JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 27.125.246.189

27.125.246.189 was found in our database!

This IP was reported 14 times. Confidence of Abuse is 28%: ?

28%

ISP	UMOBILE
Usage Type	Mobile ISP
ASN	AS38466
Domain Name	u.com.my
Country	🇲🇾 Malaysia
City	Kuala Lumpur, Kuala Lumpur

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 27.125.246.189

Whois 27.125.246.189

IP Abuse Reports for 27.125.246.189:

This IP address has been reported a total of 14 times from 11 distinct sources. 27.125.246.189 was first reported on May 7th 2021, and the most recent report was 22 hours ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇫🇷 SpaceHost-Server	2026-08-31 12:35:51 (22 hours ago)		Brute-Force Web App Attack
🇺🇸 kosada.com	2026-08-25 05:04:53 (1 week ago)	Web bot: denial-of-service flood	DDoS Attack Bad Web Bot
🇨🇱 CTMAN dev	2026-08-24 11:16:05 (1 week ago)	Triggered Cloudflare WAF (firewallCustom) from MY. Action: MANAGED_CHALLENGE \| Protocol: HTTP/2 (GET ... show more Triggered Cloudflare WAF (firewallCustom) from MY. Action: MANAGED_CHALLENGE \| Protocol: HTTP/2 (GET) \| Endpoint: /products/xiaomi-17-smartphone-android-2 \| UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36 • Generated by: github.com/sefinek/Cloudflare-WAF-To-AbuseIPDB show less	Bad Web Bot
🇫🇷 security.rdmc.fr	2026-08-06 12:43:59 (3 weeks ago)	Port Scan Attack proto:TCP src:42247 dst:23	Port Scan
🇺🇸 kosada.com	2026-07-31 04:33:47 (1 month ago)	Web bot: denial-of-service flood	DDoS Attack Bad Web Bot
🇳🇱 DrLex0	2026-07-14 20:52:42 (1 month ago)	BnL006: Obvious dumb distributed botnet crawler stepping into honeypot trap despite it clearly being ... show more BnL006: Obvious dumb distributed botnet crawler stepping into honeypot trap despite it clearly being a burning bag of dog poop. 27.125.246.189 443 - [14/Jul/2026:20:52:42 +0000] "GET [redacted] HTTP/1.1" 503 6182 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:133.0) Gecko/20100101 Firefox/133.0" show less	Bad Web Bot Exploited Host
🇺🇸 kosada.com	2026-07-10 16:02:56 (1 month ago)	Web bot: denial-of-service flood	DDoS Attack Bad Web Bot
Anonymous	2026-07-01 03:47:47 (2 months ago)	Attribution: mikhail-smirnov-79830323 (LinkedIn/profile ID) employed by Angara Technologies Group (E ... show more Attribution: mikhail-smirnov-79830323 (LinkedIn/profile ID) employed by Angara Technologies Group (Explicitly identified himself as enemy a week before attack began) \| Aggressive search filter manipulation / web scraper probe on port 443 \| URI: Heavy query parameter abuse: /multimedia/digital-signage.html?___SID=a39912ca57f778795b12510b776030f5U&dir=desc&mode=grid&order=most_viewed \| UA: Mozilla/5.0 (Linux; Android 6.0; Nexus 5 Build/MRA58N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/65.0.3325.181 Mobile Safari/537.36 \| (Magento Site) show less	Hacking Bad Web Bot
