JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 182.2.165.104

182.2.165.104 was found in our database!

This IP was reported 17 times. Confidence of Abuse is 30%: ?

30%

ISP	PT. Telekomunikasi Selular (Telkomsel) Indonesia
Usage Type	Mobile ISP
ASN	AS23693
Domain Name	telkomsel.co.id
Country	🇮🇩 Indonesia
City	Jakarta, Jakarta

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 182.2.165.104

Whois 182.2.165.104

IP Abuse Reports for 182.2.165.104:

This IP address has been reported a total of 17 times from 6 distinct sources. 182.2.165.104 was first reported on February 11th 2025, and the most recent report was 1 day ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇺🇸 TPI-Abuse	2026-07-30 14:02:42 (1 day ago)	(mod_security) mod_security (id:240335) triggered by 182.2.165.104 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:240335) triggered by 182.2.165.104 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jul 30 10:02:34.353977 2026] [security2:error] [pid 1507623:tid 1507623] [client 182.2.165.104:54977] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 182.2.165.104 (+1 hits since last alert)\|lajoze.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "lajoze.com"] [uri "/xmlrpc.php"] [unique_id "amtZennHU3KyJT0bUOwRqQAAAA4"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-07-30 09:24:58 (1 day ago)	(mod_security) mod_security (id:240335) triggered by 182.2.165.104 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:240335) triggered by 182.2.165.104 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jul 30 05:24:51.285973 2026] [security2:error] [pid 1991972:tid 1991972] [client 182.2.165.104:56845] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5965"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 182.2.165.104 (+1 hits since last alert)\|newcitypark.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "newcitypark.com"] [uri "/xmlrpc.php"] [unique_id "amsYYyChfAzTCw490GoukAAAAAI"] show less	Brute-Force Bad Web Bot Web App Attack
🇫🇷 dynamix	2026-07-30 08:06:25 (1 day ago)	WordPress XMLRPC Brute Force Attack	Brute-Force Web App Attack
🇺🇸 TPI-Abuse	2026-07-30 07:47:45 (1 day ago)	(mod_security) mod_security (id:240335) triggered by 182.2.165.104 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:240335) triggered by 182.2.165.104 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jul 30 03:47:39.876931 2026] [security2:error] [pid 1855448:tid 1855448] [client 182.2.165.104:56864] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 182.2.165.104 (+1 hits since last alert)\|virtualmediamasters.net\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "virtualmediamasters.net"] [uri "/xmlrpc.php"] [unique_id "amsBm-eNO89TUHrE7Bqk_QAAACU"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-07-30 07:04:33 (1 day ago)	(mod_security) mod_security (id:240335) triggered by 182.2.165.104 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:240335) triggered by 182.2.165.104 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jul 30 03:04:25.086628 2026] [security2:error] [pid 146849:tid 146849] [client 182.2.165.104:50980] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 182.2.165.104 (+1 hits since last alert)\|georgegourmet.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "georgegourmet.com"] [uri "/xmlrpc.php"] [unique_id "amr3eVGoKa15CXDXQ1zqKwAAABI"] show less	Brute-Force Bad Web Bot Web App Attack
🇩🇪 LRob	2026-07-30 07:04:01 (1 day ago)	CrowdSec: crowdsecurity/http-bf-wordpress_bf_xmlrpc \| req: /xmlrpc.php \| UA: Jetpack by WordPress.co ... show more CrowdSec: crowdsecurity/http-bf-wordpress_bf_xmlrpc \| req: /xmlrpc.php \| UA: Jetpack by WordPress.com (Jetpack 12.5; WordPress 6.3) show less	Brute-Force Web App Attack
🇮🇩 sockominfo	2026-07-24 13:00:53 (1 week ago)	User login to application from malicious IP 182.2.165.104.. Threat Score: 3.6/10 (LOW). Confidence: ... show more User login to application from malicious IP 182.2.165.104.. Threat Score: 3.6/10 (LOW). Confidence: 30%. CVSS v3.1: 0/10 (None). CVSS Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:N. Bayesian Probability: 40%. MITRE ATT&CK: T1016 (System Network Configuration Discovery). Tactic: TA0001. Freshness: Fresh. Source Reputation: UNKNOWN. Methodology: CVSS 3.1 + Bayesian + Temporal + Environmental + MITRE ATT&CK + OWASP. Standards: ISO/IEC 27065:2022, NIST SP 800-30, IEEE S&P 2020. Reported by TangerangKota-CSIRT show less	Hacking Web App Attack
