JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 27.124.95.142

27.124.95.142 was found in our database!

This IP was reported 13 times. Confidence of Abuse is 45%: ?

45%

ISP	PT. Indonesia Comnet Plus
Usage Type	Fixed Line ISP
ASN	AS9341
Domain Name	iconpln.net.id
Country	🇮🇩 Indonesia
City	Godean, Yogyakarta

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 27.124.95.142

Whois 27.124.95.142

IP Abuse Reports for 27.124.95.142:

This IP address has been reported a total of 13 times from 9 distinct sources. 27.124.95.142 was first reported on July 4th 2025, and the most recent report was 21 hours ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇬🇧 Apache	2026-07-13 10:35:35 (21 hours ago)	(mod_security) mod_security (id:240335) triggered by 27.124.95.142 (ID/Indonesia/-): 5 in the last 3 ... show more (mod_security) mod_security (id:240335) triggered by 27.124.95.142 (ID/Indonesia/-): 5 in the last 300 secs show less	Brute-Force Web App Attack
🇺🇸 TPI-Abuse	2026-07-13 08:59:05 (23 hours ago)	(mod_security) mod_security (id:240335) triggered by 27.124.95.142 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:240335) triggered by 27.124.95.142 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jul 13 04:58:59.386907 2026] [security2:error] [pid 20892:tid 20916] [client 27.124.95.142:60175] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 27.124.95.142 (+1 hits since last alert)\|sallykimmel.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "sallykimmel.com"] [uri "/xmlrpc.php"] [unique_id "alSo07ZJfkIZQlg5yME3zAAAAFY"] show less	Brute-Force Bad Web Bot Web App Attack
🇩🇪 ghostwarriors	2026-07-13 05:21:05 (1 day ago)	Webpage scraping	Brute-Force Bad Web Bot Web App Attack
Anonymous	2026-07-13 05:12:35 (1 day ago)	Fail2Ban: WordPress XML-RPC brute-force attack detected.	Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-07-13 04:50:32 (1 day ago)	(mod_security) mod_security (id:240335) triggered by 27.124.95.142 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:240335) triggered by 27.124.95.142 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jul 13 00:50:24.606622 2026] [security2:error] [pid 27023:tid 27040] [client 27.124.95.142:53306] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 27.124.95.142 (+1 hits since last alert)\|duplexgoldmine.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "duplexgoldmine.com"] [uri "/xmlrpc.php"] [unique_id "alRukK2guDHlSVW2tTQZTwAAAA4"] show less	Brute-Force Bad Web Bot Web App Attack
🇫🇷 Sklurk	2026-07-11 09:56:31 (2 days ago)	Web App Attack	Web App Attack
🇺🇸 kosada.com	2026-07-07 07:32:45 (1 week ago)	Web bot: denial-of-service flood	DDoS Attack Bad Web Bot
🇩🇪 SMARTNET	2026-05-27 06:03:53 (1 month ago)	Aisuru(Mirai variant) DDoS \| Incident ID: f33ea243-b344-42fe-b994-8adedb9f85ca	DDoS Attack
🇮🇩 hermawan	2026-01-11 20:53:37 (6 months ago)	[Mon Jan 12 03:53:36.251471 2026] [security2:error] [pid 656999:tid 139942935045824] [client 27.124. ... show more [Mon Jan 12 03:53:36.251471 2026] [security2:error] [pid 656999:tid 139942935045824] [client 27.124.95.142:17337] ModSecurity: Access denied with code 403 (phase 1). Match of "pm matomo.staklim-malang.info " against "SERVER_NAME" required. [file "/etc/modsecurity/coreruleset-4.22.0/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "189"] [id "440235"] [msg "BAD REQUEST Bro"] [data " Matched Data ARGS charset: - Matched Data TX.1: found within Content-Type multipart form Matched Data: %3a found within SERVER_NAME: staklim-malang.info request_line = GET /index.php/profil/arsip-artikel?catid=622&id=1308%3Aprakiraan-cuaca-daerah-malang-dan-batu-seminggu-ke-depan-berlaku-tanggal-4-9-januari-2017&start=130 HTTP/2.0 Request URI RAW = /index.php/profil/arsip-artikel?catid=622&id=1308%3Aprakiraan-cuaca-daerah-malang-dan-batu-seminggu-ke-depan-berlaku-tanggal-4-9-januari-2017&start=130 Req..."] [hostname "staklim-malang.info"] [uri "/index.php/profil/arsip-artikel"] [unique_id "aWQN0MCces4p2 ... show less	Hacking Web App Attack
🇩🇰 TransAdvice-Abuse	2025-12-26 08:27:25 (6 months ago)	IRC SPAM/Flood	DDoS Attack
🇮🇩 hermawan	2025-11-10 08:16:24 (8 months ago)	[Mon Nov 10 15:07:18.021963 2025] [security2:error] [pid 2269098:tid 140091007018688] [client 27.124 ... show more [Mon Nov 10 15:07:18.021963 2025] [security2:error] [pid 2269098:tid 140091007018688] [client 27.124.95.142:56767] ModSecurity: Access denied with code 403 (phase 1). Match of "pm matomo.staklim-malang.info " against "SERVER_NAME" required. [file "/etc/modsecurity/coreruleset-4.20.0/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "183"] [id "440235"] [msg "BAD REQUEST Bro"] [data " Matched Data ARGS charset: - Matched Data TX.1: found within Content-Type multipart form Matched Data: %3a found within SERVER_NAME: staklim-malang.info request_line = GET /index.php/profil/arsip-artikel?catid=473&id=1079%3Aprakiraan-cuaca-daerah-malang-dan-batu-seminggu-ke-depan-berlaku-tanggal-26-juli-1-agustus-2016&start=170 HTTP/2.0 Request URI RAW = /index.php/profil/arsip-artikel?catid=473&id=1079%3Aprakiraan-cuaca-daerah-malang-dan-batu-seminggu-ke-depan-berlaku-tanggal-26-juli-1-agustus-2016&s..."] [hostname "staklim-malang.info"] [uri "/index.php/profil/arsip-artikel"] [unique_id "aRGdNoC5f8av ... show less	Hacking Web App Attack
🇮🇩 hermawan	2025-10-18 02:12:55 (8 months ago)	[Sat Oct 18 08:59:32.722427 2025] [security2:error] [pid 3514223:tid 140269039564480] [client 27.124 ... show more [Sat Oct 18 08:59:32.722427 2025] [security2:error] [pid 3514223:tid 140269039564480] [client 27.124.95.142:64614] ModSecurity: Access denied with code 403 (phase 1). Match of "pm matomo.staklim-malang.info " against "SERVER_NAME" required. [file "/etc/modsecurity/coreruleset-4.16.0/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "164"] [id "440235"] [msg "BAD REQUEST Bro"] [data " Matched Data ARGS charset: - Matched Data TX.1: found within Content-Type multipart form Matched Data: %3a found within SERVER_NAME: staklim-malang.info request_line = GET /index.php/profil/arsip-artikel?catid=477&id=901%3Aprakiraan-cuaca-daerah-malang-dan-batu-seminggu-ke-depan-berlaku-tanggal-23-29-pebruari-2016&start=130 HTTP/2.0 Request URI RAW = /index.php/profil/arsip-artikel?catid=477&id=901%3Aprakiraan-cuaca-daerah-malang-dan-batu-seminggu-ke-depan-berlaku-tanggal-23-29-pebruari-2016&start=130..."] [hostname "staklim-malang.info"] [uri "/index.php/profil/arsip-artikel"] [unique_id "aPL0hBmPXz5y ... show less	Hacking Web App Attack
🇮🇩 hermawan	2025-07-04 08:46:31 (1 year ago)	[Fri Jul 04 15:46:30.620272 2025] [security2:error] [pid 391998:tid 140077299652288] [client 27.124. ... show more [Fri Jul 04 15:46:30.620272 2025] [security2:error] [pid 391998:tid 140077299652288] [client 27.124.95.142:50950] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "myactivity.google.com" at REQUEST_HEADERS:Referer. [file "/etc/modsecurity/coreruleset-4.15.0/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "460"] [id "440068"] [msg "BAD Referer"] [data "Matched Data: myactivity.google.com found within REQUEST_HEADERS:Referer: https://myactivity.google.com/ request_line = GET /images/Klimatologi/Analisis/02-Analisis_Dasarian/Analisis_Distribusi_Curah_Hujan_Dasarian/Analisis_Distribusi_Curah_Hujan_Dasarian_Provinsi_Jawa_Timur/2021/02_Februari_2021/Das-II/Peta_Analisis-Dasarian_Distribusi_Curah_Hujan_Dasarian_II_Februari_Tahun_2021_di_Provinsi_Jawa_Timur.jpg HTTP/2.0"] [severity "NOTICE"] [hostname "staklim-jatim.bmkg.go.id"] [uri "/images/Klimatologi/Analisis/02-Analisis_Dasarian/Analisis_Distribusi_Curah_Hujan_Dasarian/Analisis_Distribusi_Curah_Hujan_Dasarian_Provins ... show less	Hacking Web App Attack

Showing 1 to 13 of 13 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇩🇪 167.94.146.36

🇨🇦 159.203.44.125

🇨🇦 20.48.233.63

🇺🇸 216.24.212.250

🇮🇱 213.57.137.39

🇩🇪 212.132.111.47

🇺🇸 178.16.140.119

🇸🇬 103.253.27.144

🇳🇴 85.93.237.33

🇺🇸 65.49.20.121

🇺🇸 20.221.57.26

🇺🇸 20.64.105.9

🇺🇸 216.24.212.247

🇺🇸 184.186.73.106

🇩🇪 167.94.145.30

🇺🇸 162.243.8.173

🇨🇳 115.211.136.77

🇮🇩 103.148.28.235

🇩🇪 64.89.163.9

🇮🇳 43.228.73.146