JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 27.124.95.236

27.124.95.236 was found in our database!

This IP was reported 8 times. Confidence of Abuse is 23%: ?

23%

ISP	PT. Indonesia Comnet Plus
Usage Type	Fixed Line ISP
ASN	AS9341
Domain Name	iconpln.net.id
Country	🇮🇩 Indonesia
City	Godean, Yogyakarta

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 27.124.95.236

Whois 27.124.95.236

IP Abuse Reports for 27.124.95.236:

This IP address has been reported a total of 8 times from 4 distinct sources. 27.124.95.236 was first reported on May 4th 2024, and the most recent report was 8 hours ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇺🇸 TPI-Abuse	2026-06-27 11:35:55 (8 hours ago)	(mod_security) mod_security (id:240335) triggered by 27.124.95.236 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:240335) triggered by 27.124.95.236 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Jun 27 07:35:47.266144 2026] [security2:error] [pid 8053:tid 8053] [client 27.124.95.236:55289] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 27.124.95.236 (+1 hits since last alert)\|directcch.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "directcch.com"] [uri "/xmlrpc.php"] [unique_id "aj-1k2m9Oa-8b-m1Ab0ypwAAAAw"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-06-27 09:21:09 (11 hours ago)	(mod_security) mod_security (id:240335) triggered by 27.124.95.236 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:240335) triggered by 27.124.95.236 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Jun 27 05:21:02.438526 2026] [security2:error] [pid 18890:tid 18890] [client 27.124.95.236:59870] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 27.124.95.236 (+1 hits since last alert)\|reallifelearninghub.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "reallifelearninghub.com"] [uri "/xmlrpc.php"] [unique_id "aj-V_uvZ9csKuPO6F-tskgAAAAA"] show less	Brute-Force Bad Web Bot Web App Attack
🇫🇷 applemooz	2026-06-27 04:23:11 (16 hours ago)	WordPress XMLRPC Brute Force Attacks ...	Brute-Force Web App Attack
🇺🇸 TPI-Abuse	2026-06-25 09:13:21 (2 days ago)	(mod_security) mod_security (id:240335) triggered by 27.124.95.236 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:240335) triggered by 27.124.95.236 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jun 25 05:13:16.516544 2026] [security2:error] [pid 12821:tid 12821] [client 27.124.95.236:60647] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 27.124.95.236 (+1 hits since last alert)\|hawarcenter.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "hawarcenter.com"] [uri "/xmlrpc.php"] [unique_id "ajzxLEAOul4A6LgSLkDa8AAAAAc"] show less	Brute-Force Bad Web Bot Web App Attack
🇰🇷 zlhIcd	2026-06-20 02:41:29 (1 week ago)	27.124.95.236 - - [16/Jun/2026:05:03:29 +0900] "GET /pcwiki/index.php?days=30&from=20251117212020&hi ... show more 27.124.95.236 - - [16/Jun/2026:05:03:29 +0900] "GET /pcwiki/index.php?days=30&from=20251117212020&hideanons=1&hideminor=1&limit=50&title=%ED%8A%B9%EC%88%98%EA%B8%B0%EB%8A%A5:%EB%A7%81%ED%81%AC%EC%B5%9C%EA%B7%BC%EB%B0%94%EB%80%9C HTTP/1.1" 404 460 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_5_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.6723.69 Safari/537.36" ... show less	Web Spam SQL Injection Bad Web Bot Web App Attack
