JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 149.22.87.26

149.22.87.26 was found in our database!

This IP was reported 14 times. Confidence of Abuse is 27%: ?

27%

ISP	DataCamp Limited
Usage Type	Data Center/Web Hosting/Transit
ASN	AS212238
Hostname(s)	unn-149-22-87-26.datapacket.com
Domain Name	datacamp.co.uk
Country	🇯🇵 Japan
City	Tokyo, Tokyo

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 149.22.87.26

Whois 149.22.87.26

IP Abuse Reports for 149.22.87.26:

This IP address has been reported a total of 14 times from 12 distinct sources. 149.22.87.26 was first reported on October 9th 2024, and the most recent report was 1 day ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇺🇸 TPI-Abuse	2026-06-12 19:11:56 (1 day ago)	(mod_security) mod_security (id:210730) triggered by 149.22.87.26 (unn-149-22-87-26.datapacket.com): ... show more (mod_security) mod_security (id:210730) triggered by 149.22.87.26 (unn-149-22-87-26.datapacket.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jun 12 15:11:52.639202 2026] [security2:error] [pid 24899:tid 24899] [client 149.22.87.26:0] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy\|\|luisguacache.com\|F\|2"] [data ".xsd"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "luisguacache.com"] [uri "/vendor/phpunit/phpunit/phpunit.xsd"] [unique_id "aixZ-PvC4XeCz4wxcZChKgAAAAo"] show less	Brute-Force Bad Web Bot Web App Attack
🇯🇵 beon	2026-06-12 05:03:58 (1 day ago)	[DateTime=>2026-06-12T05:03:58Z (UTC)] , [HoneyPot_Hit=>once] , [HoneyPot=>/vendor/phpunit/phpunit/p ... show more [DateTime=>2026-06-12T05:03:58Z (UTC)] , [HoneyPot_Hit=>once] , [HoneyPot=>/vendor/phpunit/phpunit/phpunit.xsd] , [total_Hit=>once] show less	Bad Web Bot Web App Attack Hacking
🇯🇵 demonsword	2026-06-01 09:58:14 (1 week ago)	Detected by SentinelX honeypot: sent HTTP CONNECT request probing for an open proxy. Connection was ... show more Detected by SentinelX honeypot: sent HTTP CONNECT request probing for an open proxy. Connection was hijacked and held in a tarpit to slow down the scan. Probed target: icanhazip.com:443 show less	Open Proxy Port Scan
🇯🇵 demonsword	2026-05-28 09:50:06 (2 weeks ago)	Detected by SentinelX honeypot: sent HTTP CONNECT request probing for an open proxy. Connection was ... show more Detected by SentinelX honeypot: sent HTTP CONNECT request probing for an open proxy. Connection was hijacked and held in a tarpit to slow down the scan. Probed target: clients3.google.com:443 show less	Open Proxy Port Scan
🇺🇸 TPI-Abuse	2026-05-10 11:05:08 (1 month ago)	(mod_security) mod_security (id:210492) triggered by 149.22.87.26 (unn-149-22-87-26.datapacket.com): ... show more (mod_security) mod_security (id:210492) triggered by 149.22.87.26 (unn-149-22-87-26.datapacket.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun May 10 07:05:00.675258 2026] [security2:error] [pid 17304:tid 17304] [client 149.22.87.26:45463] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "madandproud.com"] [uri "/.env"] [unique_id "agBmXKCyClVKXKA-3TKteQAAABg"] show less	Brute-Force Bad Web Bot Web App Attack
🇮🇩 David Koswari	2026-04-27 05:11:00 (1 month ago)	REQ_BLOCKED_SECURITY	DDoS Attack FTP Brute-Force Ping of Death Port Scan Hacking SQL Injection Spoofing Brute-Force Bad Web Bot Exploited Host Web App Attack SSH IoT Targeted
🇺🇦 URAN Publishing Service	2026-04-16 12:45:41 (1 month ago)	149.22.87.26 - - [16/Apr/2026:15:44:28 +0300] "GET /cgi-bin/shell20211028.php HTTP/1.1" 404 245 "-" ... show more 149.22.87.26 - - [16/Apr/2026:15:44:28 +0300] "GET /cgi-bin/shell20211028.php HTTP/1.1" 404 245 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.102 Safari/537.36" 149.22.87.26 - - [16/Apr/2026:15:45:41 +0300] "GET /wp-admin/shell20211028.php HTTP/1.1" 404 683 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.102 Safari/537.36" ... show less	Web App Attack
🇫🇷 masterguru	2026-03-21 08:15:59 (2 months ago)	(modsec_5080) ModSec 5080: Infrastructure subdomain probe from 149.22.87.26 (JP/Japan/unn-149-22-87- ... show more (modsec_5080) ModSec 5080: Infrastructure subdomain probe from 149.22.87.26 (JP/Japan/unn-149-22-87-26.datapacket.com): 1 in the last 3600 secs (0-201) show less	Hacking
Anonymous	2026-03-17 05:05:07 (2 months ago)	Web attack	Bad Web Bot Web App Attack
🇨🇭 Origon	2026-02-25 10:53:00 (3 months ago)	recidive - IP: 149.22.87.26 - 2026-02-25 05:34:52,667 fail2ban.actions [245081]: NOTICE [plesk-word ... show more recidive - IP: 149.22.87.26 - 2026-02-25 05:34:52,667 fail2ban.actions [245081]: NOTICE [plesk-wordpress] Ban 149.22.87.26 2026-02-25 09:39:34,245 fail2ban.actions [245081]: NOTICE [plesk-wordpress] Ban 149.22.87.26 2026-02-25 11:52:59,439 fail2ban.actions [245081]: NOTICE [plesk-wordpress] Ban 149.22.87.26 show less	Web App Attack
Anonymous	2026-02-25 05:53:52 (3 months ago)	Excessive request and web scraping	Bad Web Bot Web App Attack
🇧🇪 cmbplf	2026-02-25 03:23:46 (3 months ago)	2.665 requests with url.path */xmlrpc.php	Brute-Force Bad Web Bot
🇺🇸 kosada.com	2025-05-30 07:26:45 (1 year ago)	Web password guessing	Brute-Force
Anonymous	2024-10-09 14:46:27 (1 year ago)	Ports: 80,443; Direction: 0; Trigger: LF_CUSTOMTRIGGER	Brute-Force SSH

Showing 1 to 14 of 14 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇨🇳 223.74.189.181

🇳🇱 213.109.119.221

🇳🇱 204.76.203.51

🇧🇴 190.181.27.37

🇫🇷 185.177.72.69

🇷🇺 185.40.30.168

🇳🇱 183.81.169.76

🇮🇳 182.95.150.186

🇨🇳 175.0.68.49

🇺🇸 172.236.111.128

🇺🇸 172.208.49.189

🇩🇪 167.94.145.23

🇩🇪 165.232.118.73

🇺🇸 165.227.111.234

🇩🇪 144.76.67.25

🇸🇦 144.24.209.174

🇨🇳 115.190.115.237

🇰🇷 112.151.178.49

🇺🇸 100.29.192.57

🇺🇸 85.208.96.206