JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 202.65.236.22

202.65.236.22 was found in our database!

This IP was reported 14 times. Confidence of Abuse is 20%: ?

20%

ISP	PT Global Telecom Utama
Usage Type	Fixed Line ISP
ASN	AS45700
Hostname(s)	customer.srbaidn2.pop.starlinkisp.net
Domain Name	apjii.or.id
Country	🇮🇩 Indonesia
City	Jakarta, Jakarta

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 202.65.236.22

Whois 202.65.236.22

IP Abuse Reports for 202.65.236.22:

This IP address has been reported a total of 14 times from 9 distinct sources. 202.65.236.22 was first reported on September 20th 2025, and the most recent report was 2 hours ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
Anonymous	2026-09-03 04:46:26 (2 hours ago)	denied SSH access attempt. destination port 22.	Port Scan Brute-Force SSH
🇫🇷 adnscom.net	2026-09-02 21:41:17 (9 hours ago)	IPS trigger: Brute force SSH scanning/attack	Brute-Force SSH
🇺🇸 kosada.com	2026-07-09 23:03:33 (1 month ago)	Web bot: denial-of-service flood	DDoS Attack Bad Web Bot
🇸🇬 mypatricks	2026-06-29 03:02:24 (2 months ago)	202.65.236.22 \| Port: 9371 \| DNS: customer.srbaidn2.pop.starlinkisp.net 2026-06-29T11:02:22+08:00 As ... show more 202.65.236.22 \| Port: 9371 \| DNS: customer.srbaidn2.pop.starlinkisp.net 2026-06-29T11:02:22+08:00 Asia/Jakarta \| IPs Spam list \| UA: Mozilla/5.0 (Linux; Android 6.0; Nexus 5 Build/MRA58N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/65.0.3325.181 Mobile Safari/537.36 HTTP/1.1 443 GET \| URL: /?ffafdeb8a99ebee=717 \| Ref: - \| Country: ID/Indonesia/+07:00 IP City: Jakarta a131b127de0c62dc-SIN/Singapore, Singapore 1 hits/0 secs Browser 1 show less	Brute-Force Web App Attack Blog Spam Web Spam Exploited Host
🇮🇩 sockominfo	2026-06-14 23:01:04 (2 months ago)	Late night login (22:00-05:30) - High risk Jakarta timezone (WIB). Threat Score: 8.8/10 (CRITICAL). ... show more Late night login (22:00-05:30) - High risk Jakarta timezone (WIB). Threat Score: 8.8/10 (CRITICAL). Confidence: 70%. CVSS v3.1: 9.9/10 (Critical). CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. Bayesian Probability: 87%. MITRE ATT&CK: T1078 (Valid Accounts). Tactic: TA0001. Freshness: Fresh. Source Reputation: KNOWN_MALICIOUS. Methodology: CVSS 3.1 + Bayesian + Temporal + Environmental + MITRE ATT&CK + OWASP. Standards: ISO/IEC 27065:2022, NIST SP 800-30, IEEE S&P 2020. Reported by TangerangKota-CSIRT. Status: MALICIOUS show less	Hacking Web App Attack
🇮🇩 sockominfo	2026-06-14 22:00:53 (2 months ago)	Late night login (22:00-05:30) - High risk Jakarta timezone (WIB). Threat Score: 8.9/10 (CRITICAL). ... show more Late night login (22:00-05:30) - High risk Jakarta timezone (WIB). Threat Score: 8.9/10 (CRITICAL). Confidence: 70%. CVSS v3.1: 9.9/10 (Critical). CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. Bayesian Probability: 87%. MITRE ATT&CK: T1078 (Valid Accounts). Tactic: TA0001. Freshness: Very Fresh. Source Reputation: KNOWN_MALICIOUS. Methodology: CVSS 3.1 + Bayesian + Temporal + Environmental + MITRE ATT&CK + OWASP. Standards: ISO/IEC 27065:2022, NIST SP 800-30, IEEE S&P 2020. Reported by TangerangKota-CSIRT. Status: MALICIOUS show less	Hacking Web App Attack
🇮🇩 sockominfo	2026-06-13 17:00:58 (2 months ago)	User login to application during non-business hours. Threat Score: 6.6/10 (HIGH). Confidence: 40%. C ... show more User login to application during non-business hours. Threat Score: 6.6/10 (HIGH). Confidence: 40%. CVSS v3.1: 4.6/10 (Medium). CVSS Vector: CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L. Bayesian Probability: 87%. MITRE ATT&CK: T1046 (Network Service Scanning). Tactic: TA0001. Freshness: Very Fresh. Source Reputation: UNKNOWN. Methodology: CVSS 3.1 + Bayesian + Temporal + Environmental + MITRE ATT&CK + OWASP. Standards: ISO/IEC 27065:2022, NIST SP 800-30, IEEE S&P 2020. Reported by TangerangKota-CSIRT. Status: MALICIOUS show less	Hacking Web App Attack
