JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 14.99.221.18

14.99.221.18 was found in our database!

This IP was reported 15 times. Confidence of Abuse is 47%: ?

47%

ISP	TATA TELESERVICES LTD - TATA INDICOM - CDMA DIVISION
Usage Type	Fixed Line ISP
ASN	AS45820
Hostname(s)	aachigroup.com webmail.aachigroup.com
Domain Name	tatatel.co.in
Country	🇮🇳 India
City	Chennai, Tamil Nadu

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 14.99.221.18

Whois 14.99.221.18

IP Abuse Reports for 14.99.221.18:

This IP address has been reported a total of 15 times from 11 distinct sources. 14.99.221.18 was first reported on December 24th 2020, and the most recent report was 22 hours ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇩🇪 abdubhai	2026-07-01 09:32:55 (22 hours ago)	14.99.221.18 - - [01/Jul/2026:14 ...	Brute-Force
Anonymous	2026-07-01 05:49:03 (1 day ago)	Bot / scanning and/or hacking attempts: POST /xmlrpc.php HTTP/1.1	Hacking Web App Attack
🇫🇷 masterguru	2026-07-01 03:28:26 (1 day ago)	xmlrpc request blocked, no referer. Pattern match "xmlrpc.php" at REQUEST_URI. (88010-201)	Hacking
🇺🇸 Jason Howell	2026-06-30 11:45:59 (1 day ago)	14.99.221.18 - - [30/Jun/2026:06:36:00 -0500] "POST /xmlrpc.php HTTP/1.1" 200 4956 "-" "Jetpack by W ... show more 14.99.221.18 - - [30/Jun/2026:06:36:00 -0500] "POST /xmlrpc.php HTTP/1.1" 200 4956 "-" "Jetpack by WordPress.com" 14.99.221.18 - - [30/Jun/2026:06:38:07 -0500] "POST /xmlrpc.php HTTP/1.1" 200 4956 "-" "Jetpack by WordPress.com" 14.99.221.18 - - [30/Jun/2026:06:41:40 -0500] "POST /xmlrpc.php HTTP/1.1" 200 4955 "-" "Jetpack/12.0; WordPress/6.4; http://site38794087.com" 14.99.221.18 - - [30/Jun/2026:06:43:51 -0500] "POST /xmlrpc.php HTTP/1.1" 200 4956 "-" "WordPress.com; https://wordpress.com" 14.99.221.18 - - [30/Jun/2026:06:45:58 -0500] "POST /xmlrpc.php HTTP/1.1" 200 4955 "-" "Jetpack/12.5; WordPress/6.4; http://site46682688.com" ... show less	Web App Attack
🇺🇸 TPI-Abuse	2026-06-30 11:33:57 (1 day ago)	(mod_security) mod_security (id:240335) triggered by 14.99.221.18 (webmail.aachigroup.com): 1 in the ... show more (mod_security) mod_security (id:240335) triggered by 14.99.221.18 (webmail.aachigroup.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jun 30 07:33:49.461660 2026] [security2:error] [pid 1269:tid 1279] [client 14.99.221.18:52255] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 14.99.221.18 (+1 hits since last alert)\|managementlaw.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "managementlaw.com"] [uri "/xmlrpc.php"] [unique_id "akOpncqiZpYlh2e55JaaTAAAAQY"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 Jason Howell	2026-06-30 10:35:56 (1 day ago)	14.99.221.18 - - [30/Jun/2026:05:27:26 -0500] "POST /xmlrpc.php HTTP/1.1" 200 4957 "-" "Jetpack by W ... show more 14.99.221.18 - - [30/Jun/2026:05:27:26 -0500] "POST /xmlrpc.php HTTP/1.1" 200 4957 "-" "Jetpack by WordPress.com" 14.99.221.18 - - [30/Jun/2026:05:29:32 -0500] "POST /xmlrpc.php HTTP/1.1" 200 4956 "-" "Jetpack/13.0; WordPress/6.2; http://site31607253.com" 14.99.221.18 - - [30/Jun/2026:05:31:40 -0500] "POST /xmlrpc.php HTTP/1.1" 200 4957 "-" "Jetpack by WordPress.com" 14.99.221.18 - - [30/Jun/2026:05:33:48 -0500] "POST /xmlrpc.php HTTP/1.1" 200 4957 "-" "Jetpack by WordPress.com" 14.99.221.18 - - [30/Jun/2026:05:35:56 -0500] "POST /xmlrpc.php HTTP/1.1" 200 4956 "-" "Jetpack by WordPress.com" ... show less	Web App Attack
