JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 107.149.152.250

107.149.152.250 was found in our database!

This IP was reported 50 times. Confidence of Abuse is 100%: ?

100%

ISP	PEG TECH INC
Usage Type	Data Center/Web Hosting/Transit
ASN	AS212238
Domain Name	peg-tech.it
Country	🇧🇷 Brazil
City	Sao Paulo, Sao Paulo

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 107.149.152.250

Whois 107.149.152.250

IP Abuse Reports for 107.149.152.250:

This IP address has been reported a total of 50 times from 41 distinct sources. 107.149.152.250 was first reported on April 28th 2026, and the most recent report was 3 hours ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇮🇳 evicky2002	2026-07-19 06:00:00 (3 hours ago)	Confirmed malicious by STILWaters CTI platform (score=100, sources=1)	Hacking Brute-Force SSH
🇲🇽 octageeks.com	2026-07-19 04:09:53 (5 hours ago)	Wordpress malicious attack:[octablocked]	Web App Attack
🇫🇷 SpaceHost-Server	2026-07-18 22:25:45 (11 hours ago)		Brute-Force Web App Attack
Anonymous	2026-07-18 13:53:00 (19 hours ago)	AlfaTeam Shell	Brute-Force Web App Attack
🇩🇪 ISPLtd	2026-07-18 12:05:32 (21 hours ago)	107.149.152.250 [18/Jul/2026:09:05:28 -0300] patientrm.com:443 URL:/ALFA_DATA/alfacgiapi/perl.alfa " ... show more 107.149.152.250 [18/Jul/2026:09:05:28 -0300] patientrm.com:443 URL:/ALFA_DATA/alfacgiapi/perl.alfa "POST /ALFA_DATA/alfacgiapi/perl.alfa 107.149.152.250 [18/Jul/2026:09:05:32 -0300] patientrm.com:443 URL:/alfacgiapi/perl.alfa "POST /alfacgiapi/perl.alfa ... show less	Hacking Web App Attack
🇩🇪 london2038.com	2026-07-18 10:15:52 (23 hours ago)	Probing for exploits 107.149.152.250 - - [18/Jul/2026:12:15:44 +0200] "GET /wp-content/plugins/fix/u ... show more Probing for exploits 107.149.152.250 - - [18/Jul/2026:12:15:44 +0200] "GET /wp-content/plugins/fix/up.php HTTP/1.1" 301 169 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.102 Safari/537.36" 107.149.152.250 - - [18/Jul/2026:12:15:44 +0200] "GET / HTTP/1.1" 204 0 "-" "Mozlila/5.0 (Linux; Android 7.0; SM-G892A Bulid/NRD90M; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/60.0.3112.107 Moblie Safari/537.36" show less	Hacking Web App Attack
🇺🇸 TPI-Abuse	2026-07-18 09:15:59 (1 day ago)	(mod_security) mod_security (id:210350) triggered by 107.149.152.250 (-): 1 in the last 300 secs; Po ... show more (mod_security) mod_security (id:210350) triggered by 107.149.152.250 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Jul 18 05:15:53.340013 2026] [security2:error] [pid 18774:tid 18774] [client 107.149.152.250:62789] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close\|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close\|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found\|\|www.blublk.com\|F\|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.blublk.com"] [uri "/plugins/content/apismtp/apismtp.php.suspected"] [unique_id "altESXgz7XDHLxXK611kBwAAABE"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-07-18 08:13:13 (1 day ago)	(mod_security) mod_security (id:210350) triggered by 107.149.152.250 (-): 1 in the last 300 secs; Po ... show more (mod_security) mod_security (id:210350) triggered by 107.149.152.250 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Jul 18 04:13:08.945460 2026] [security2:error] [pid 15284:tid 15284] [client 107.149.152.250:54057] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close\|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close\|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found\|\|www.fractalsky.com\|F\|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.fractalsky.com"] [uri "/wp-content/plugins/apikey/apikey.php.suspected"] [unique_id "als1lPTUKE6ZQceYOAl2xgAAACA"] show less	Brute-Force Bad Web Bot Web App Attack
