JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 206.189.130.11

206.189.130.11 was found in our database!

This IP was reported 27 times. Confidence of Abuse is 100%: ?

100%

ISP	DigitalOcean, LLC
Usage Type	Data Center/Web Hosting/Transit
ASN	AS14061
Domain Name	digitalocean.com
Country	🇮🇳 India
City	Bengaluru, Karnataka

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 206.189.130.11

Whois 206.189.130.11

IP Abuse Reports for 206.189.130.11:

This IP address has been reported a total of 27 times from 26 distinct sources. 206.189.130.11 was first reported on July 4th 2024, and the most recent report was 2 hours ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇸🇬 pusathosting.com	2026-10-22 21:20:05 (2 hours ago)	24ds22 bruteforce	Brute-Force Web App Attack
🇺🇸 ipblock.com	2026-10-22 18:28:00 (5 hours ago)	IPBlock protected site ID [669-fx]. Exploit request, vulnerability scanner.	Hacking Bad Web Bot Web App Attack
🇺🇸 decode5921	2026-10-22 15:03:25 (9 hours ago)	Honeypot hit: GET /xmlrpc.php	Bad Web Bot Web App Attack
Anonymous	2026-10-22 14:27:56 (9 hours ago)	[redacted] 206.189.130.11 - - [22/Oct/2026:16:27:39 +0200] "POST /xmlrpc.php HTTP/1.1" 200 403 "-" " ... show more [redacted] 206.189.130.11 - - [22/Oct/2026:16:27:39 +0200] "POST /xmlrpc.php HTTP/1.1" 200 403 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36" [redacted] 206.189.130.11 - - [22/Oct/2026:16:27:41 +0200] "POST /xmlrpc.php HTTP/1.1" 200 416 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36" [redacted] 206.189.130.11 - - [22/Oct/2026:16:27:43 +0200] "POST /xmlrpc.php HTTP/1.1" 200 416 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36" [redacted] 206.189.130.11 - - [22/Oct/2026:16:27:44 +0200] "POST /xmlrpc.php HTTP/1.1" 200 416 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36" [redacted] 206.189.130.11 - - [22/Oct/2026:16:27:46 +0200] "POST /xmlrpc.php HTTP/1 ... show less	Hacking Web App Attack
Anonymous	2026-10-22 10:22:05 (13 hours ago)	Reported by internal abuse tracking	DDoS Attack Web App Attack
🇳🇱 Site.eu	2026-10-22 07:38:34 (16 hours ago)	Repeated wp-login/xmlrpc attempts	Brute-Force SSH
🇩🇪 niedson	2026-10-22 07:30:02 (16 hours ago)	Automated honeypot trigger: scanner probing decoy admin/credential paths (e.g. /wp-admin, /phpmyadmi ... show more Automated honeypot trigger: scanner probing decoy admin/credential paths (e.g. /wp-admin, /phpmyadmin). Request dropped (HTTP 444) and source IP firewalled. Reported automatically. show less	Port Scan Web App Attack
Anonymous	2026-10-22 06:41:52 (17 hours ago)	Blocked by web application firewall: automated malicious HTTP requests (WordPress xmlrpc.php / wp-lo ... show more Blocked by web application firewall: automated malicious HTTP requests (WordPress xmlrpc.php / wp-login brute-force and admin-panel scanning). Distributed botnet / automated tooling. No legitimate use. show less	Brute-Force Web App Attack
🇺🇸 kosada.com	2026-10-22 06:21:36 (17 hours ago)	Repeated requests for suspicious nonexistent URLs, for example: /[redacted]/wordpress/wp-includes/wl ... show more Repeated requests for suspicious nonexistent URLs, for example: /[redacted]/wordpress/wp-includes/wlwmanifest.xml (HTTP/1.1 port 443, user agent: "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36") show less	Web App Attack
🇺🇸 TPI-Abuse	2026-10-22 05:06:08 (19 hours ago)	(mod_security) mod_security (id:225170) triggered by 206.189.130.11 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:225170) triggered by 206.189.130.11 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 22 01:06:03.172679 2026] [security2:error] [pid 27247:tid 27247] [client 206.189.130.11:64353] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)\|\|www.odinathletes.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "www.odinathletes.com"] [uri "/wp-json/wp/v2/users/"] [unique_id "atmZu0PwLGLgt4oFkBPBpAAAAAA"] show less	Brute-Force Bad Web Bot Web App Attack
🇩🇪 SwinT	2026-10-22 05:00:05 (19 hours ago)	WordPress login brute-force detected by Fail2Ban in plesk-wordpress jail	Brute-Force Web App Attack
🇫🇷 masterguru	2026-10-22 04:58:08 (19 hours ago)	(wordpress) Apache: Failed WordPress login from 206.189.130.11 (IN/India/-): 10 in the last 3600 sec ... show more (wordpress) Apache: Failed WordPress login from 206.189.130.11 (IN/India/-): 10 in the last 3600 secs (0-193) show less	Hacking
Anonymous	2026-10-22 04:48:02 (19 hours ago)	Bot / scanning and/or hacking attempts: POST //xmlrpc.php HTTP/1.1	Hacking Web App Attack
🇨🇭 Origon	2026-10-22 04:45:02 (19 hours ago)	http-probing - IP: 206.189.130.11 - time="2026-10-22T06:45:02+02:00" level=info msg="(555f66b4f6a74 ... show more http-probing - IP: 206.189.130.11 - time="2026-10-22T06:45:02+02:00" level=info msg="(555f66b4f6a74558bc11e3f93469658es8App0Mcc0TKEeje/crowdsec) crowdsecurity/http-probing by ip 206.189.130.11 (IN/14061) : 4h ban on Ip 206.189.130.11" module=db show less	Web App Attack
🇺🇸 TPI-Abuse	2026-10-22 04:14:35 (20 hours ago)	(mod_security) mod_security (id:225170) triggered by 206.189.130.11 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:225170) triggered by 206.189.130.11 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 22 00:14:28.556085 2026] [security2:error] [pid 13825:tid 13825] [client 206.189.130.11:51140] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)\|\|automatebi.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "automatebi.com"] [uri "/wp-json/wp/v2/users/"] [unique_id "atmNpGPdt72wJ9lCFya1VwAAAAI"] show less	Brute-Force Bad Web Bot Web App Attack

Showing 1 to 15 of 27 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇺🇦 2a09:bac1:7500:30::84:a8

🇨🇳 218.92.201.254

🇮🇷 217.218.10.46

🇻🇪 201.249.89.102

🇧🇷 191.17.230.122

🇸🇦 188.49.17.182

🇩🇪 188.40.192.252

🇨🇱 181.73.14.246

🇺🇸 162.216.150.78

🇨🇦 134.122.45.119

🇰🇷 113.131.118.4

🇰🇷 112.72.226.212

🇺🇸 109.105.210.87

🇩🇪 109.91.4.177

🇨🇳 106.59.139.75

🇺🇸 104.234.94.23

🇳🇴 87.120.104.79

🇩🇪 69.5.169.50

🇺🇸 64.62.156.44

🇧🇬 62.60.134.134