JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 182.52.137.227

182.52.137.227 was found in our database!

This IP was reported 25 times. Confidence of Abuse is 61%: ?

61%

ISP	TOT Public Company Limited
Usage Type	Fixed Line ISP
ASN	AS23969
Hostname(s)	node-r8j.pool-182-52.dynamic.nt-isp.net
Domain Name	totidc.net
Country	🇹🇭 Thailand
City	Chiang Mai, Chiang Mai

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 182.52.137.227

Whois 182.52.137.227

IP Abuse Reports for 182.52.137.227:

This IP address has been reported a total of 25 times from 19 distinct sources. 182.52.137.227 was first reported on December 14th 2020, and the most recent report was 1 minute ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇺🇸 TPI-Abuse	2026-07-03 01:15:53 (1 minute ago)	(mod_security) mod_security (id:240335) triggered by 182.52.137.227 (node-r8j.pool-182-52.dynamic.nt ... show more (mod_security) mod_security (id:240335) triggered by 182.52.137.227 (node-r8j.pool-182-52.dynamic.nt-isp.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jul 02 21:15:47.586956 2026] [security2:error] [pid 2919:tid 2940] [client 182.52.137.227:57596] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 182.52.137.227 (+1 hits since last alert)\|koalacogs.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "koalacogs.com"] [uri "/xmlrpc.php"] [unique_id "akcNQwWokMFW3J-okbeuGgAAANI"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-07-02 23:43:19 (1 hour ago)	(mod_security) mod_security (id:240335) triggered by 182.52.137.227 (node-r8j.pool-182-52.dynamic.nt ... show more (mod_security) mod_security (id:240335) triggered by 182.52.137.227 (node-r8j.pool-182-52.dynamic.nt-isp.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jul 02 19:43:14.663404 2026] [security2:error] [pid 17479:tid 17479] [client 182.52.137.227:52856] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 182.52.137.227 (+1 hits since last alert)\|jesussotoca.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "jesussotoca.com"] [uri "/xmlrpc.php"] [unique_id "akb3kn2IEr7VM5G-oQbvqwAAAAY"] show less	Brute-Force Bad Web Bot Web App Attack
Anonymous	2026-07-02 20:05:57 (5 hours ago)	(wordpress) Failed wordpress login from 182.52.137.227 (TH/Thailand/node-r8j.pool-182-52.dynamic.nt- ... show more (wordpress) Failed wordpress login from 182.52.137.227 (TH/Thailand/node-r8j.pool-182-52.dynamic.nt-isp.net) show less	Brute-Force
🇺🇸 WeekendWeb	2026-07-02 20:05:04 (5 hours ago)	Wordpress Vunerability attack	Web App Attack
🇺🇸 TPI-Abuse	2026-07-02 15:01:54 (10 hours ago)	(mod_security) mod_security (id:240335) triggered by 182.52.137.227 (node-r8j.pool-182-52.dynamic.nt ... show more (mod_security) mod_security (id:240335) triggered by 182.52.137.227 (node-r8j.pool-182-52.dynamic.nt-isp.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jul 02 11:01:46.595555 2026] [security2:error] [pid 8697:tid 8697] [client 182.52.137.227:61053] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 182.52.137.227 (+1 hits since last alert)\|transcapitalsolutions.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "transcapitalsolutions.com"] [uri "/xmlrpc.php"] [unique_id "akZ9WhZtktjOvd7vXQcifQAAAAM"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-07-02 12:59:36 (12 hours ago)	(mod_security) mod_security (id:240335) triggered by 182.52.137.227 (node-r8j.pool-182-52.dynamic.nt ... show more (mod_security) mod_security (id:240335) triggered by 182.52.137.227 (node-r8j.pool-182-52.dynamic.nt-isp.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jul 02 08:59:31.607304 2026] [security2:error] [pid 26409:tid 26409] [client 182.52.137.227:59994] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 182.52.137.227 (+1 hits since last alert)\|frelsburg.