AbuseIPDB » 116.49.7.189

116.49.7.189 was found in our database!

This IP was reported 121 times. Confidence of Abuse is 88%: ?

88%

ISP	Hong Kong Telecommunications (HKT) Limited Mass Internet
Usage Type	Fixed Line ISP
ASN	AS4760
Hostname(s)	n116497189.netvigator.com
Domain Name	netvigator.com
Country	Hong Kong
City	Hong Kong

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated biweekly.

Report 116.49.7.189

Whois 116.49.7.189

IP Abuse Reports for 116.49.7.189:

This IP address has been reported a total of 121 times from 61 distinct sources. 116.49.7.189 was first reported on March 6th 2025, and the most recent report was 2 weeks ago.

Old Reports: The most recent abuse report for this IP address is from 2 weeks ago. It is possible that this IP is no longer involved in abusive activities.

Reporter	IoA Timestamp in UTC	Comment	Categories
urnilxfgbez	2025-03-19 23:45:00 (1 month ago)	Last 24 Hours suspicious: (DPT=445|DPT=3389|DPT=22|DPT=3306|DPT=8080|DPT=23|DPT=5900|DPT=1433)	Port Scan
BSG Webmaster	2025-03-19 07:35:12 (1 month ago)	Port scanning (Port 80)	Port Scan Hacking
RuVeR	2025-03-19 05:47:12 (1 month ago)	2025-03-19T08:46:40.995091pantelemone.ru sshd[2111241]: Invalid user openstack from 116.49.7.189 por ... show more2025-03-19T08:46:40.995091pantelemone.ru sshd[2111241]: Invalid user openstack from 116.49.7.189 port 51444 2025-03-19T08:46:40.998277pantelemone.ru sshd[2111241]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=116.49.7.189 2025-03-19T08:46:43.190991pantelemone.ru sshd[2111241]: Failed password for invalid user openstack from 116.49.7.189 port 51444 ssh2 2025-03-19T08:47:09.321649pantelemone.ru sshd[2111259]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=116.49.7.189 user=root 2025-03-19T08:47:11.162985pantelemone.ru sshd[2111259]: Failed password for root from 116.49.7.189 port 60702 ssh2 ... show less	Brute-Force SSH
Anonymous	2025-03-19 04:25:22 (1 month ago)	116.49.7.189 - - [19/Mar/2025:04:24:34 +0000] "POST /cgi-bin/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e ... show more116.49.7.189 - - [19/Mar/2025:04:24:34 +0000] "POST /cgi-bin/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/bin/sh HTTP/1.1" 400 166 "-" "-" 116.49.7.189 - - [19/Mar/2025:04:24:47 +0000] "POST /cgi-bin/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/bin/sh HTTP/1.1" 400 166 "-" "-" 116.49.7.189 - - [19/Mar/2025:04:24:57 +0000] "POST /hello.world?%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 403 162 "-" "Custom-AsyncHttpClient" 116.49.7.189 - - [19/Mar/2025:04:25:03 +0000] "GET /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1" 403 162 "-" "Custom-AsyncHttpClient" 116.49.7.189 - - [19/Mar/2025:04:25:09 +0000] "GET /vendor/phpunit/phpunit/Util/PHP/eval-stdin.php HTTP/1.1" 403 162 "-" "Custom-AsyncHttpClient" 116.49.7.189 - - [19/Mar/2025:04:25:15 +0000] "GET /vendor/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1" 403 162 "-" "Custom-AsyncHttpClient" 116.49.7.189 - - [19/Mar/2025:04:25:22 +000 ... show less	FTP Brute-Force Port Scan Hacking Brute-Force Bad Web Bot Web App Attack SSH
trobotham	2025-03-19 04:15:10 (1 month ago)	(sshd) Failed SSH login from 116.49.7.189 (HK/Hong Kong/n116497189.netvigator.com): 5 in the last 36 ... show more(sshd) Failed SSH login from 116.49.7.189 (HK/Hong Kong/n116497189.netvigator.com): 5 in the last 3600 secs; Ports: 22; Direction: in; Trigger: LF_SSHD; Logs: Mar 19 00:05:30 w sshd[806685]: Invalid user lsfadmin from 116.49.7.189 port 38336 Mar 19 00:07:29 w sshd[807440]: Invalid user centos from 116.49.7.189 port 5684 Mar 19 00:08:25 w sshd[807698]: Invalid user xguest from 116.49.7.189 port 21298 Mar 19 00:12:14 w sshd[809349]: Invalid user dusan from 116.49.7.189 port 20106 Mar 19 00:15:09 w sshd[810591]: Invalid user support from 116.49.7.189 port 4504 show less	Port Scan
ozisp.com.au	2025-03-19 03:22:07 (1 month ago)	HK_MAINT-HK-IMS-CS_<33>1742354526 [1:2034125:5] ET EXPLOIT Apache HTTP Server 2.4.49 - Path Traversa ... show moreHK_MAINT-HK-IMS-CS_<33>1742354526 [1:2034125:5] ET EXPLOIT Apache HTTP Server 2.4.49 - Path Traversal Attempt (CVE-2021-41773) M2 [Classification: Attempted Administrator Privilege Gain] [Priority: 1] {TCP} 116.49.7.189:5844 show less	Hacking
ps-center	2025-03-19 02:22:11 (1 month ago)	C1-W: TCP-Scanner. Port: 22	Port Scan
rtbh.com.tr	2025-03-19 00:48:48 (1 month ago)	list.rtbh.com.tr report: tcp/23	Brute-Force
quarba	2025-03-19 00:10:05 (1 month ago)	Brute force SMTP login attempted	Brute-Force SSH
urnilxfgbez	2025-03-18 23:45:00 (1 month ago)	Last 24 Hours suspicious: (DPT=445|DPT=3389|DPT=22|DPT=3306|DPT=8080|DPT=23|DPT=5900|DPT=1433)	Port Scan
Anonymous	2025-03-18 22:06:02 (1 month ago)	Bot / scanning and/or hacking attempts: GET /api/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php ... show moreBot / scanning and/or hacking attempts: GET /api/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTT, GET /backup/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php , GET /crm/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTT, GET /admin/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php H, GET /demo/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HT show less	Hacking Web App Attack
jasperedv.de	2025-03-18 22:04:52 (1 month ago)	Apache Login - Brutforcing	Brute-Force Web App Attack
Block Rockin' Beats	2025-03-18 22:04:03 (1 month ago)	Scanning for exploitable scripts	Hacking Web App Attack
librebit	2025-03-18 19:25:04 (1 month ago)	Brute force	Brute-Force
shaunc	2025-03-18 18:38:40 (1 month ago)	Mar 18 13:38:34 mailman sshd[28492]: pam_unix(sshd:auth): authentication failure; logname= uid=0 eui ... show moreMar 18 13:38:34 mailman sshd[28492]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=n116497189.netvigator.com Mar 18 13:38:36 mailman sshd[28492]: Failed password for invalid user team from 116.49.7.189 port 54184 ssh2 Mar 18 13:38:38 mailman sshd[28492]: Connection closed by 116.49.7.189 port 54184 [preauth] show less	Brute-Force SSH

Is this your IP? You may request to takedown any associated reports. We will attempt to verify your ownership. Request Takedown 🚩