149.154.161.201
Recent Activity
This IP has received recent abuse reports, which causes the score to increase.
- ISP
- Telegram Messenger Network
- Usage Type
- Commercial
- ASN
- AS62041
- Hostname(s)
- ip-149-154-161-201.ptr.telegram.org
- Domain Name
- telegram.org
- Country
- 🇳🇱 Netherlands
- City
- Amsterdam, North Holland
Abuse Reports
Total reports
274 from
37 distinct
reporters
First reported
Most recent report
Recent reports
We have received reports of abusive activity from this IP address within the last week. It is
potentially still actively engaged in abusive activities.
| Reporter | IoA Timestamp (UTC) | Comment | Categories |
|---|---|---|---|
| 🇨🇭 TheCoon |
Automated: Credential theft attempt - JSON bomb served
|
Web App Attack Hacking | |
| 🇩🇪 ghostwarriors |
Attempts against non-existent wp-login
|
Brute-Force Web App Attack | |
| 🇩🇪 throny |
Web app exploit probe on a honeypot: requested known vulnerability paths (wp-login.php, .env, .git ...).
Requests within an hour: 1 on 1 host(s)
User agent: TelegramBot (like TwitterBot)
Requested, e.g.:
- portainer.[REDACTED]/.environment
|
Web App Attack | |
| 🇨🇭 TheCoon |
Automated: Credential theft attempt - JSON bomb served
|
Web App Attack Hacking | |
| 🇹🇼 tyetriiix |
Wazuh Alert Evidence: 2026/11/04 11:02:27 [error] 2813945#2813945: *39792 access forbidden by rule, client: 149.154.161.201, server: localhost, request: "GET /59.120.34.133:443 HTTP/1.1", host: "dev.triiix.io"
|
Web App Attack | |
| 🇺🇸 SX Communications |
HTTP application-layer DoS / botnet traffic from 149.154.161.201: repeated high-cost dynamic page and feed requests (profile/tag views, forums, tracker, RSS) at abusive rates via completed TCP/HTTPS. Likely compromised end-user host.
|
DDoS Attack Bad Web Bot Exploited Host | |
| 🇳🇱 johntps |
Automated honeypot defense: host probed a decoy/trap endpoint (/data.sql) on a monitored web server; confirmed malicious and blocked.
|
Web App Attack Bad Web Bot | |
| 🇨🇭 TheCoon |
Automated: Credential theft attempt - JSON bomb served
|
Web App Attack Hacking | |
| 🇨🇭 TheCoon |
Automated: Credential theft attempt - JSON bomb served
|
Web App Attack Hacking | |
| 🇨🇭 TheCoon |
Automated: Credential theft attempt - JSON bomb served
|
Web App Attack Hacking | |
| 🇨🇭 🇨🇭 Hosting |
Automated security scanning detected: WordPress Setup-Config Probing. Systematic reconnaissance using automated tools.
|
Web App Attack | |
| 🇮🇹 sentinel1 |
Sentinel: [Path traversal] status=301 [GET] cyberchords.nexus-orbital.com/wp-content/plugins/canto/includes/lib/sizes.php?abspath=../../../../../ -> 301
|
Web App Attack | |
| 🇩🇪 big-cloud.nl |
Try to access /xmlrpc.php%D0%91%D1%80%D1%83%D1%82%D1%84%D0%BE%D1%80%D1%81+%D0%9F%D0%B0%D1%80%D1%81%D0%B8%D0%BD%D0%B3
|
Web App Attack | |
| 🇨🇭 TheCoon |
Automated: Credential theft attempt - JSON bomb served
|
Web App Attack Hacking | |
| 🇮🇩 sockominfo |
Reported by TangerangKota-CSIRT. Status: MALICIOUS
|
Hacking Web App Attack |
Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown