JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 27.125.240.146

27.125.240.146 was found in our database!

This IP was reported 17 times. Confidence of Abuse is 33%: ?

33%

ISP	UMOBILE
Usage Type	Mobile ISP
ASN	AS38466
Domain Name	u.com.my
Country	🇲🇾 Malaysia
City	Kuala Lumpur, Kuala Lumpur

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 27.125.240.146

Whois 27.125.240.146

IP Abuse Reports for 27.125.240.146:

This IP address has been reported a total of 17 times from 13 distinct sources. 27.125.240.146 was first reported on July 1st 2023, and the most recent report was 15 hours ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇩🇪 LRob	2026-10-26 22:44:26 (15 hours ago)	Proxynvader botnet: shop search flood (L7 DDoS) \| path: /connexion \| query: back=https%3A%2F%2Fcycli ... show more Proxynvader botnet: shop search flood (L7 DDoS) \| path: /connexion \| query: back=https%3A%2F%2Fcycling.fr%2F4-velos-electriques%3Fq%3DFamille-Aspect%2BeRide-Voltage-Aspect \| src_port: 40736 \| ua: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36 show less	DDoS Attack Web App Attack
🇺🇸 RLDD	2026-10-25 09:42:53 (2 days ago)	WP login attempts -lev	Brute-Force
🇺🇸 kosada.com	2026-10-15 07:12:29 (1 week ago)	Repeated requests classified as pathological web bot behavior, for example: /[redacted]?topics%5B1%5 ... show more Repeated requests classified as pathological web bot behavior, for example: /[redacted]?topics%5B1%5D=63&topics%5B3%5D=35&topics%5B4%5D=52&topics%5B5%5D=61 (HTTP/2.0 port 443, user agent: "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36") show less	DDoS Attack Bad Web Bot
🇩🇪 Packets-Decreaser.NET	2026-10-12 15:26:52 (2 weeks ago)	Incoming Layer 7 Flood Detected	DDoS Attack Web Spam
🇺🇸 鬼影233	2026-09-26 13:50:16 (1 month ago)	Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Sa ... show more Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 show less	Bad Web Bot
🇺🇸 鬼影233	2026-09-24 15:32:18 (1 month ago)	Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Sa ... show more Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 show less	Bad Web Bot
🇺🇸 鬼影233	2026-09-20 02:52:57 (1 month ago)	Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Sa ... show more Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 show less	Bad Web Bot
🇺🇸 kosada.com	2026-08-31 05:37:42 (1 month ago)	Web bot: denial-of-service flood	DDoS Attack Bad Web Bot
🇫🇷 Zkillu	2026-08-19 21:57:26 (2 months ago)	UDP flood (DDoS) vs AS215599: 9 pkts / 0.01 MB to UDP 8443 across 9 dst IP(s), 2026-08-19 21:46 to 2 ... show more UDP flood (DDoS) vs AS215599: 9 pkts / 0.01 MB to UDP 8443 across 9 dst IP(s), 2026-08-19 21:46 to 2026-08-20 00:36 CEST. No legitimate service on these UDP ports (7-day baseline 0 GB/day). Carpet-bombing of a /24, likely botnet-compromised host. Evidence: sFlow + hardware ACL counters. show less	DDoS Attack Exploited Host
🇫🇷 HaloAgencySAS	2026-08-19 21:57:26 (2 months ago)	UDP flood (DDoS) vs AS215599: 9 pkts / 0.01 MB to UDP 8443 across 9 dst IP(s), 2026-08-19 21:46 to 2 ... show more UDP flood (DDoS) vs AS215599: 9 pkts / 0.01 MB to UDP 8443 across 9 dst IP(s), 2026-08-19 21:46 to 2026-08-20 00:36 CEST. No legitimate service on these UDP ports (7-day baseline 0 GB/day). Carpet-bombing of a /24, likely botnet-compromised host. Evidence: sFlow + hardware ACL counters. show less	DDoS Attack Exploited Host
🇩🇪 botreporter	2026-07-07 10:28:51 (3 months ago)	botnet ignoring robots.txt	Bad Web Bot
🇺🇸 kosada.com	2026-07-04 14:26:12 (3 months ago)	Web bot: denial-of-service flood	DDoS Attack Bad Web Bot
🇮🇩 hermawan	2025-12-20 03:51:29 (10 months ago)	[Sat Dec 20 10:51:29.188036 2025] [security2:error] [pid 58300:tid 139691390047936] [client 27.125.2 ... show more [Sat Dec 20 10:51:29.188036 2025] [security2:error] [pid 58300:tid 139691390047936] [client 27.125.240.146:45755] ModSecurity: Access denied with code 403 (phase 1). Match of "pm www.office.com powerpoint.officeapps.live.com /offline-service-worker-19-02-2025.js /offline-service-worker-27-01-2024-v5-0-1.js /offline-service-worker-01-08-2023-v4-5-1.js /OneSignalSDKWorker.js /worker-analytic-helper-27-11-2022.js/ /worker-analyti ..." against "REQUEST_HEADERS:Referer" required. [file "/etc/modsecurity/coreruleset-4.20.0/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "614"] [id "440067"] [msg "BAD Referer"] [data "Matched Data: staklim-jatim.bmkg.go.id found within REQUEST_HEADERS:Referer: https://dm.terabox.com/ request_line = GET /api/ico HTTP/1.1"] [severity "NOTICE"] [hostname "staklim-jatim.bmkg.go.id"] [uri "/api/ico"] [unique_id "aUYdQVmGd-el-nYLa3dwBAAAA0A"], referer https://dm.terabox.com/ [staklim-jatim.bmkg.go.id] [staklim-jatim.bmkg.go.id] top=[58340] [+XDiG5r7R40] [aUYdQ ... show less	Hacking Web App Attack
🇺🇸 TPI-Abuse	2025-12-19 23:59:20 (10 months ago)	(mod_security) mod_security (id:210350) triggered by 27.125.240.146 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210350) triggered by 27.125.240.146 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Dec 19 18:59:15.852586 2025] [security2:error] [pid 31482:tid 31482] [client 27.125.240.146:10096] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close\|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close\|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found\|\|altoshp.com\|F\|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "altoshp.com"] [uri "/"] [unique_id "aUXm0-wtLAVKJDgwkgSv9wAAAAU"], referer: https://192.64.150.99/ show less	Brute-Force Bad Web Bot Web App Attack
🇩🇪 SMARTNET	2025-11-26 02:37:10 (11 months ago)	Aisuru(Mirai variant) DDoS	DDoS Attack

Showing 1 to 15 of 17 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇧🇷 190.89.55.250

🇺🇸 188.213.202.106

🇺🇸 174.76.33.8

🇮🇳 167.71.231.57

🇺🇸 162.216.149.6

🇰🇷 101.36.114.4

🇳🇱 95.179.176.175

🇺🇸 66.132.195.72

🇨🇳 47.109.179.249

🇳🇱 45.148.10.121

🇺🇸 45.41.86.226

🇺🇸 34.71.225.118

🇳🇱 200.138.46.213

🇵🇪 190.105.240.38

🇸🇾 188.132.249.157

🇺🇸 129.121.142.157

🇮🇹 79.3.96.178

🇺🇸 66.132.224.227

🇵🇷 24.171.218.204

🇨🇳 223.100.224.75