JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 1.54.154.49

1.54.154.49 was found in our database!

This IP was reported 15 times. Confidence of Abuse is 57%: ?

57%

ISP	FPT Telecom Company
Usage Type	Fixed Line ISP
ASN	AS18403
Domain Name	fpt.net
Country	🇻🇳 Viet Nam
City	Ho Chi Minh City, Ho Chi Minh City (HCMC)

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 1.54.154.49

Whois 1.54.154.49

IP Abuse Reports for 1.54.154.49:

This IP address has been reported a total of 15 times from 11 distinct sources. 1.54.154.49 was first reported on March 27th 2024, and the most recent report was 1 day ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇺🇸 IndigoRidge	2026-07-19 15:14:58 (1 day ago)	1.54.154.49 - - [19/Jul/2026:11:13:21 -0400] "POST /xmlrpc.php HTTP/1.1" 403 5049 "-" "WordPress.com ... show more 1.54.154.49 - - [19/Jul/2026:11:13:21 -0400] "POST /xmlrpc.php HTTP/1.1" 403 5049 "-" "WordPress.com; https://wordpress.com" 1.54.154.49 - - [19/Jul/2026:11:13:53 -0400] "POST /xmlrpc.php HTTP/1.1" 403 5049 "-" "WordPress.com; https://wordpress.com" 1.54.154.49 - - [19/Jul/2026:11:14:14 -0400] "POST /xmlrpc.php HTTP/1.1" 403 5049 "-" "WordPress.com; https://wordpress.com" 1.54.154.49 - - [19/Jul/2026:11:14:25 -0400] "POST /xmlrpc.php HTTP/1.1" 403 5049 "-" "WordPress.com; https://wordpress.com" 1.54.154.49 - - [19/Jul/2026:11:14:57 -0400] "POST /xmlrpc.php HTTP/1.1" 403 5049 "-" "WordPress.com; https://wordpress.com" ... show less	Web App Attack
🇮🇹 CoreTech srl	2026-07-19 15:13:57 (1 day ago)	cloudlinux2 fail2ban: 2026-07-19 17:09:41,738 fail2ban.filter [1918]: INFO [plesk-wordpre ... show more cloudlinux2 fail2ban: 2026-07-19 17:09:41,738 fail2ban.filter [1918]: INFO [plesk-wordpress] Found 45.132.227.151 - 2026-07-19 17:09:41cloudlinux2 fail2ban: 2026-07-19 17:10:11,862 fail2ban.filter [1918]: INFO [plesk-wordpress] Found 185.251.19.138 - 2026-07-19 17:10:11cloudlinux2 fail2ban: 2026-07-19 17:10:11,518 fail2ban.filter [1918]: INFO [plesk-wordpress] Found 45.132.227.211 - 2026-07-19 17:10:11cloudlinux2 fail2ban: 2026-07-19 17:10:11,602 fail2ban.filter [1918]: INFO [plesk-wordpress] Found 185.251.19.137 - 2026-07-19 17:10:11cloudlinux2 fail2ban: 2026-07-19 17:10:15,854 fail2ban.filter [1918]: INFO [plesk-wordpress] Found 45.132.227.211 - 2026-07-19 17:10:15cloudlinux2 fail2ban: 2026-07-19 17:11:31,277 fail2ban.filter [1918]: INFO [plesk-wordpress] Found 193.56.116.205 - 2026-07-19 17:11:30cloudlinux2 fail2ban: 2026-07-19 17:12:04,054 fail2ban.filter [1918]: INFO [plesk-modsecurity] Found 223.205.73.240 - 2026-07-19 17:12:03 show less	Web App Attack
🇫🇷 dynamix	2026-07-19 08:40:06 (1 day ago)	WordPress XMLRPC Brute Force Attack	Brute-Force Web App Attack
🇩🇪 ghostwarriors	2026-07-19 05:50:22 (1 day ago)	Webpage scraping	Brute-Force Bad Web Bot Web App Attack
Anonymous	2026-07-19 05:43:25 (1 day ago)	Fail2Ban: WordPress XML-RPC brute-force attack detected.	Bad Web Bot Web App Attack
🇫🇮 KnightIndustries	2026-07-18 14:59:38 (2 days ago)	2026-07-18T16:58:43.983223+02:00 milkyway wordpress(oldscarborough.com)[3912497]: XML-RPC authentica ... show more 2026-07-18T16:58:43.983223+02:00 milkyway wordpress(oldscarborough.com)[3912497]: XML-RPC authentication failure for joshua from 1.54.154.49 2026-07-18T16:59:05.265550+02:00 milkyway wordpress(oldscarborough.com)[3914546]: XML-RPC authentication failure for joshua from 1.54.154.49 2026-07-18T16:59:37.140068+02:00 milkyway wordpress(oldscarborough.com)[3921888]: XML-RPC authentication failure for joshua from 1.54.154.49 ... show less	Brute-Force Web App Attack