🇮🇩 hermawan	2025-11-21 07:01:47 (7 months ago)	[Fri Nov 21 13:40:15.536377 2025] [security2:error] [pid 196133:tid 140004854949568] [client 27.124. ... show more [Fri Nov 21 13:40:15.536377 2025] [security2:error] [pid 196133:tid 140004854949568] [client 27.124.95.236:37632] ModSecurity: Access denied with code 403 (phase 2). Pattern match "." at ARGS_NAMES:file. [file "/etc/modsecurity/coreruleset-4.20.0/rules/REQUEST-921-PROTOCOL-ATTACK.conf"] [line "728"] [id "921170"] [msg "deny 921170"] [data " Matched Data ARGS charset: - Matched Data TX.1: found within Content-Type multipart form Matched Data: f found within ARGS_NAMES:file: file request_line = GET /pdfjs/web/viewer.html?file=/images/Klimatologi/Buletin/Bulanan/Informasi_Iklim_dan_Lingkungan/2025/06_Juni_2025/06_Buletin_Bulanan_Informasi_Iklim_dan_Lingkungan_Volume_9_No_7_Edisi_JULI_Tahun_2025_Update_dari_Analisis_Bulan_Juni_Tahun_2025.pdf HTTP/2.0 Request URI RAW = /pdfjs/web/viewer.html?file=/images/Klimatologi/Buletin/Bulanan/Informasi_..."] [ver "OWASP_CRS/4.20.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS"] [tag ... show less	Hacking Web App Attack
🇮🇩 hermawan	2025-10-09 00:29:12 (8 months ago)	[Thu Oct 09 04:37:40.001003 2025] [security2:error] [pid 1951570:tid 140371056056000] [client 27.124 ... show more [Thu Oct 09 04:37:40.001003 2025] [security2:error] [pid 1951570:tid 140371056056000] [client 27.124.95.236:41038] ModSecurity: Access denied with code 403 (phase 1). Match of "pm matomo.staklim-malang.info " against "SERVER_NAME" required. [file "/etc/modsecurity/coreruleset-4.16.0/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "164"] [id "440235"] [msg "BAD REQUEST Bro"] [data " Matched Data ARGS charset: - Matched Data TX.1: found within Content-Type multipart form Matched Data: %3a found within SERVER_NAME: staklim-malang.info request_line = GET /index.php/profil/arsip-artikel?catid=625&id=555555662%3Aprakiraan-cuaca-daerah-malang-dan-batu-seminggu-ke-depan-berlaku-tanggal-26-april-02-mei-2018&start=140 HTTP/2.0 Request URI RAW = /index.php/profil/arsip-artikel?catid=625&id=555555662%3Aprakiraan-cuaca-daerah-malang-dan-batu-seminggu-ke-depan-berlaku-tanggal-26-april-02-mei-..."] [hostname "staklim-malang.info"] [uri "/index.php/profil/arsip-artikel"] [unique_id "aObZo957SUD_ ... show less	Hacking Web App Attack
🇮🇩 hermawan	2024-05-04 23:17:09 (2 years ago)	[Sun May 05 06:17:06.617498 2024] [security2:error] [pid 826237:tid 123889290053184] [client 27.124. ... show more [Sun May 05 06:17:06.617498 2024] [security2:error] [pid 826237:tid 123889290053184] [client 27.124.95.236:37596] [client 27.124.95.236] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i),.?[\\"'\\\\)0-9`-f][\\"'`](?:[\\"'`].?[\\"'`]\|(?:\\\\r?\\\\n)?\\\\z\|[^\\"'`]+)\|[^0-9A-Z_a-z]select.+[^0-9A-Z_a-z]?from\|(?:alter\|(?:(?:cre\|trunc\|upd)at\|renam)e\|d(?:e(?:lete\|sc)\|rop)\|(?:inser\|selec)t\|load)[\\\\s\\\\v]?\\\\([\\\\s\\\\v]?space[\\\\s\\\\v]?\\\\(" at REQUEST_HEADERS:User-Agent. [file "/etc/modsecurity/coreruleset-4.0.0/rules/REQUEST-942-APPLICATION-ATTACK-SQLI.conf"] [line "2109"] [id "942200"] [msg "Detects MySQL comment-/space-obfuscated injections and backtick termination"] [data "Matched Data: , like Gecko) Version/4.0 Chrome/124.0.6367.123 Mobile Safari/537.36 OcIdWebView ({\\x22os\\x22:\\x22Android\\x22, found within REQUEST_HEADERS:User-Agent: Mozilla/5.0 (Linux; Android 10; SM-M205G Build/QP1A.190711.020; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/ ... show less	Hacking Web App Attack

Showing 1 to 8 of 8 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇺🇸 154.92.22.131

🇵🇰 139.135.53.32

🇩🇿 105.103.221.133

🇬🇧 82.3.215.109

🇿🇦 41.135.12.176

🇻🇳 27.71.230.31

🇪🇸 5.182.83.231

🇰🇷 3.35.128.125

🇪🇹 196.190.220.199

🇺🇸 192.3.134.24

🇸🇦 188.54.227.111

🇧🇷 187.17.224.139

🇳🇱 176.65.132.93

🇺🇸 162.216.150.196

🇮🇳 106.219.159.99

🇦🇿 81.17.87.96

🇺🇸 74.204.156.139

🇺🇸 69.124.145.13

🇺🇸 66.132.172.169

🇮🇪 3.255.159.98