JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 149.200.255.213

149.200.255.213 was found in our database!

This IP was reported 22 times. Confidence of Abuse is 61%: ?

61%

ISP	Jordan Data Communications Company LLC
Usage Type	Fixed Line ISP
ASN	AS8376
Domain Name	orange-jtg.jo
Country	🇯🇴 Jordan
City	Amman, Amman

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 149.200.255.213

Whois 149.200.255.213

IP Abuse Reports for 149.200.255.213:

This IP address has been reported a total of 22 times from 16 distinct sources. 149.200.255.213 was first reported on May 19th 2025, and the most recent report was 3 days ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇳🇿 Tripwire	2026-06-28 18:39:41 (3 days ago)	Probing for Wordpress - /xmlrpc.php	Brute-Force Web App Attack
🇫🇷 dynamix	2026-06-27 19:35:29 (4 days ago)	WordPress XMLRPC Brute Force Attack	Brute-Force Web App Attack
🇺🇸 TPI-Abuse	2026-06-27 12:46:19 (5 days ago)	(mod_security) mod_security (id:240335) triggered by 149.200.255.213 (-): 1 in the last 300 secs; Po ... show more (mod_security) mod_security (id:240335) triggered by 149.200.255.213 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Jun 27 08:46:12.811348 2026] [security2:error] [pid 23397:tid 23397] [client 149.200.255.213:29725] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 149.200.255.213 (+1 hits since last alert)\|iconbizpromo.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "iconbizpromo.com"] [uri "/xmlrpc.php"] [unique_id "aj_GFFeNxzwuCfp3v6rDYwAAABU"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-06-27 08:43:46 (5 days ago)	(mod_security) mod_security (id:240335) triggered by 149.200.255.213 (-): 1 in the last 300 secs; Po ... show more (mod_security) mod_security (id:240335) triggered by 149.200.255.213 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Jun 27 04:43:41.450577 2026] [security2:error] [pid 21286:tid 21286] [client 149.200.255.213:45602] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 149.200.255.213 (+1 hits since last alert)\|frogdesignmexico.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "frogdesignmexico.com"] [uri "/xmlrpc.php"] [unique_id "aj-NPfqk-NTfu2IAkTnfDAAAAAQ"] show less	Brute-Force Bad Web Bot Web App Attack
🇫🇷 tecnicorioja	2026-06-26 22:02:58 (5 days ago)	POST /xmlrpc.php [26/Jun/2026:20:19:42	Web App Attack Brute-Force
Anonymous	2026-06-26 07:50:07 (6 days ago)	149.200.255.213 - - [26/Jun/2026:09:48:07 +0200] "POST /xmlrpc.php HTTP/1.1" 200 418 149.200.255.213 ... show more 149.200.255.213 - - [26/Jun/2026:09:48:07 +0200] "POST /xmlrpc.php HTTP/1.1" 200 418 149.200.255.213 - - [26/Jun/2026:09:50:06 +0200] "POST /xmlrpc.php HTTP/1.1" 200 418 ... show less	Brute-Force Bad Web Bot
🇺🇸 TPI-Abuse	2026-06-25 06:53:30 (1 week ago)	(mod_security) mod_security (id:240335) triggered by 149.200.255.213 (-): 1 in the last 300 secs; Po ... show more (mod_security) mod_security (id:240335) triggered by 149.200.255.213 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jun 25 02:53:22.470609 2026] [security2:error] [pid 1412:tid 1412] [client 149.200.255.213:37876] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 149.200.255.213 (+1 hits since last alert)\|londongroup.info\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "londongroup.info"] [uri "/xmlrpc.php"] [unique_id "ajzQYnMnyroGU8tqNK1_pgAAADI"] show less	Brute-Force Bad Web Bot Web App Attack
🇫🇷 dynamix	2026-06-24 14:54:05 (1 week ago)	WordPress XMLRPC Brute Force Attack	Brute-Force Web App Attack
Anonymous	2026-06-24 11:17:09 (1 week ago)	Fail2Ban - Wordpress brute-force ...	Brute-Force Web App Attack
🇫🇷 Kenshin869	2026-06-24 09:23:37 (1 week ago)	Wordpress unauthorized access attempt	Brute-Force
Anonymous	2026-06-23 15:16:45 (1 week ago)	[ns41.kdns.gr] httpd-xmlrpc-post: sites=coris.gr; logs=/var/log/httpd/domains/coris.gr.log; samples= ... show more [ns41.kdns.gr] httpd-xmlrpc-post: sites=coris.gr; logs=/var/log/httpd/domains/coris.gr.log; samples=/xmlrpc.php show less	Brute-Force Web App Attack
🇺🇸 WeekendWeb	2026-06-22 20:41:46 (1 week ago)	Wordpress Vunerability attack	Web App Attack
🇳🇱 debestelapp	2026-06-22 18:35:05 (1 week ago)		Web App Attack
🇦🇺 screwlooseit.com.au	2026-06-22 14:33:25 (1 week ago)	Blocked by CSF 13 firewall - Rule: XMLRPC JO/Hashemite Kingdom of Jordan/-	Web App Attack
🇩🇪 SMARTNET	2026-05-27 06:03:53 (1 month ago)	Aisuru(Mirai variant) DDoS \| Incident ID: 1c72ea9a-d634-4668-a8aa-89a786da95ec	DDoS Attack

Showing 1 to 15 of 22 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇺🇸 185.150.190.165

🇨🇳 110.188.66.228

🇻🇳 2001:ee1:f70f:2340:b5b2:e804:ac49:f03c

🇨🇦 185.98.171.60

🇧🇷 167.250.103.137

🇨🇳 123.144.30.37

🇨🇲 102.244.197.137

🇺🇸 45.43.57.5

🇺🇸 20.163.2.150

🇹🇼 210.68.105.68

🇺🇸 184.105.247.227

🇸🇬 103.250.11.156

🇧🇩 103.239.252.132

🇧🇩 103.153.110.190

🇪🇸 85.87.103.202

🇬🇧 81.103.234.208

🇩🇪 8.211.42.77

🇨🇳 2409:8c14:f22:1104:1::1e4

🇺🇸 205.210.31.55

🇺🇸 179.61.232.244