🇺🇸 cwytech	2026-07-18 12:45:27 (2 days ago)	Fleet-wide ban from the Ghostfleet 👻. Triggered by scenario: cwy/wp-us-login-only-high.	Bad Web Bot Web App Attack
🇫🇷 dynamix	2026-07-18 05:50:08 (2 days ago)	WordPress XMLRPC Brute Force Attack	Brute-Force Web App Attack
🇩🇪 ghostwarriors	2026-07-17 03:21:25 (3 days ago)	Webpage scraping	Brute-Force Bad Web Bot Web App Attack
Anonymous	2026-07-17 03:10:29 (3 days ago)	Fail2Ban: WordPress XML-RPC brute-force attack detected.	Bad Web Bot Web App Attack
Anonymous	2026-07-17 01:37:18 (3 days ago)	[redacted] 1.54.154.49 - - [17/Jul/2026:03:36:23 +0200] "POST /xmlrpc.php HTTP/1.1" 405 428 "-" "Jet ... show more [redacted] 1.54.154.49 - - [17/Jul/2026:03:36:23 +0200] "POST /xmlrpc.php HTTP/1.1" 405 428 "-" "Jetpack/12.1; WordPress/6.3; http://site48702096.com" [redacted] 1.54.154.49 - - [17/Jul/2026:03:36:34 +0200] "POST /xmlrpc.php HTTP/1.1" 405 428 "-" "Jetpack/12.0; WordPress/6.3; http://site68024822.com" [redacted] 1.54.154.49 - - [17/Jul/2026:03:36:44 +0200] "POST /xmlrpc.php HTTP/1.1" 405 428 "-" "Jetpack/13.0; WordPress/6.4; http://site98681597.com" [redacted] 1.54.154.49 - - [17/Jul/2026:03:36:55 +0200] "POST /xmlrpc.php HTTP/1.1" 405 428 "-" "Jetpack by WordPress.com (Jetpack 12.1; WordPress 6.1)" [redacted] 1.54.154.49 - - [17/Jul/2026:03:37:16 +0200] "POST /xmlrpc.php HTTP/1.1" 405 428 "-" "Jetpack by WordPress.com" ... show less	Hacking Web App Attack
🇺🇸 IndigoRidge	2026-07-16 04:57:58 (4 days ago)	1.54.154.49 - - [16/Jul/2026:00:55:28 -0400] "POST /xmlrpc.php HTTP/1.0" 403 5612 "-" "WordPress.com ... show more 1.54.154.49 - - [16/Jul/2026:00:55:28 -0400] "POST /xmlrpc.php HTTP/1.0" 403 5612 "-" "WordPress.com; https://wordpress.com" 1.54.154.49 - - [16/Jul/2026:00:55:49 -0400] "POST /xmlrpc.php HTTP/1.0" 403 5612 "-" "WordPress.com; https://wordpress.com" 1.54.154.49 - - [16/Jul/2026:00:56:21 -0400] "POST /xmlrpc.php HTTP/1.0" 403 5612 "-" "WordPress.com; https://wordpress.com" 1.54.154.49 - - [16/Jul/2026:00:57:46 -0400] "POST /xmlrpc.php HTTP/1.0" 403 5612 "-" "WordPress.com; https://wordpress.com" 1.54.154.49 - - [16/Jul/2026:00:57:57 -0400] "POST /xmlrpc.php HTTP/1.0" 403 5612 "-" "WordPress.com; https://wordpress.com" ... show less	Web App Attack
🇺🇸 TPI-Abuse	2026-07-16 04:07:44 (4 days ago)	(mod_security) mod_security (id:240335) triggered by 1.54.154.49 (-): 1 in the last 300 secs; Ports: ... show more (mod_security) mod_security (id:240335) triggered by 1.54.154.49 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jul 16 00:07:27.914976 2026] [security2:error] [pid 25013:tid 25013] [client 1.54.154.49:48210] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 1.54.154.49 (+1 hits since last alert)\|virtualmediamasters.net\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "virtualmediamasters.net"] [uri "/xmlrpc.php"] [unique_id "alhY_3G9jIKlUoRwUYOF2wAAAAQ"] show less	Brute-Force Bad Web Bot Web App Attack
🇳🇱 exxos	2025-08-22 12:03:01 (10 months ago)	Attacks with Bad user agents	Hacking
Anonymous	2024-03-27 11:18:33 (2 years ago)	Unauthorized connection attempt	Port Scan Hacking Exploited Host

Showing 1 to 15 of 15 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇺🇸 172.253.212.19

🇻🇳 160.191.243.188

🇳🇱 91.92.42.168

🇫🇷 79.137.32.187

🇿🇦 4.221.186.70

🇮🇩 202.155.157.131

🇵🇱 185.41.130.140

🇮🇳 182.76.43.24

🇦🇷 170.233.210.238

🇪🇬 156.210.10.22

🇵🇱 146.59.32.16

🇲🇲 103.59.163.135

🇮🇹 217.26.178.143

🇳🇱 185.242.226.97

🇺🇸 164.92.106.15

🇳🇱 158.94.210.171

🇺🇸 142.252.79.45

🇧🇩 103.171.69.186

🇷🇴 92.118.39.71

🇺🇸 74.235.121.66