JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 149.30.139.2

149.30.139.2 was found in our database!

This IP was reported 22 times. Confidence of Abuse is 51%: ?

51%

ISP	RoyalCable Flash
Usage Type	Fixed Line ISP
ASN	AS134707
Domain Name	royalcable.com.ph
Country	🇵🇭 Philippines
City	Majayjay, Calabarzon

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 149.30.139.2

Whois 149.30.139.2

IP Abuse Reports for 149.30.139.2:

This IP address has been reported a total of 22 times from 13 distinct sources. 149.30.139.2 was first reported on October 22nd 2025, and the most recent report was 7 hours ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇩🇪 ghostwarriors	2026-10-22 15:20:05 (7 hours ago)	Attempts against non-existent wp-login	Brute-Force Web App Attack
🇩🇪 yitzhaq	2026-10-22 14:59:59 (7 hours ago)	149.30.139.2 - - [22/Oct/2026:16:59:48 +0200] "GET /wp-json/wp/v2/comments?per_page=100&page=1&_fiel ... show more 149.30.139.2 - - [22/Oct/2026:16:59:48 +0200] "GET /wp-json/wp/v2/comments?per_page=100&page=1&_fields=author_name,author_url HTTP/2.0" 200 629 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36" 149.30.139.2 - - [22/Oct/2026:16:59:49 +0200] "GET /author-sitemap.xml HTTP/2.0" 404 43394 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36" 149.30.139.2 - - [22/Oct/2026:16:59:50 +0200] "GET /feed/ HTTP/2.0" 200 855 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36" 149.30.139.2 - - [22/Oct/2026:16:59:51 +0200] "GET /rss/ HTTP/2.0" 301 123 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36" 149.30.139.2 - - [22/Oct/2026:16:59:52 +0200] "GET /feed/ HTTP/2.0" 200 804 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 show less	Web App Attack Hacking
🇫🇷 masterguru	2026-10-21 21:52:21 (1 day ago)	WordPress: User enumeration. Pattern match "(author\\\\= (88030-193)	Hacking
🇩🇪 LRob	2026-10-21 02:05:38 (1 day ago)	Not following 301 redirects — wasted requests \| method: POST \| path: /wp-login.php \| ua: Mozilla/5.0 ... show more Not following 301 redirects — wasted requests \| method: POST \| path: /wp-login.php \| ua: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 \| 2026-10-21 02:05 UTC show less	Bad Web Bot
🇫🇷 LRob	2026-10-19 16:09:05 (3 days ago)	Not following 301 redirects — wasted requests \| method: POST \| path: /wp-login.php \| ua: Mozilla/5.0 ... show more Not following 301 redirects — wasted requests \| method: POST \| path: /wp-login.php \| ua: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36 show less	Bad Web Bot
🇺🇸 TPI-Abuse	2026-10-14 13:17:38 (1 week ago)	(mod_security) mod_security (id:225170) triggered by 149.30.139.2 (-): 1 in the last 300 secs; Ports ... show more (mod_security) mod_security (id:225170) triggered by 149.30.139.2 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 14 09:17:31.586398 2026] [security2:error] [pid 22126:tid 22126] [client 149.30.139.2:35378] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)\|\|monmouthcountydanceclasses.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "monmouthcountydanceclasses.com"] [uri "/wp-json/wp/v2/users"] [unique_id "as-A6yyiJLkNMSrBkAsFxAAAABI"] show less	Brute-Force Bad Web Bot Web App Attack
🇷🇺 AbuseIPDB informer	2026-10-13 08:05:54 (1 week ago)	nfdump top talker: 149.30.139.2 \| first seen 2026-10-13 08:05:54.944 \| duration 00:00:00.171 \| flows ... show more nfdump top talker: 149.30.139.2 \| first seen 2026-10-13 08:05:54.944 \| duration 00:00:00.171 \| flows=13 \| packets=487971 \| bytes=352.3 M \| pps=2840 \| bps=16.4 M \| bpp=722 \| proto=any show less	DDoS Attack Port Scan Exploited Host
