JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 130.49.10.159

130.49.10.159 was found in our database!

This IP was reported 29 times. Confidence of Abuse is 47%: ?

47%

ISP	Fine Group Servers Solutions LLC
Usage Type	Data Center/Web Hosting/Transit
ASN	AS59651
Domain Name	finegroupservers.com
Country	🇸🇪 Sweden
City	Marsta, Stockholm

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 130.49.10.159

Whois 130.49.10.159

IP Abuse Reports for 130.49.10.159:

This IP address has been reported a total of 29 times from 19 distinct sources. 130.49.10.159 was first reported on April 17th 2026, and the most recent report was 8 hours ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇨🇦 zXero	2026-06-18 21:06:39 (8 hours ago)	Fail2Ban automatic report - jail: no-wordpress	Brute-Force SSH DDoS Attack
🇨🇦 zXero	2026-06-09 12:51:19 (1 week ago)	Fail2Ban automatic report - jail: no-wordpress	Brute-Force SSH DDoS Attack
🇨🇦 zXero	2026-06-03 12:27:42 (2 weeks ago)	Fail2Ban automatic report - jail: no-wordpress	Brute-Force SSH DDoS Attack
🇨🇦 zXero	2026-05-29 12:22:06 (2 weeks ago)	Fail2Ban automatic report - jail: no-wordpress	Brute-Force SSH DDoS Attack
🇳🇱 i-turnradio.nl	2026-05-25 21:59:33 (3 weeks ago)	2026-05-25 @ 23:59:33 (CET) ~ Blocked for trying to access: /xmlrpc.php	Web App Attack
🇫🇷 solution.it	2026-05-25 19:47:29 (3 weeks ago)	[Mon May 25 21:47:28.816848 2026] [php7:error] [pid 2549488:tid 2549488] [client 130.49.10.159:9401] ... show more [Mon May 25 21:47:28.816848 2026] [php7:error] [pid 2549488:tid 2549488] [client 130.49.10.159:9401] script '/var/www/html/xmlrpc.php' not found or unable to stat show less	Web App Attack
🇩🇪 4server	2026-05-25 09:53:35 (3 weeks ago)	[MonMay2511:53:33.8384302026][security2:error][pid3915793:tid3915915][client130.49.10.159:0]ModSecur ... show more [MonMay2511:53:33.8384302026][security2:error][pid3915793:tid3915915][client130.49.10.159:0]ModSecurity:Accessdeniedwithcode403\(phase1\).Stringmatch\"/xmlrpc.php\"atREQUEST_URI.[file\"/etc/apache2/conf.d/modsec_custom_rules.conf\"][line\"170\"][id\"960024\"][msg\"XML-RPCdisabled\"][hostname\"restaurantgandria.ch\"][uri\"/xmlrpc.php\"][unique_id\"ahQcHXJBzG04FKPF0Ii6cAAAAQQ\"] show less	Port Scan Brute-Force Web App Attack
Anonymous	2026-05-24 17:24:28 (3 weeks ago)	130.49.10.159 - - [24/May/2026:19:24:27 +0200] "POST / HTTP/1.1" 301 169 "-" "Mozilla/5.0 (Macintosh ... show more 130.49.10.159 - - [24/May/2026:19:24:27 +0200] "POST / HTTP/1.1" 301 169 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_8) AppleWebKit/536.36 (KHTML, like Gecko111) Chrome/99.6 Safari/531.55" show less	Web App Attack
🇺🇸 TPI-Abuse	2026-05-21 22:43:28 (4 weeks ago)	(mod_security) mod_security (id:225170) triggered by 130.49.10.159 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:225170) triggered by 130.49.10.159 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu May 21 18:43:22.462564 2026] [security2:error] [pid 24868:tid 24868] [client 130.49.10.159:27719] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)\|\|exners.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "exners.com"] [uri "/wp-json/wp/v2/users"] [unique_id "ag-KinN2iKg-B8ejDQHG-QAAABA"], referer: https://www.google.com show less	Brute-Force Bad Web Bot Web App Attack
