JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 202.152.156.202

202.152.156.202 was found in our database!

This IP was reported 27 times. Confidence of Abuse is 72%: ?

72%

ISP	PT Jembatain Citra Nusantara
Usage Type	Fixed Line ISP
ASN	AS23951
Hostname(s)	202-152-156-202.pwkt.citra.net.id
Domain Name	citra.net.id
Country	🇮🇩 Indonesia
City	Yogyakarta, Yogyakarta

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 202.152.156.202

Whois 202.152.156.202

IP Abuse Reports for 202.152.156.202:

This IP address has been reported a total of 27 times from 12 distinct sources. 202.152.156.202 was first reported on June 13th 2026, and the most recent report was 4 hours ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇪🇸 masterguru	2026-07-03 07:28:15 (4 hours ago)	(xmlrpc) Failed xmlrpc access from 202.152.156.202 (ID/Indonesia/202-152-156-202.pwkt.citra.net.id): ... show more (xmlrpc) Failed xmlrpc access from 202.152.156.202 (ID/Indonesia/202-152-156-202.pwkt.citra.net.id): 5 in the last 3600 secs (0-122) show less	Hacking
Anonymous	2026-07-03 07:26:03 (4 hours ago)	Bot / scanning and/or hacking attempts: POST /xmlrpc.php HTTP/1.1	Hacking Web App Attack
🇩🇪 BlueWire Hosting	2026-07-03 01:23:49 (10 hours ago)	Probing websites for vulnerabilities	Web App Attack
🇫🇷 dynamix	2026-07-03 00:22:13 (11 hours ago)	WordPress XMLRPC Brute Force Attack	Brute-Force Web App Attack
🇩🇪 konseptit	2026-07-02 16:51:55 (19 hours ago)	(wordpress) Failed wordpress login from 202.152.156.202 (ID/Indonesia/202-152-156-202.pwkt.citra.net ... show more (wordpress) Failed wordpress login from 202.152.156.202 (ID/Indonesia/202-152-156-202.pwkt.citra.net.id) show less	Brute-Force
🇦🇺 screwlooseit.com.au	2026-07-02 06:23:27 (1 day ago)	Blocked by CSF 13 firewall - Rule: XMLRPC ID/Indonesia/202-152-156-202.pwkt.citra.net.id	Web App Attack
🇺🇸 TPI-Abuse	2026-07-02 02:51:12 (1 day ago)	(mod_security) mod_security (id:240335) triggered by 202.152.156.202 (202-152-156-202.pwkt.citra.net ... show more (mod_security) mod_security (id:240335) triggered by 202.152.156.202 (202-152-156-202.pwkt.citra.net.id): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jul 01 22:51:08.611305 2026] [security2:error] [pid 7203:tid 7203] [client 202.152.156.202:49170] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 202.152.156.202 (+1 hits since last alert)\|canebrakes.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "canebrakes.com"] [uri "/xmlrpc.php"] [unique_id "akXSHCGDmao9ngl5fB8nDQAAABo"] show less	Brute-Force Bad Web Bot Web App Attack
🇳🇱 ConsulHosting	2026-07-01 05:54:25 (2 days ago)	Excessive failed CAPTCHA attempts (CAPTCHA DoS)	Web App Attack
🇺🇸 TPI-Abuse	2026-07-01 03:04:50 (2 days ago)	(mod_security) mod_security (id:240335) triggered by 202.152.156.202 (202-152-156-202.pwkt.citra.net ... show more (mod_security) mod_security (id:240335) triggered by 202.152.156.202 (202-152-156-202.pwkt.citra.net.id): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jun 30 23:04:46.111997 2026] [security2:error] [pid 30551:tid 30575] [client 202.152.156.202:53382] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 202.152.156.202 (+1 hits since last alert)\|strengthsmatter.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "strengthsmatter.com"] [uri "/xmlrpc.php"] [unique_id "akSDzurZpn743O4hg-R9HgAAAdU"] show less	Brute-Force Bad Web Bot Web App Attack