🇷🇺 AbuseIPDB informer	2026-10-12 16:23:52 (1 week ago)	nfdump top talker: 149.30.139.2 \| first seen 2026-10-12 19:23:52.832 \| duration 00:00:00.277 \| flows ... show more nfdump top talker: 149.30.139.2 \| first seen 2026-10-12 19:23:52.832 \| duration 00:00:00.277 \| flows=17 \| packets=587202 \| bytes=426.0 M \| pps=2114 \| bps=12.3 M \| bpp=725 \| proto=udp show less	DDoS Attack Exploited Host
🇷🇺 AbuseIPDB informer	2026-10-12 09:25:00 (1 week ago)	nfdump top talker: 149.30.139.2 \| first seen 2026-10-12 12:25:00.288 \| duration 00:00:00.265 \| flows ... show more nfdump top talker: 149.30.139.2 \| first seen 2026-10-12 12:25:00.288 \| duration 00:00:00.265 \| flows=34 \| packets=1.2 M \| bytes=836.0 M \| pps=4339 \| bps=25.2 M \| bpp=726 \| proto=udp show less	DDoS Attack Exploited Host
🇷🇺 AbuseIPDB informer	2026-10-12 09:25:00 (1 week ago)	nfdump top talker: 149.30.139.2 \| first seen 2026-10-12 12:25:00.288 \| duration 00:00:00.265 \| flows ... show more nfdump top talker: 149.30.139.2 \| first seen 2026-10-12 12:25:00.288 \| duration 00:00:00.265 \| flows=31 \| packets=1.1 M \| bytes=807.1 M \| pps=4188 \| bps=24.3 M \| bpp=726 \| proto=udp show less	DDoS Attack Exploited Host
🇺🇸 TPI-Abuse	2026-10-12 04:11:39 (1 week ago)	(mod_security) mod_security (id:225170) triggered by 149.30.139.2 (-): 1 in the last 300 secs; Ports ... show more (mod_security) mod_security (id:225170) triggered by 149.30.139.2 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Oct 12 00:11:33.348451 2026] [security2:error] [pid 1011:tid 1011] [client 149.30.139.2:37746] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)\|\|yogawithbubba.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "yogawithbubba.com"] [uri "/wp-json/wp/v2/users/me"] [unique_id "asxd9WLeKkBuzgeG_XJG8wAAAAk"] show less	Brute-Force Bad Web Bot Web App Attack
🇷🇺 AbuseIPDB informer	2026-10-11 21:44:25 (1 week ago)	nfdump top talker: 149.30.139.2 \| first seen 2026-10-11 21:44:25.728 \| duration 00:00:00.082 \| flows ... show more nfdump top talker: 149.30.139.2 \| first seen 2026-10-11 21:44:25.728 \| duration 00:00:00.082 \| flows=7 \| packets=317130 \| bytes=229.0 M \| pps=3847 \| bps=22.2 M \| bpp=722 \| proto=any show less	DDoS Attack Exploited Host
🇫🇷 Tilellit.PRO	2026-10-11 00:00:39 (1 week ago)	Fail2Ban banned 149.30.139.2 for security violations in jail wp-armour. Log: 2026/10/11 00:00:38 [er ... show more Fail2Ban banned 149.30.139.2 for security violations in jail wp-armour. Log: 2026/10/11 00:00:38 [error] FastCGI sent in stderr: "PHP message: [WP_ARMOUR_BAN] IP: 149.30.139.2 \| Type: wplogin \| URI: /wp-login.php" , client: 149.30.139.2, server: [REDACTED], request: "POST /wp-login.php HTTP/2.0", upstream: [REDACTED], host: [REDACTED], referrer: "https://caffebook.it/wp-login.php" ... show less	Web Spam
🇩🇪 tentwentyfour	2026-10-10 13:51:23 (1 week ago)	Blocked for brute-forcing WordPress log-in	Brute-Force Web App Attack
🇷🇺 AbuseIPDB informer	2026-10-09 08:28:26 (1 week ago)	nfdump top talker: 149.30.139.2 \| first seen 2026-10-09 11:28:26.496 \| duration 00:00:00.371 \| flows ... show more nfdump top talker: 149.30.139.2 \| first seen 2026-10-09 11:28:26.496 \| duration 00:00:00.371 \| flows=43 \| packets=1.7 M \| bytes=1.3 G \| pps=4563 \| bps=27.2 M \| bpp=745 \| proto=any show less	DDoS Attack Port Scan Exploited Host

Showing 1 to 15 of 22 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇰🇷 220.123.33.105

🇷🇺 178.216.165.187

🇧🇴 166.114.168.209

🇮🇱 129.159.153.250

🇬🇧 77.67.26.14

🇦🇪 74.162.106.25

🇺🇸 70.37.89.177

🇺🇸 45.55.186.92

🇧🇪 34.62.189.80

🇬🇧 31.14.254.32

🇺🇸 20.118.251.93

🇨🇳 222.219.131.47

🇨🇴 201.184.50.251

🇳🇱 194.50.16.73

🇪🇨 181.199.9.71

🇺🇸 172.171.233.230

🇵🇱 80.238.117.164

🇺🇦 62.205.129.65

🇬🇧 51.52.115.150

🇳🇱 45.148.10.141