JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 104.198.14.249

104.198.14.249 was found in our database!

This IP was reported 19 times. Confidence of Abuse is 80%: ?

80%

ISP	Google LLC
Usage Type	Content Delivery Network
ASN	AS396982
Hostname(s)	249.14.198.104.bc.googleusercontent.com
Domain Name	google.com
Country	🇺🇸 United States of America
City	The Dalles, Oregon

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 104.198.14.249

Whois 104.198.14.249

IP Abuse Reports for 104.198.14.249:

This IP address has been reported a total of 19 times from 16 distinct sources. 104.198.14.249 was first reported on July 3rd 2026, and the most recent report was 5 days ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇧🇪 cmbplf	2026-07-03 08:45:22 (5 days ago)	11.237 requests with url.path /xmlrpc.php 11.207 requests with url.path //xmlrpc.php 984 request ... show more 11.237 requests with url.path /xmlrpc.php 11.207 requests with url.path //xmlrpc.php 984 requests with url.path */wp-includes/wlwmanifest.xml show less	Brute-Force Bad Web Bot
🇪🇸 pipeline.es	2026-07-03 08:43:37 (5 days ago)	Web scanning / probing for vulnerable paths	Port Scan Web App Attack
🇺🇸 mnsf	2026-07-03 08:07:59 (5 days ago)	Abuse Detected (14)	Brute-Force Web App Attack
🇺🇸 TPI-Abuse	2026-07-03 07:48:25 (5 days ago)	(mod_security) mod_security (id:225170) triggered by 104.198.14.249 (249.14.198.104.bc.googleusercon ... show more (mod_security) mod_security (id:225170) triggered by 104.198.14.249 (249.14.198.104.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jul 03 03:48:17.499075 2026] [security2:error] [pid 23886:tid 23886] [client 104.198.14.249:53056] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)\|\|tradersworldmarket.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "tradersworldmarket.com"] [uri "/wp-json/wp/v2/users/"] [unique_id "akdpQRf9X_FIz6td1LoDKgAAABE"] show less	Brute-Force Bad Web Bot Web App Attack
Anonymous	2026-07-03 07:38:19 (5 days ago)	104.198.14.249 - - [03/Jul/2026:04:38:18 -0300] "GET //wp-includes/ID3/license.txt HTTP/1.1" 404 548 ... show more 104.198.14.249 - - [03/Jul/2026:04:38:18 -0300] "GET //wp-includes/ID3/license.txt HTTP/1.1" 404 548 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36" 104.198.14.249 - - [03/Jul/2026:04:38:18 -0300] "GET //xmlrpc.php?rsd HTTP/1.1" 404 548 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36" 104.198.14.249 - - [03/Jul/2026:04:38:18 -0300] "GET //blog/wp-includes/wlwmanifest.xml HTTP/1.1" 404 548 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36" ... show less	Port Scan
🇨🇭 Cybercat	2026-07-03 07:35:29 (5 days ago)	CrowdSec detection: crowdsecurity/http-probing	Hacking
🇳🇴 jad-abuse	2026-07-03 07:24:05 (5 days ago)	ActiveDefense automated detection: malicious HTTP scanning / exploit attempts. Signatures: xmlrpc. O ... show more ActiveDefense automated detection: malicious HTTP scanning / exploit attempts. Signatures: xmlrpc. Observed by 1 sensor(s); 32 hits. show less	Brute-Force Web App Attack
🇦🇺 nzhost.co.nz	2026-07-03 07:23:52 (5 days ago)	$f2bV_matches	Hacking Brute-Force
🇮🇹 🐷🐷🐷	2026-07-03 07:23:51 (5 days ago)	Multiple WordPress unauthorized access attempts ...	Brute-Force Bad Web Bot
