JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 130.49.76.36

130.49.76.36 was found in our database!

This IP was reported 11 times. Confidence of Abuse is 0%: ?

ISP	Fine Group Servers Solutions LLC
Usage Type	Data Center/Web Hosting/Transit
ASN	AS35830
Domain Name	finegroupservers.com
Country	🇵🇱 Poland
City	Lyszkowice, Lodz Voivodeship

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 130.49.76.36

Whois 130.49.76.36

IP Abuse Reports for 130.49.76.36:

This IP address has been reported a total of 11 times from 5 distinct sources. 130.49.76.36 was first reported on November 27th 2025, and the most recent report was 1 month ago.

Old Reports: The most recent abuse report for this IP address is from 1 month ago . It is possible that this IP is no longer involved in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇱🇻 garmtech.com	2026-08-02 18:52:20 (1 month ago)	IM360 WAF: WordPress wp2shell REST batch endpoint before 7.0.2 or 6.9.5 (CVE-2026-63030) MV:0	Hacking
🇧🇷 Peregrine	2026-07-07 03:12:26 (2 months ago)	Fail2Ban ct101 Jail: tomcat-honeypot \| Evidence: 130.49.76.36 104.23.221.9 - - [04/Jul/2026:15:37:54 ... show more Fail2Ban ct101 Jail: tomcat-honeypot \| Evidence: 130.49.76.36 104.23.221.9 - - [04/Jul/2026:15:37:54 -0300] "GET /wp-login.php HTTP/1.1" 404 18193 show less	Bad Web Bot
🇧🇷 Peregrine	2026-07-06 03:12:14 (2 months ago)	Fail2Ban ct101 Jail: tomcat-honeypot \| Evidence: 130.49.76.36 104.23.221.9 - - [04/Jul/2026:15:37:54 ... show more Fail2Ban ct101 Jail: tomcat-honeypot \| Evidence: 130.49.76.36 104.23.221.9 - - [04/Jul/2026:15:37:54 -0300] "GET /wp-login.php HTTP/1.1" 404 18193 show less	Bad Web Bot
🇧🇷 Peregrine	2026-07-04 18:37:58 (2 months ago)	Fail2Ban ct101 Jail: tomcat-honeypot \| Evidence: 130.49.76.36 104.23.221.9 - - [04/Jul/2026:15:37:54 ... show more Fail2Ban ct101 Jail: tomcat-honeypot \| Evidence: 130.49.76.36 104.23.221.9 - - [04/Jul/2026:15:37:54 -0300] "GET /wp-login.php HTTP/1.1" 404 18193 show less	Bad Web Bot
🇺🇸 TRoden	2026-06-17 23:45:18 (2 months ago)	Geo Block Plugin: Escalation flag(s): rce_attempt	Hacking
🇺🇸 kosada.com	2026-05-03 12:59:10 (4 months ago)	Web password guessing	Brute-Force
🇺🇸 TPI-Abuse	2026-05-02 18:50:47 (4 months ago)	(mod_security) mod_security (id:225170) triggered by 130.49.76.36 (-): 1 in the last 300 secs; Ports ... show more (mod_security) mod_security (id:225170) triggered by 130.49.76.36 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat May 02 14:50:43.077822 2026] [security2:error] [pid 26491:tid 26491] [client 130.49.76.36:52491] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)\|\|azbrooks.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "azbrooks.com"] [uri "/wp-json/wp/v2/users"] [unique_id "afZHgwPu6NAwTueTyC74sgAAAAs"], referer: https://www.google.com show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 kosada.com	2026-04-13 23:11:20 (5 months ago)	Web password guessing	Brute-Force
🇺🇸 TRoden	2026-04-08 10:02:00 (5 months ago)	Geo Block Plugin: Escalation flag(s): rce_attempt	Hacking
🇺🇸 TPI-Abuse	2026-01-23 03:03:40 (7 months ago)	(mod_security) mod_security (id:225170) triggered by 130.49.76.36 (-): 1 in the last 300 secs; Ports ... show more (mod_security) mod_security (id:225170) triggered by 130.49.76.36 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jan 22 22:03:33.531332 2026] [security2:error] [pid 27344:tid 27344] [client 130.49.76.36:32765] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)\|\|dorismitchell.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "dorismitchell.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aXLlBQBfu3TBf-Mgl5cq7gAAAB4"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2025-11-27 17:56:16 (9 months ago)	(mod_security) mod_security (id:210350) triggered by 130.49.76.36 (-): 1 in the last 300 secs; Ports ... show more (mod_security) mod_security (id:210350) triggered by 130.49.76.36 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 27 12:56:11.255223 2025] [security2:error] [pid 31359:tid 31359] [client 130.49.76.36:64393] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close\|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close\|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found\|\|i-brochures.com\|F\|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "i-brochures.com"] [uri "/"] [unique_id "aSiQu7lG7PgkMdQAgS5wFgAAAAw"] show less	Brute-Force Bad Web Bot Web App Attack

Showing 1 to 11 of 11 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇳🇱 193.47.62.69

🇨🇳 182.118.64.225

🇷🇺 176.211.19.48

🇫🇷 173.212.241.253

🇧🇪 146.148.8.213

🇺🇦 77.109.21.190

🇪🇸 46.6.127.33

🇩🇪 43.228.157.161

🇷🇺 195.26.81.155

🇨🇱 190.171.165.205

🇳🇱 185.223.235.48

🇵🇾 181.122.113.63

🇷🇺 176.211.106.206

🇨🇳 122.190.71.38

🇮🇳 117.213.142.244

🇮🇳 103.232.239.218

🇷🇺 94.243.13.119

🇳🇱 77.239.124.213

🇵🇱 57.128.222.79

🇺🇸 40.77.167.18