🇸🇬 mypatricks	2026-06-18 06:48:17 (2 months ago)	27.125.246.189 \| Port: 10364 \| DNS: 27.125.246.189 2026-06-18T14:48:16+08:00 Asia/Kuala_Lumpur \| Bad ... show more 27.125.246.189 \| Port: 10364 \| DNS: 27.125.246.189 2026-06-18T14:48:16+08:00 Asia/Kuala_Lumpur \| Bad Behavior Activity \| UA: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.3 Safari/605.1.15 HTTP/1.1 443 GET \| URL: /?route=information/ecard&1781747174&image=32b0131eb3a7a5dc2dca98945b1f818d&product_id=277 \| Ref: - \| Country: MY/Malaysia/+08:00 IP City: Kuala Lumpur a0d858f15c669cd8-SIN/Singapore, Singapore 1 hits/0 secs Robots 4 show less	Brute-Force Web App Attack Blog Spam Web Spam Exploited Host
🇸🇬 mypatricks	2026-06-17 20:01:25 (2 months ago)	27.125.246.189 \| Port: 10544 \| DNS: 27.125.246.189 2026-06-18T04:01:24+08:00 Asia/Kuala_Lumpur \| Fak ... show more 27.125.246.189 \| Port: 10544 \| DNS: 27.125.246.189 2026-06-18T04:01:24+08:00 Asia/Kuala_Lumpur \| Fake HTTP Protocol detected! \| UA: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 HTTP/1.1 443 GET \| URL: / \| Ref: - \| Country: MY/Malaysia/+08:00 IP City: Kuala Lumpur Windows a0d4a55d4c41fdcb-SIN/Singapore, Singapore 1 hits/0 secs Robots 0 show less	Brute-Force Web App Attack Blog Spam Web Spam Exploited Host
🇩🇪 SMARTNET	2026-05-27 06:03:53 (3 months ago)	Aisuru(Mirai variant) DDoS \| Incident ID: 1175168a-7e6d-467e-bb9a-dd1cdfa3fb9e	DDoS Attack
🇮🇩 hermawan	2025-09-22 08:47:56 (11 months ago)	[Mon Sep 22 15:46:47.621449 2025] [security2:error] [pid 919129:tid 139669716059840] [client 27.125. ... show more [Mon Sep 22 15:46:47.621449 2025] [security2:error] [pid 919129:tid 139669716059840] [client 27.125.246.189:42751] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "okhttp" at REQUEST_HEADERS:User-Agent. [file "/etc/modsecurity/coreruleset-4.16.0/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "228"] [id "440000"] [msg "BAD BOT - Detected and Blocked"] [data "Matched Data: okhttp found within REQUEST_HEADERS:User-Agent: okhttp/4.12.0 request_line = GET /images/Klimatologi/Infografis/Infografis-Iklim/Info/2024/1_Apa_Itu_La_Nina-1.jpg HTTP/2.0"] [severity "NOTICE"] [hostname "staklim-jatim.bmkg.go.id"] [uri "/images/Klimatologi/Infografis/Infografis-Iklim/Info/2024/1_Apa_Itu_La_Nina-1.jpg"] [unique_id "aNEM90NrqRwctH9tGPqyhQACzAI"] [staklim-jatim.bmkg.go.id] [staklim-jatim.bmkg.go.id] top=[919132] [Hu0a3N/CqXQ] [aNEM90NrqRwctH9tGPqyhQACzAI] keep_alive=[1] [2025-09-22 15:46:47.621456] [R:aNEM90NrqRwctH9tGPqyhQACzAI] UA:'okhttp/4.12.0' Host:'staklim-jatim.bmkg.go.id' ... show less	Hacking Web App Attack
🇿🇦 IrisFlower	2021-08-28 02:13:13 (5 years ago)	Unauthorized connection attempt detected from IP address 27.125.246.189 to port 443 [J]	Port Scan Hacking
🇬🇧 sdos.es	2021-05-07 01:51:20 (5 years ago)	"XSS Attack Detected via libinjection - Matched Data: XSS data found within ARGS_NAMES:<?xml version ... show more "XSS Attack Detected via libinjection - Matched Data: XSS data found within ARGS_NAMES:<?xml version: <?xml version" show less	Web App Attack

Showing 1 to 14 of 14 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇭🇰 2602:80d:1004::22

🇩🇪 213.209.159.208

🇻🇳 103.28.38.241

🇫🇷 91.196.152.213

🇺🇸 45.33.94.76

🇨🇦 34.19.152.49

🇺🇸 216.45.59.110

🇬🇧 195.206.182.202

🇧🇷 191.248.227.82

🇮🇷 188.214.223.21

🇵🇰 182.184.79.159

🇳🇱 146.103.107.199

🇮🇳 103.109.13.50

🇫🇷 91.231.89.180

🇫🇷 91.231.89.59

🇺🇸 44.220.188.224

🇺🇸 23.92.27.179

🇺🇸 2600:1900:4120:e3fb:0:76::

🇵🇰 223.123.92.77

🇪🇸 217.160.88.29