5:9328] [client ... show more [Fri Jul 24 19:07:26.932129 2026] [security2:error] [pid 622950] [client 182.11.154.5:9328] [client 182.11.154.5] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/modsecurity/crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.4"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "valueaddedpromotions.com.au"] [uri "/"] [unique_id "amMrTot8u_4k2p99TT6tQgAAAAE"] ... show less	Web App Attack
Anonymous	2026-07-24 08:50:28 (3 days ago)	182.11.154.5 - - [24/Jul/2026:08:50:27 +0000] "GET /.vscode/sftp.json HTTP/1.1" 404 49684 "-" "Mozil ... show more 182.11.154.5 - - [24/Jul/2026:08:50:27 +0000] "GET /.vscode/sftp.json HTTP/1.1" 404 49684 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" ... show less	Bad Web Bot Web App Attack
🇩🇪 FeG Deutschland	2026-07-24 08:44:17 (3 days ago)	Looking for CMS/PHP/SQL vulnerablilities/excessive crawling - 124	Exploited Host Web App Attack
🇦🇺 paulshipley.com.au	2026-07-24 08:30:39 (3 days ago)	[Fri Jul 24 18:30:39.134817 2026] [security2:error] [pid 622950] [client 182.11.154.5:1899] [client ... show more [Fri Jul 24 18:30:39.134817 2026] [security2:error] [pid 622950] [client 182.11.154.5:1899] [client 182.11.154.5] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/modsecurity/crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.4"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "valueaddedpromotions.com.au"] [uri "/"] [unique_id "amMir4t8u_4k2p99TT6tEwAAAAE"] ... show less	Web App Attack
🇮🇳 evicky2002	2026-07-24 06:00:00 (3 days ago)	Confirmed malicious by STILWaters CTI platform (score=100, sources=1)	Hacking Brute-Force SSH
🇬🇧 AvonleaConsulting	2026-07-23 22:59:07 (3 days ago)	Attempts to probe web pages for vulnerable PHP or other applications	Web App Attack
🇩🇪 4server	2026-07-23 17:43:36 (4 days ago)	[ThuJul2319:43:32.7172962026][security2:error][pid2065132:tid2065148][client182.11.154.5:0]ModSecuri ... show more [ThuJul2319:43:32.7172962026][security2:error][pid2065132:tid2065148][client182.11.154.5:0]ModSecurity:Accessdeniedwithcode403\(phase2\).OperatorGEmatched5atTX:anomaly_score.[file\"/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf\"][line\"94\"][id\"949110\"][msg\"InboundAnomalyScoreExceeded\(TotalScore:5\)\"][severity\"CRITICAL\"][ver\"OWASP_CRS/3.3.10\"][tag\"application-multi\"][tag\"language-multi\"][tag\"platform-multi\"][tag\"attack-generic\"][hostname\"www.maurokorangraf.ch\"][uri\"/\"][unique_id\"amJSxDw0l2O1y3-ChTWx8AAAAQA\"] show less	Port Scan Brute-Force Web App Attack
🇫🇷 Sklurk	2026-07-23 09:48:38 (4 days ago)	Web App Attack	Web App Attack
🇩🇪 FeG Deutschland	2026-07-23 07:02:33 (4 days ago)	Looking for CMS/PHP/SQL vulnerablilities/excessive crawling - 124	Exploited Host Web App Attack
🇬🇧 AvonleaConsulting	2026-07-23 06:08:59 (4 days ago)	Scanning unused Default website or suspicious access to valid sites from IP marked as abusive	Bad Web Bot Web App Attack
🇺🇸 deskpass.com	2026-07-22 18:44:21 (5 days ago)	GET /index.php	Web App Attack

Showing 1 to 15 of 39 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇺🇦 213.231.16.197

🇸🇪 171.25.158.24

🇯🇵 160.251.215.51

🇭🇰 156.225.1.10

🇨🇳 120.239.176.208

🇮🇳 110.44.1.131

🇺🇸 66.132.195.86

🇺🇸 66.132.172.101

🇩🇪 31.70.84.142

🇺🇸 13.57.27.134

🇯🇵 203.80.139.109

🇳🇱 193.176.31.153

🇫🇮 147.185.133.243

🇻🇳 27.71.230.31

🇺🇸 205.210.31.69

🇨🇷 190.171.112.48

🇫🇷 176.31.21.38

🇭🇰 103.210.237.224

🇩🇪 88.99.165.22

🇺🇸 76.127.119.129