🇮🇩 soc-yk	2026-07-18 07:30:15 (1 day ago)	Type: suspicious_network_activity Risk: 84 Events: 101 Evidence: - Persistent suspicious network ac ... show more Type: suspicious_network_activity Risk: 84 Events: 101 Evidence: - Persistent suspicious network activity detected - Repeated hostile operational behavior observed - Multi-event operational persistence identified - Threat escalation behavior observed show less	Port Scan Hacking
🇩🇪 raph	2026-07-18 05:53:19 (1 day ago)	[Wordpress] crawler /wp-admin/, /wp-content/, etc.	Bad Web Bot Web App Attack
🇩🇪 maxpower	2026-07-18 04:58:29 (1 day ago)	(backdoor_scan) REGOLA 7 - Backdoor Scan Attempt 107.149.152.250 (BR/Brazil/-): 1 in the last 3600 s ... show more (backdoor_scan) REGOLA 7 - Backdoor Scan Attempt 107.149.152.250 (BR/Brazil/-): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: 107.149.152.250 - - [18/Jul/2026:06:58:25 +0200] "GET /wp-content/themes/seotheme/db.php?u HTTP/2.0" 404 6740 "www.google.com" "Mozlila/5.0 (Linux; Android 7.0; SM-G892A Bulid/NRD90M; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/60.0.3112.107 Moblie Safari/537.36" "107.149.152.250" host=ilfaro.focusabruzzo.eu show less	Port Scan
🇺🇦 URAN Publishing Service	2026-07-18 04:19:26 (1 day ago)	107.149.152.250 - - [18/Jul/2026:07:19:25 +0300] "POST /wp-plain.php HTTP/1.1" 404 760 "www.google.c ... show more 107.149.152.250 - - [18/Jul/2026:07:19:25 +0300] "POST /wp-plain.php HTTP/1.1" 404 760 "www.google.com" "Mozilla/5.0 (Linux; Android 7.0; SM-G892A Bulid/NRD90M; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/60.0.3112.107 Moblie Safari/537.36" 107.149.152.250 - - [18/Jul/2026:07:19:25 +0300] "GET /wp-content/themes/seotheme/db.php?u HTTP/1.1" 404 760 "www.google.com" "Mozlila/5.0 (Linux; Android 7.0; SM-G892A Bulid/NRD90M; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/60.0.3112.107 Moblie Safari/537.36" ... show less	Web App Attack
🇩🇪 4server	2026-07-18 02:41:42 (1 day ago)	[SatJul1804:41:40.4868432026][security2:error][pid2314252:tid2314274][client107.149.152.250:0]ModSec ... show more [SatJul1804:41:40.4868432026][security2:error][pid2314252:tid2314274][client107.149.152.250:0]ModSecurity:Accessdeniedwithcode403\(phase2\).Patternmatch\"\(\?:\\\\\\\\\(chr\?\\\\\\\\\(\?[0-9]{1\,3}\?\\\\\\\\\)\\|\?=\?f\(\?:open\\|write\)\?\\\\\\\\\(\\|\\\\\\\\b\(\?:passthru\\|serialize\\|php_uname\\|phpinfo\\|shell_exec\\|preg_\\\\\\\\w \\|mysql_query\\|exec\\|include\\|eval\\|create_function\\|system\\|base64_decode\\|decode_base64\\|base64_url_decode\\|str_rot13\)\\\\\\\\b\?\(\?:\\\\\\\\\(\\|\\\\\\\\:\)\)\"atARGS:l.[file\"/etc/apache2/conf.d/modsec_rules/10_asl_rules.conf\"][line\"724\"][id\"340195\"][rev\"4\"][msg\"Atomicorp.comWAFRules:AttackBlocked-Base64EncodedPHPfunctioninArgument-thismaybeanattack.\"][data\"php_uname\(\"][severity\"CRITICAL\"][hostname\"admin-services.ch\"][uri\"/wp-plain.php\"][unique_id\"alrn5Hg8-O7cO1z-MC6sNwAAANM\"]\,referer:www.google.com show less	Port Scan Brute-Force Web App Attack
🇮🇩 bps-statistics	2026-07-18 02:19:21 (1 day ago)	Remote Shell Reconnaisance: "2026-07-18T09:19:21.711+07:00" "/ALFA_DATA/alfacgiapi/perl.alfa" "107.1 ... show more Remote Shell Reconnaisance: "2026-07-18T09:19:21.711+07:00" "/ALFA_DATA/alfacgiapi/perl.alfa" "107.149.152.250" "Mozlila/5.0 (Linux; Android 7.0; SM-G892A Bulid/NRD90M; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/60.0.3112.107 Moblie Safari/537.36" show less	Web App Attack Brute-Force
Anonymous	2026-07-18 02:09:03 (1 day ago)	SIEM ALERT AUTO REPORT	Email Spam

Showing 1 to 15 of 50 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇸🇬 134.209.105.229

🇨🇳 14.29.214.161

🇳🇱 195.178.110.137

🇷🇴 193.46.255.86

🇧🇷 177.137.102.133

🇩🇪 167.94.146.36

🇺🇸 147.185.132.59

🇨🇦 142.93.158.237

🇺🇸 136.107.165.75

🇯🇵 118.194.228.167

🇫🇷 91.196.152.243

🇫🇷 91.196.152.202

🇫🇷 85.217.140.43

🇺🇸 66.132.172.184

🇫🇷 62.197.152.84

🇺🇸 47.88.29.116

🇵🇸 213.6.226.149

🇧🇷 201.42.45.161

🇮🇳 182.76.43.24

🇩🇪 167.94.146.47