🇳🇱 i-turnradio.nl	2026-05-21 15:38:36 (4 weeks ago)	2026-05-21 @ 17:38:36 (CET) ~ Blocked for trying to access: /xmlrpc.php	Web App Attack
🇮🇹 [email protected]	2026-05-21 01:58:10 (4 weeks ago)	[Thu May 21 03:58:10.059175 2026] [authz_core:error] [pid 3825779:tid 3825814] [remote 130.49.10.159 ... show more [Thu May 21 03:58:10.059175 2026] [authz_core:error] [pid 3825779:tid 3825814] [remote 130.49.10.159:40911] AH01630: client denied by server configuration: /var/www/html/MyWeb/Wordpress_www/xmlrpc.php show less	Brute-Force Web App Attack
🇺🇸 nationaleventpros.com	2026-05-14 18:35:55 (1 month ago)	WordPress login attempt	Brute-Force
🇬🇧 Bytemark	2026-05-13 02:07:37 (1 month ago)	130.49.10.159 - - [13/May/2026:03:07:24 +0100] "POST /xmlrpc.php HTTP/2.0" 404 16 "-" "Mozilla/5.0 ( ... show more 130.49.10.159 - - [13/May/2026:03:07:24 +0100] "POST /xmlrpc.php HTTP/2.0" 404 16 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_1) AppleWebKit/531.38 (KHTML, like Gecko111) Chrome/96.4 Safari/538.52" 130.49.10.159 - - [13/May/2026:03:07:32 +0100] "POST /xmlrpc.php HTTP/2.0" 404 16 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_2) AppleWebKit/532.32 (KHTML, like Gecko111) Chrome/91.4 Safari/539.55" 130.49.10.159 - - [13/May/2026:03:07:36 +0100] "POST /xmlrpc.php HTTP/2.0" 404 16 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_2) AppleWebKit/533.35 (KHTML, like Gecko111) Chrome/92.1 Safari/532.53" show less	Brute-Force Web App Attack
🇨🇭 4server	2026-05-12 23:48:58 (1 month ago)	[WedMay1301:48:52.9513572026][security2:error][pid158256:tid158258][client130.49.10.159:0]ModSecurit ... show more [WedMay1301:48:52.9513572026][security2:error][pid158256:tid158258][client130.49.10.159:0]ModSecurity:Accessdeniedwithcode403\(phase1\).Stringmatch\"/xmlrpc.php\"atREQUEST_URI.[file\"/etc/apache2/conf.d/modsec_custom_rules.conf\"][line\"367\"][id\"960024\"][msg\"XML-RPCdisabled\"][hostname\"whatsdecor.ch\"][uri\"/xmlrpc.php\"][unique_id\"agO8ZPhhE9EAUOvnu_Eu-gAAAMA\"] show less	Hacking Web App Attack
🇮🇩 zam	2026-05-12 03:13:34 (1 month ago)	130.49.10.159 - - [12/May/2026:03:13:32 +0000] "POST /xmlrpc.php HTTP/1.1" 500 320	Web App Attack

Showing 1 to 15 of 29 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇨🇳 183.233.85.194

🇨🇳 180.102.110.167

🇩🇪 47.245.135.164

🇬🇧 35.203.211.176

🇩🇪 2.27.20.149

🇺🇸 2600:4041:40cc:d400:dc93:b125:9648:3e71

🇺🇸 2001:470:2cc:1::29d

🇧🇷 205.210.31.236

🇨🇱 200.89.69.247

🇳🇱 185.223.235.21

🇮🇳 182.79.218.164

🇨🇳 175.175.154.87

🇺🇸 154.3.224.218

🇨🇳 139.170.73.54

🇨🇳 129.211.218.71

🇭🇰 124.156.138.249

🇨🇳 120.48.124.81

🇺🇸 104.21.35.98

🇨🇳 101.52.130.122

🇩🇪 69.5.169.236