🇺🇸 TPI-Abuse	2026-06-29 12:13:51 (2 days ago)	(mod_security) mod_security (id:240335) triggered by 14.99.221.18 (aachigroup.com): 1 in the last 30 ... show more (mod_security) mod_security (id:240335) triggered by 14.99.221.18 (aachigroup.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jun 29 08:13:43.170796 2026] [security2:error] [pid 26694:tid 26694] [client 14.99.221.18:52007] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 14.99.221.18 (+1 hits since last alert)\|forerunnersjazz.org\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "forerunnersjazz.org"] [uri "/xmlrpc.php"] [unique_id "akJhd8IL2NEB2RbGDAoNXAAAAAQ"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 cwytech	2026-06-29 11:39:25 (2 days ago)	Fleet-wide ban from the Ghostfleet 👻. Triggered by scenario: cwy/wp-us-login-only-high.	Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-06-23 03:54:00 (1 week ago)	(mod_security) mod_security (id:240335) triggered by 14.99.221.18 (webmail.aachigroup.com): 1 in the ... show more (mod_security) mod_security (id:240335) triggered by 14.99.221.18 (webmail.aachigroup.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jun 22 23:53:56.719869 2026] [security2:error] [pid 6814:tid 6814] [client 14.99.221.18:50973] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 14.99.221.18 (+1 hits since last alert)\|dynamic-therapy-mn.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "dynamic-therapy-mn.com"] [uri "/xmlrpc.php"] [unique_id "ajoDVFqG_ijxF6GuMuwwLwAAAAw"] show less	Brute-Force Bad Web Bot Web App Attack
Anonymous	2026-06-18 04:08:21 (2 weeks ago)	14.99.221.18 - - [18/Jun/2026:06:07:59 +0200] "POST /xmlrpc.php HTTP/1.1" 200 624 "-" "Jetpack/12.1; ... show more 14.99.221.18 - - [18/Jun/2026:06:07:59 +0200] "POST /xmlrpc.php HTTP/1.1" 200 624 "-" "Jetpack/12.1; WordPress/6.1; http://site88557068.com" 14.99.221.18 - - [18/Jun/2026:06:08:00 +0200] "POST /xmlrpc.php HTTP/1.1" 200 403 "-" "Jetpack/12.1; WordPress/6.1; http://site88557068.com" 14.99.221.18 - - [18/Jun/2026:06:08:09 +0200] "POST /xmlrpc.php HTTP/1.1" 200 624 "-" "Jetpack by WordPress.com" 14.99.221.18 - - [18/Jun/2026:06:08:10 +0200] "POST /xmlrpc.php HTTP/1.1" 200 403 "-" "Jetpack by WordPress.com" 14.99.221.18 - - [18/Jun/2026:06:08:20 +0200] "POST /xmlrpc.php HTTP/1.1" 200 624 "-" "Jetpack/12.5; WordPress/6.3; http://site78914534.com" ... show less	Brute-Force Web App Attack
Anonymous	2026-05-26 07:01:10 (1 month ago)	Attac	Brute-Force
Anonymous	2026-05-20 06:58:41 (1 month ago)	Attac	Brute-Force
🇯🇵 stfw	2021-01-17 16:35:39 (5 years ago)	445/tcp [2021-01-17]1pkt	Port Scan
🇫🇮 Kimmo Rieskaniemi	2021-01-02 04:12:15 (5 years ago)	Brute-force attempt banned	Brute-Force SSH
Anonymous	2020-12-24 04:13:23 (5 years ago)		Brute-Force SSH

Showing 1 to 15 of 15 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇮🇪 2a05:d018:10df:d400:faf:e1c5:ccb2:3cf9

🇺🇸 2607:f8b0:4004:1001::127

🇺🇸 195.184.76.99

🇲🇽 189.240.44.9

🇺🇸 167.99.54.222

🇺🇸 162.216.150.13

🇰🇷 152.32.243.245

🇳🇬 105.113.41.77

🇺🇸 104.131.164.182

🇧🇩 103.99.250.55

🇮🇪 2a05:d018:10df:d402:5074:a2c6:8bd2:2b4a

🇨🇳 180.153.236.104

🇭🇰 152.32.135.81

🇷🇺 147.45.48.17

🇧🇩 103.242.219.181

🇭🇰 103.146.159.173

🇵🇰 103.72.1.203

🇨🇳 101.126.53.14

🇷🇺 94.243.10.99

🇺🇸 71.6.242.24