🇫🇷 dynamix	2026-07-01 02:32:42 (2 days ago)	WordPress XMLRPC Brute Force Attack	Brute-Force Web App Attack
🇱🇻 garmtech.com	2026-07-01 01:38:39 (2 days ago)	IM360 WAF: Rate limit exceeded for XMLRPC DoS (fault code)	Web App Attack
🇺🇸 TPI-Abuse	2026-06-30 09:22:53 (3 days ago)	(mod_security) mod_security (id:240335) triggered by 202.152.156.202 (202-152-156-202.pwkt.citra.net ... show more (mod_security) mod_security (id:240335) triggered by 202.152.156.202 (202-152-156-202.pwkt.citra.net.id): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jun 30 05:22:48.891378 2026] [security2:error] [pid 17105:tid 17105] [client 202.152.156.202:60699] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 202.152.156.202 (+1 hits since last alert)\|sneedvillefarmersmarket.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "sneedvillefarmersmarket.com"] [uri "/xmlrpc.php"] [unique_id "akOK6EMf6BnyR-Et-2efLwAAAAA"] show less	Brute-Force Bad Web Bot Web App Attack
🇩🇪 Marc	2026-06-30 09:19:16 (3 days ago)	202.152.156.202 - - [30/Jun/2026:11:18:54 +0200] "POST /xmlrpc.php HTTP/1.1" 403 3467 "-" "Jetpack b ... show more 202.152.156.202 - - [30/Jun/2026:11:18:54 +0200] "POST /xmlrpc.php HTTP/1.1" 403 3467 "-" "Jetpack by WordPress.com" 202.152.156.202 - - [30/Jun/2026:11:19:04 +0200] "POST /xmlrpc.php HTTP/1.1" 403 3465 "-" "Jetpack by WordPress.com" 202.152.156.202 - - [30/Jun/2026:11:19:15 +0200] "POST /xmlrpc.php HTTP/1.1" 403 3466 "-" "WordPress.com; https://wordpress.com" show less	Brute-Force Web App Attack
🇫🇷 masterguru	2026-06-30 04:55:23 (3 days ago)	xmlrpc request blocked, no referer. Pattern match "xmlrpc.php" at REQUEST_URI. (88010-201)	Hacking
🇺🇸 TPI-Abuse	2026-06-26 08:33:32 (1 week ago)	(mod_security) mod_security (id:240335) triggered by 202.152.156.202 (202-152-156-202.pwkt.citra.net ... show more (mod_security) mod_security (id:240335) triggered by 202.152.156.202 (202-152-156-202.pwkt.citra.net.id): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jun 26 04:33:26.144944 2026] [security2:error] [pid 1210:tid 1210] [client 202.152.156.202:57568] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 202.152.156.202 (+1 hits since last alert)\|seabreezeculvert.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "seabreezeculvert.com"] [uri "/xmlrpc.php"] [unique_id "aj45Vq5ZO6067KV6T-LblgAAAA4"] show less	Brute-Force Bad Web Bot Web App Attack

Showing 1 to 15 of 27 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇮🇳 202.4.169.89

🇳🇱 160.119.71.111

🇺🇸 147.185.132.92

🇨🇳 115.190.211.57

🇳🇱 45.153.34.71

🇯🇵 20.89.224.248

🇬🇧 2.57.17.41

🇩🇪 2001:41d0:701:1100::547d

🇫🇷 213.32.68.85

🇪🇸 212.231.190.106

🇨🇳 118.31.62.206

🇺🇸 96.126.114.196

🇳🇱 64.89.162.38

🇮🇳 49.36.144.20

🇬🇧 35.203.210.192

🇨🇳 223.109.252.181

🇫🇷 213.32.68.86

🇳🇱 185.93.89.167

🇺🇸 174.62.146.254

🇫🇮 147.185.133.50