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "frelsburg.com"] [uri "/xmlrpc.php"] [unique_id "akZgsy3AYCG4TvNimxeqoAAAAAk"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 integrantservices.com	2026-07-02 12:57:18 (12 hours ago)	(wordpress) Failed wordpress login from 182.52.137.227 (TH/Thailand/node-r8j.pool-182-52.dynamic.nt- ... show more (wordpress) Failed wordpress login from 182.52.137.227 (TH/Thailand/node-r8j.pool-182-52.dynamic.nt-isp.net) show less	Brute-Force
🇫🇷 dynamix	2026-07-02 10:37:45 (14 hours ago)	WordPress XMLRPC Brute Force Attack	Brute-Force Web App Attack
Anonymous	2026-07-02 06:02:38 (19 hours ago)	182.52.137.227 - - [02/Jul/2026:08:02:26 +0200] "POST /xmlrpc.php HTTP/1.1" 405 428 182.52.137.227 - ... show more 182.52.137.227 - - [02/Jul/2026:08:02:26 +0200] "POST /xmlrpc.php HTTP/1.1" 405 428 182.52.137.227 - - [02/Jul/2026:08:02:36 +0200] "POST /xmlrpc.php HTTP/1.1" 405 428 ... show less	Brute-Force Bad Web Bot
🇩🇪 Marc	2026-07-02 05:33:13 (19 hours ago)	182.52.137.227 - - [02/Jul/2026:07:32:53 +0200] "POST /xmlrpc.php HTTP/1.1" 200 3298 "-" "Jetpack/13 ... show more 182.52.137.227 - - [02/Jul/2026:07:32:53 +0200] "POST /xmlrpc.php HTTP/1.1" 200 3298 "-" "Jetpack/13.0; WordPress/6.4; http://site29729541.com" 182.52.137.227 - - [02/Jul/2026:07:33:02 +0200] "POST /xmlrpc.php HTTP/1.1" 200 3298 "-" "WordPress.com; https://wordpress.com" 182.52.137.227 - - [02/Jul/2026:07:33:13 +0200] "POST /xmlrpc.php HTTP/1.1" 200 3299 "-" "Jetpack by WordPress.com" show less	Brute-Force Web App Attack
🇺🇸 TPI-Abuse	2026-07-02 05:04:47 (20 hours ago)	(mod_security) mod_security (id:240335) triggered by 182.52.137.227 (node-r8j.pool-182-52.dynamic.nt ... show more (mod_security) mod_security (id:240335) triggered by 182.52.137.227 (node-r8j.pool-182-52.dynamic.nt-isp.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jul 02 01:04:41.861702 2026] [security2:error] [pid 8333:tid 8333] [client 182.52.137.227:56358] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5965"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 182.52.137.227 (+1 hits since last alert)\|pathpa.org\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "pathpa.org"] [uri "/xmlrpc.php"] [unique_id "akXxaddmWurvKg9YCr3cagAAAAE"] show less	Brute-Force Bad Web Bot Web App Attack
🇪🇸 DXC-0	2026-06-04 03:00:44 (4 weeks ago)	Multiple attacks on Honeypot servers	Web Spam Brute-Force Web App Attack Hacking
🇬🇧 Birdo	2026-06-03 12:14:55 (4 weeks ago)	[Birdo SMB Honeypot] SMB unauthorized attempt	Exploited Host Brute-Force Port Scan Hacking
Anonymous	2026-06-02 17:56:03 (1 month ago)	Unauthorized access (tcp/445/smb)	Port Scan
🇬🇧 PeravixGroup	2026-05-31 16:45:58 (1 month ago)	Honeypot detection: SMB / Windows file sharing exploitation attempt on port 445. Severity: HIGH. Aar ... show more Honeypot detection: SMB / Windows file sharing exploitation attempt on port 445. Severity: HIGH. Aaran.cloud show less	Hacking Exploited Host

Showing 1 to 15 of 25 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇮🇪 2a05:d018:10df:d402:cf74:b45d:db44:53e3

🇺🇸 2a03:2880:2ff:10a::

🇧🇪 198.235.24.201

🇭🇰 150.5.169.138

🇬🇧 87.236.176.192

🇳🇱 45.148.10.152

🇺🇸 45.140.206.177

🇮🇪 2a05:d018:10df:d402:98b5:e0c0:d965:2f5

🇮🇪 2a05:d018:10df:d402:9544:98c9:985d:3ca1

🇮🇪 2a05:d018:10df:d402:8f23:d29a:e91a:79ec

🇹🇼 198.235.24.116

🇦🇲 195.250.79.2

🇫🇮 185.75.135.220

🇬🇧 161.35.45.184

🇮🇳 152.56.254.118

🇨🇳 111.226.237.201

🇮🇹 101.57.22.1

🇬🇧 87.236.176.27

🇺🇸 66.132.172.128

🇺🇸 65.49.1.108