JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 202.152.139.194

202.152.139.194 was found in our database!

This IP was reported 86 times. Confidence of Abuse is 55%: ?

55%

ISP	PT Jembatain Citra Nusantara
Usage Type	Fixed Line ISP
ASN	AS23951
Hostname(s)	202-152-139-194.citra.net.id
Domain Name	citra.net.id
Country	🇮🇩 Indonesia
City	Surakarta, Central Java

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 202.152.139.194

Whois 202.152.139.194

IP Abuse Reports for 202.152.139.194:

This IP address has been reported a total of 86 times from 50 distinct sources. 202.152.139.194 was first reported on August 28th 2024, and the most recent report was 6 days ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇫🇷 Sklurk	2026-07-15 13:30:49 (6 days ago)	Web App Attack	Web App Attack
🇬🇷 setupgr	2026-07-14 06:01:36 (1 week ago)	(XMLRPC) WP XMLRPC Attack 202.152.139.194 (ID/Indonesia/Central Java/Surakarta/-/[AS23951 CITRA-AS-I ... show more (XMLRPC) WP XMLRPC Attack 202.152.139.194 (ID/Indonesia/Central Java/Surakarta/-/[AS23951 CITRA-AS-ID PT JEMBATAN CITRA NUSANTARA]): 1 in the last 86400 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: 202.152.139.194 - - [14/Jul/2026:08:55:37 +0300] "POST /xmlrpc.php HTTP/1.1" 404 89199 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; x86) AppleWebKit/537.36 (KHTML, like Gecko) Firefox/100.0.0.0 Safari/537.36" show less	Port Scan
🇺🇸 TPI-Abuse	2026-07-14 00:31:15 (1 week ago)	(mod_security) mod_security (id:225170) triggered by 202.152.139.194 (202-152-139-194.citra.net.id): ... show more (mod_security) mod_security (id:225170) triggered by 202.152.139.194 (202-152-139-194.citra.net.id): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jul 13 20:31:11.884073 2026] [security2:error] [pid 27554:tid 27554] [client 202.152.139.194:65001] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)\|\|greenlight.us\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "greenlight.us"] [uri "/wp-json/wp/v2/users"] [unique_id "alWDTxdXxVsu-hsbgNJRGwAAAAw"] show less	Brute-Force Bad Web Bot Web App Attack
Anonymous	2026-07-13 13:56:50 (1 week ago)	(wordpress) Failed wordpress login from 202.152.139.194 (ID/Indonesia/202-152-139-194.citra.net.id)	Brute-Force
🇺🇸 TPI-Abuse	2026-07-13 02:30:41 (1 week ago)	(mod_security) mod_security (id:225170) triggered by 202.152.139.194 (202-152-139-194.citra.net.id): ... show more (mod_security) mod_security (id:225170) triggered by 202.152.139.194 (202-152-139-194.citra.net.id): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Jul 12 22:30:19.619813 2026] [security2:error] [pid 13435:tid 13440] [client 202.152.139.194:61324] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)\|\|fastestcopyright.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "fastestcopyright.com"] [uri "/wp-json/wp/v2/users"] [unique_id "alRNu_zZPmP0rNjB8yLirQAAAYI"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-07-12 01:45:48 (1 week ago)	(mod_security) mod_security (id:225170) triggered by 202.152.139.194 (202-152-139-194.citra.net.id): ... show more (mod_security) mod_security (id:225170) triggered by 202.152.139.194 (202-152-139-194.citra.net.id): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Jul 11 21:45:39.989932 2026] [security2:error] [pid 18090:tid 18090] [client 202.152.139.194:61222] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)\|\|fadcometal.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "fadcometal.com"] [uri "/wp-json/wp/v2/users"] [unique_id "alLxw6hGHyuydJtJzzbK2wAAAAw"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 kosada.com	2026-07-11 18:31:08 (1 week ago)	Web bot: denial-of-service flood	DDoS Attack Bad Web Bot
🇩🇪 Holger	2026-06-13 12:34:27 (1 month ago)	WordPress WebAttack	Brute-Force Web App Attack
🇩🇪 Holger	2026-06-11 09:27:46 (1 month ago)	WordPress WebAttack	Brute-Force Web App Attack
🇬🇧 consul.to	2026-06-10 08:02:52 (1 month ago)	Web attack/malicious scanning detected	Web App Attack
🇮🇩 soc-yk	2026-06-09 14:30:12 (1 month ago)	Type: suspicious_network_activity Risk: 87 Events: 77 Evidence: - Persistent suspicious network act ... show more Type: suspicious_network_activity Risk: 87 Events: 77 Evidence: - Persistent suspicious network activity detected - Repeated hostile operational behavior observed - Multi-event operational persistence identified - Threat escalation behavior observed show less	Port Scan Hacking
🇳🇱 BlueWire Hosting	2026-06-09 01:37:25 (1 month ago)	Probing websites for vulnerabilities	Web App Attack
🇩🇪 Holger	2026-06-08 14:14:53 (1 month ago)	WordPress WebAttack	Brute-Force Web App Attack
🇩🇪 big-cloud.nl	2026-06-08 13:13:40 (1 month ago)	Try to access /xmlrpc.php	Web App Attack
Anonymous	2026-06-08 12:27:25 (1 month ago)	Automated report (2026-06-08T08:27:25-04:00). POST RFI detected.	Hacking

Showing 1 to 15 of 86 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇧🇷 200.11.123.241

🇬🇧 185.247.137.127

🇩🇪 165.154.138.123

🇺🇸 109.105.210.89

🇺🇸 109.105.210.88

🇫🇷 91.231.89.128

🇺🇸 66.132.172.201

🇺🇸 35.222.246.223

🇨🇳 1.83.125.47

🇳🇱 195.178.110.30

🇺🇸 162.216.150.10

🇺🇸 109.105.210.90

🇳🇱 89.124.87.116

🇷🇺 85.95.166.40

🇺🇸 66.132.195.44

🇳🇱 45.148.10.151

🇰🇷 221.162.218.85

🇸🇬 148.66.142.9

🇨🇳 110.249.201.74

🇮🇳 103.174.103.19