🇨🇦 electronico	2026-07-03 07:23:17 (5 days ago)	104.198.14.249 - - [03/Jul/2026:18:23:16 +1100] "GET //xmlrpc.php?rsd HTTP/1.1" 404 544 "-" "Mozilla ... show more 104.198.14.249 - - [03/Jul/2026:18:23:16 +1100] "GET //xmlrpc.php?rsd HTTP/1.1" 404 544 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36" ... show less	Brute-Force Web App Attack
🇩🇪 big-cloud.nl	2026-07-03 07:23:05 (5 days ago)	Try to access /xmlrpc.php?rsd	Web App Attack
🇳🇱 Webhoster	2026-07-03 07:22:14 (5 days ago)	{"ClientAddr":"108.162.246.102:9288","ClientHost":"104.198.14.249","ClientPort":"9288","ClientUserna ... show more {"ClientAddr":"108.162.246.102:9288","ClientHost":"104.198.14.249","ClientPort":"9288","ClientUsername":"-","DownstreamContentSize":0,"DownstreamStatus":429,"Duration":436555,"OriginContentSize":0,"OriginDuration":0,"OriginStatus":0,"Overhead":436555,"RequestAddr":"timvdberg.dev","RequestContentSize":0,"RequestCount":79694,"RequestHost":"timvdberg.dev","RequestMethod":"GET","RequestPath":"/blog/wp-includes/wlwmanifest.xml","RequestPort":"-","RequestProtocol":"HTTP/2.0","RequestScheme":"https","RetryAttempts":0,"RouterName":"https-0-omari8kj3ono91z1qv5lbj10-coraza-www@docker","StartLocal":"2026-07-03T07:22:14.50173804Z","StartUTC":"2026-07-03T07:22:14.50173804Z","TLSCipher":"TLS_AES_128_GCM_SHA256","TLSVersion":"1.3","entryPointName":"https","level":"info","msg":"","request_Cf-Connecting-Ip":"104.198.14.249","request_X-Forwarded-For":"104.198.14.249","request_X-Real-Ip":"108.162.246.102","time":"2026-07-03T07:22:14Z"} {"ClientAddr":"108.162.246.102:9288","ClientHost":"104.198.14.249","C ... show less	Port Scan Hacking Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-07-03 07:22:08 (5 days ago)	(mod_security) mod_security (id:225170) triggered by 104.198.14.249 (249.14.198.104.bc.googleusercon ... show more (mod_security) mod_security (id:225170) triggered by 104.198.14.249 (249.14.198.104.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jul 03 03:22:03.663537 2026] [security2:error] [pid 1292:tid 1292] [client 104.198.14.249:51502] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)\|\|timjbutler.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "timjbutler.com"] [uri "/test/wp-json/wp/v2/users/"] [unique_id "akdjG2bT1efisNxGlMppZAAAABQ"] show less	Brute-Force Bad Web Bot Web App Attack
🇪🇸 pipeline.es	2026-07-03 07:19:22 (5 days ago)	Web scanning / probing for vulnerable paths \| URL: //site/wp-includes/wlwmanifest.xml \| Evidence: ti ... show more Web scanning / probing for vulnerable paths \| URL: //site/wp-includes/wlwmanifest.xml \| Evidence: tickets.[redacted] 104.198.14.249 - - [03/Jul/2026:09:18:19 +0200] \"GET //site/wp-includes/wlwmanifest.xml HTTP/1.1\" 404 230 \"-\" \"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36\" GEOIP_COUNTRY_CODE=US \| ASN: GOOGLE-CLOUD-PLATFORM \| Country: US show less	Port Scan Web App Attack
🇩🇪 raph	2026-07-03 07:18:10 (5 days ago)	[Wordpress] crawler /wp-admin/, /wp-content/, etc.	Bad Web Bot Web App Attack

Showing 1 to 15 of 19 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇺🇸 2a04:c300:400::fe

🇺🇸 162.216.150.252

🇫🇮 147.185.133.111

🇺🇸 144.225.187.5

🇩🇪 91.192.10.86

🇬🇧 35.203.210.157

🇺🇸 23.80.153.156

🇺🇸 2607:f8b0:4001:c79::127

🇧🇪 198.235.24.205

🇧🇷 179.60.169.91

🇧🇷 177.70.71.243

🇺🇸 172.253.240.126

🇩🇪 165.232.65.117

🇯🇵 152.32.203.18

🇺🇸 146.88.241.92

🇺🇸 143.198.54.84

🇩🇪 82.165.175.206

🇫🇷 51.255.192.229

🇰🇷 49.172.254.199

🇺🇸 18.119.209.50