🇮🇩 sockominfo	2026-07-24 12:00:52 (1 week ago)	User login to application from malicious IP 182.2.165.104.. Threat Score: 3.8/10 (LOW). Confidence: ... show more User login to application from malicious IP 182.2.165.104.. Threat Score: 3.8/10 (LOW). Confidence: 30%. CVSS v3.1: 0/10 (None). CVSS Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:N. Bayesian Probability: 40%. MITRE ATT&CK: T1016 (System Network Configuration Discovery). Tactic: TA0001. Freshness: Fresh. Source Reputation: UNKNOWN. Methodology: CVSS 3.1 + Bayesian + Temporal + Environmental + MITRE ATT&CK + OWASP. Standards: ISO/IEC 27065:2022, NIST SP 800-30, IEEE S&P 2020. Reported by TangerangKota-CSIRT show less	Hacking Web App Attack
🇮🇩 sockominfo	2026-07-24 11:00:53 (1 week ago)	User login to application from malicious IP 182.2.165.104.. Threat Score: 3.9/10 (LOW). Confidence: ... show more User login to application from malicious IP 182.2.165.104.. Threat Score: 3.9/10 (LOW). Confidence: 30%. CVSS v3.1: 0/10 (None). CVSS Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:N. Bayesian Probability: 40%. MITRE ATT&CK: T1016 (System Network Configuration Discovery). Tactic: TA0001. Freshness: Very Fresh. Source Reputation: UNKNOWN. Methodology: CVSS 3.1 + Bayesian + Temporal + Environmental + MITRE ATT&CK + OWASP. Standards: ISO/IEC 27065:2022, NIST SP 800-30, IEEE S&P 2020. Reported by TangerangKota-CSIRT show less	Hacking Web App Attack
🇮🇩 sockominfo	2026-07-17 14:00:53 (2 weeks ago)	User login to application from malicious IP 182.2.165.104.. Threat Score: 4/10 (MEDIUM). Confidence: ... show more User login to application from malicious IP 182.2.165.104.. Threat Score: 4/10 (MEDIUM). Confidence: 40%. CVSS v3.1: 0/10 (None). CVSS Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:N. Bayesian Probability: 57%. MITRE ATT&CK: T1016 (System Network Configuration Discovery). Tactic: TA0001. Freshness: Fresh. Source Reputation: UNKNOWN. Methodology: CVSS 3.1 + Bayesian + Temporal + Environmental + MITRE ATT&CK + OWASP. Standards: ISO/IEC 27065:2022, NIST SP 800-30, IEEE S&P 2020. Reported by TangerangKota-CSIRT. Status: MALICIOUS show less	Hacking Web App Attack
🇮🇩 sockominfo	2026-07-17 13:00:52 (2 weeks ago)	User login to application from malicious IP 182.2.165.104.. Threat Score: 4.1/10 (MEDIUM). Confidenc ... show more User login to application from malicious IP 182.2.165.104.. Threat Score: 4.1/10 (MEDIUM). Confidence: 40%. CVSS v3.1: 0/10 (None). CVSS Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:N. Bayesian Probability: 57%. MITRE ATT&CK: T1016 (System Network Configuration Discovery). Tactic: TA0001. Freshness: Fresh. Source Reputation: UNKNOWN. Methodology: CVSS 3.1 + Bayesian + Temporal + Environmental + MITRE ATT&CK + OWASP. Standards: ISO/IEC 27065:2022, NIST SP 800-30, IEEE S&P 2020. Reported by TangerangKota-CSIRT. Status: MALICIOUS show less	Hacking Web App Attack
🇮🇩 sockominfo	2026-07-17 12:00:09 (2 weeks ago)	User login to application from malicious IP 182.2.165.104.. Threat Score: 0/10 (INFORMATIONAL). Repo ... show more User login to application from malicious IP 182.2.165.104.. Threat Score: 0/10 (INFORMATIONAL). Reported by TangerangKota-CSIRT show less	Hacking Web App Attack
🇺🇸 TPI-Abuse	2026-07-11 13:30:18 (2 weeks ago)	(mod_security) mod_security (id:240335) triggered by 182.2.165.104 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:240335) triggered by 182.2.165.104 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Jul 11 09:30:14.852121 2026] [security2:error] [pid 20431:tid 20431] [client 182.2.165.104:50917] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5965"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 182.2.165.104 (+1 hits since last alert)\|renomarsh.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "renomarsh.com"] [uri "/xmlrpc.php"] [unique_id "alJFZhn0TO9arLNV7z7RlgAAAAs"] show less	Brute-Force Bad Web Bot Web App Attack
🇫🇷 dynamix	2026-07-10 14:20:33 (3 weeks ago)	WordPress XMLRPC Brute Force Attack	Brute-Force Web App Attack
🇳🇱 exxos	2025-08-29 23:03:01 (11 months ago)	Attacks with Bad user agents	Hacking

Showing 1 to 15 of 17 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇳🇱 195.178.110.232

🇺🇸 45.156.129.159

🇳🇱 45.148.10.183

🇲🇽 187.212.37.143

🇪🇪 162.212.170.252

🇲🇾 113.211.214.43

🇨🇳 106.52.49.148

🇳🇱 85.11.167.7

🇮🇸 82.221.113.209

🇪🇸 37.15.117.160

🇨🇳 221.0.103.81

🇧🇷 177.130.86.57

🇺🇸 144.172.110.92

🇨🇳 113.90.238.79

🇲🇺 102.117.11.174

🇳🇱 45.148.10.151

🇧🇷 38.191.150.129

🇺🇸 34.181.217.92

🇺🇸 2607:f8b0:4001:c19::125

🇪🇸 196.196.150.100