🇮🇩 sockominfo	2026-06-12 17:00:58 (2 months ago)	Late night login (22:00-05:30) - High risk Jakarta timezone (WIB), User access to sensitive menu dur ... show more Late night login (22:00-05:30) - High risk Jakarta timezone (WIB), User access to sensitive menu during non-business hours. Threat Score: 9.2/10 (CRITICAL). Confidence: 70%. CVSS v3.1: 9.9/10 (Critical). CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. Bayesian Probability: 96%. MITRE ATT&CK: T1078 (Valid Accounts). Tactic: TA0001. Freshness: Very Fresh. Source Reputation: KNOWN_MALICIOUS. Methodology: CVSS 3.1 + Bayesian + Temporal + Environmental + MITRE ATT&CK + OWASP. Standards: ISO/IEC 27065:2022, NIST SP 800-30, IEEE S&P 2020. Reported by TangerangKota-CSIRT. Status: MALICIOUS show less	Hacking Web App Attack
🇩🇪 pltcldvlpr	2026-06-08 05:33:30 (2 months ago)	Bogus Useragent: 202.65.236.22 - - [08/Jun/2026:07:33:29 +0200] "GET /protocol?id=st_4_61&offset=140 ... show more Bogus Useragent: 202.65.236.22 - - [08/Jun/2026:07:33:29 +0200] "GET /protocol?id=st_4_61&offset=1400&seq=1492 HTTP/1.1" 444 0 "-" "Opera/9.30.(X11; Linux x86_64; ar-KM) Presto/2.9.164 Version/12.00" asn=45700 org="PT. NAP Info Lintas Nusa" country=ID ... show less	Bad Web Bot
Anonymous	2026-01-28 07:32:05 (7 months ago)	Distributed web crawl botnet attack (like Mellowtel), likely illicit scraping of AI training data to ... show more Distributed web crawl botnet attack (like Mellowtel), likely illicit scraping of AI training data to bypass firewall/robots.txt restrictions in email-link.asp show less	Bad Web Bot Exploited Host
Anonymous	2026-01-10 16:29:52 (7 months ago)	Unauthorized connection attempt on Port 23	Port Scan Hacking Exploited Host
🇮🇩 hermawan	2025-10-04 10:20:13 (10 months ago)	[Sat Oct 04 17:19:42.916939 2025] [security2:error] [pid 600492:tid 140074780890816] [client 202.65. ... show more [Sat Oct 04 17:19:42.916939 2025] [security2:error] [pid 600492:tid 140074780890816] [client 202.65.236.22:53482] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i),.?[\\"'\\\\)0-9`-f][\\"'`](?:[\\"'`].?[\\"'`]\|(?:\\\\r?\\\\n)?\\\\z\|[^\\"'`]+)\|[^0-9A-Z_a-z]select.+[^0-9A-Z_a-z]?from\|(?:alter\|(?:(?:cre\|trunc\|upd)at\|renam)e\|d(?:e(?:lete\|sc)\|rop)\|(?:inser\|selec)t\|load)[\\\\s\\\\x0b]?\\\\([\\\\s\\\\x0b]?space[\\\\s\\\\x0b]?\\\\(" at REQUEST_HEADERS:User-Agent. [file "/etc/modsecurity/coreruleset-4.16.0/rules/REQUEST-942-APPLICATION-ATTACK-SQLI.conf"] [line "2129"] [id "942200"] [msg "Detects MySQL comment-/space-obfuscated injections and backtick termination"] [data " Matched Data ARGS charset: - Matched Data TX.1: found within Content-Type multipart form Matched Data: , like Gecko) Version/4.0 Chrome/140.0.7339.207 Mobile Safari/537.36 OcIdWebView ({\\x22os\\x22:\\x22Android\\x22, found within REQUEST_HEADERS:User-Agent: Mozilla/5.0 (Linux; Android 14; Infinix ... show less	Hacking Web App Attack
Anonymous	2025-09-28 04:26:32 (11 months ago)	Unauthorized connection attempt	Port Scan Hacking Exploited Host
Anonymous	2025-09-20 01:54:12 (11 months ago)	wordpress-trap	Web App Attack

Showing 1 to 14 of 14 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇰🇷 211.56.131.187

🇳🇱 195.178.110.70

🇺🇿 185.74.7.77

🇷🇺 185.9.186.140

🇮🇩 182.11.130.113

🇩🇪 164.92.200.25

🇺🇸 162.216.150.58

🇺🇸 147.185.132.99

🇺🇸 147.182.227.78

🇬🇧 90.242.160.82

🇮🇹 88.147.30.59

🇧🇷 45.205.1.247

🇷🇺 176.211.0.107

🇹🇭 171.97.220.3

🇺🇸 149.165.151.85

🇦🇷 148.227.69.133

🇺🇸 147.185.132.91

🇺🇸 147.185.132.85

🇹🇼 114.32.68.115

🇮🇳 106.222.216.3