JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 149.88.22.177

149.88.22.177 was found in our database!

This IP was reported 27 times. Confidence of Abuse is 63%: ?

63%

ISP	Datacamp Limited
Usage Type	Data Center/Web Hosting/Transit
ASN	AS212238
Hostname(s)	unn-149-88-22-177.datapacket.com
Domain Name	datacamp.co.uk
Country	🇲🇽 Mexico
City	Santiago de Queretaro, Queretaro

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 149.88.22.177

Whois 149.88.22.177

IP Abuse Reports for 149.88.22.177:

This IP address has been reported a total of 27 times from 19 distinct sources. 149.88.22.177 was first reported on September 7th 2024, and the most recent report was 9 hours ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇫🇷 bazter.pro	2026-07-10 15:28:27 (9 hours ago)	Fail2Ban: plesk-bot-aggressive - 15 failures	Port Scan Bad Web Bot Web App Attack
🇫🇷 Baking333	2026-07-10 12:27:15 (12 hours ago)	[redacted] 149.88.22.177 - - [10/Jul/2026:13:27:05 +0100] "GET /.env HTTP/2.0" 301 291 "-" "Mozilla/ ... show more [redacted] 149.88.22.177 - - [10/Jul/2026:13:27:05 +0100] "GET /.env HTTP/2.0" 301 291 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:121.0) Gecko/20100101 Firefox/121.0" [redacted] 149.88.22.177 - - [10/Jul/2026:13:27:12 +0100] "GET /fr/.env/ HTTP/2.0" 404 26701 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:121.0) Gecko/20100101 Firefox/121.0" show less	Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-07-09 09:44:50 (1 day ago)	(mod_security) mod_security (id:210492) triggered by 149.88.22.177 (unn-149-88-22-177.datapacket.com ... show more (mod_security) mod_security (id:210492) triggered by 149.88.22.177 (unn-149-88-22-177.datapacket.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jul 09 05:44:42.732403 2026] [security2:error] [pid 5472:tid 5472] [client 149.88.22.177:49909] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "asiancommoditiescorporation.com"] [uri "/.env"] [unique_id "ak9tiiqhUwWJNcATwMbFYQAAAAY"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-07-09 08:46:09 (1 day ago)	(mod_security) mod_security (id:210492) triggered by 149.88.22.177 (unn-149-88-22-177.datapacket.com ... show more (mod_security) mod_security (id:210492) triggered by 149.88.22.177 (unn-149-88-22-177.datapacket.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jul 09 04:46:04.222758 2026] [security2:error] [pid 6482:tid 6482] [client 149.88.22.177:63536] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "barigby.com"] [uri "/.env"] [unique_id "ak9fzENAbC1Bo8XQALxgMAAAAAQ"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-07-09 08:15:27 (1 day ago)	(mod_security) mod_security (id:210492) triggered by 149.88.22.177 (unn-149-88-22-177.datapacket.com ... show more (mod_security) mod_security (id:210492) triggered by 149.88.22.177 (unn-149-88-22-177.datapacket.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jul 09 04:15:21.855167 2026] [security2:error] [pid 9291:tid 9291] [client 149.88.22.177:62718] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "ramabahama.net"] [uri "/.env"] [unique_id "ak9YmVTFYcQr5_bT4ps_tgAAAB4"] show less	Brute-Force Bad Web Bot Web App Attack
🇧🇪 cmbplf	2026-07-08 20:34:38 (2 days ago)	292 requests with url.path *.env	Brute-Force Bad Web Bot
🇺🇸 TPI-Abuse	2026-07-08 20:21:36 (2 days ago)	(mod_security) mod_security (id:210492) triggered by 149.88.22.177 (unn-149-88-22-177.datapacket.com ... show more (mod_security) mod_security (id:210492) triggered by 149.88.22.177 (unn-149-88-22-177.datapacket.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jul 08 16:21:30.312918 2026] [security2:error] [pid 26171:tid 26186] [client 149.88.22.177:61600] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "onernet.com"] [uri "/.env"] [unique_id "ak6xSnXpidy2S6etTsb7WAAAAEs"] show less	Brute-Force Bad Web Bot Web App Attack
🇬🇧 consul.to	2026-07-08 19:42:10 (2 days ago)	Web attack/malicious scanning detected	Web App Attack
🇪🇸 alferez	2026-07-08 19:11:18 (2 days ago)	Searching .(env\|sql\|zip\|tar\|rar) files	Hacking Exploited Host Web App Attack
🇪🇸 pipeline.es	2026-07-08 18:52:43 (2 days ago)	Web scanning / probing for vulnerable paths \| URL: /protected/.env \| Evidence: www.[redacted] 149.88 ... show more Web scanning / probing for vulnerable paths \| URL: /protected/.env \| Evidence: www.[redacted] 149.88.22.177 - - [08/Jul/2026:20:47:54 +0200] \"GET /protected/.env HTTP/1.1\" 404 212 \"-\" \"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.129 Safari/537.36\" GEOIP_COUNTRY_CODE=MX \| ASN: Datacamp Limited \| Country: MX show less	Port Scan Web App Attack
🇫🇷 LRob	2026-07-08 18:48:02 (2 days ago)	CrowdSec: crowdsecurity/http-sensitive-files \| req: ["/local/.env","/public/.env","/app/.env","/back ... show more CrowdSec: crowdsecurity/http-sensitive-files \| req: ["/local/.env","/public/.env","/app/.env","/backend/.env","/old/.env"] \| UA: ["Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.129 Safari/537.36"] show less	Hacking
🇺🇸 TPI-Abuse	2026-07-08 18:38:02 (2 days ago)	(mod_security) mod_security (id:210492) triggered by 149.88.22.177 (unn-149-88-22-177.datapacket.com ... show more (mod_security) mod_security (id:210492) triggered by 149.88.22.177 (unn-149-88-22-177.datapacket.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jul 08 14:37:56.999646 2026] [security2:error] [pid 19983:tid 19983] [client 149.88.22.177:54563] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "gonzalez.com"] [uri "/.env"] [unique_id "ak6ZBL-VglNsKRjSqC6TtwAAABI"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-07-08 17:48:21 (2 days ago)	(mod_security) mod_security (id:210492) triggered by 149.88.22.177 (unn-149-88-22-177.datapacket.com ... show more (mod_security) mod_security (id:210492) triggered by 149.88.22.177 (unn-149-88-22-177.datapacket.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jul 08 13:48:14.354070 2026] [security2:error] [pid 20862:tid 20862] [client 149.88.22.177:53598] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "ictsl.net"] [uri "/.env"] [unique_id "ak6NXsBWzPA2HeK4ZZLdNQAAAAY"] show less	Brute-Force Bad Web Bot Web App Attack
🇫🇷 UM3	2026-07-04 13:13:08 (6 days ago)	Exim Auth Failed	Brute-Force
🇩🇪 webanyone	2026-06-09 05:15:26 (1 month ago)	WAF repeated trigger detected by Fail2Ban in plesk-modsecurity jail	Web App Attack

Showing 1 to 15 of 27 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇰🇷 112.216.129.27

🇰🇷 210.183.21.53

🇨🇦 207.219.221.101

🇺🇸 205.210.31.49

🇹🇭 202.29.234.42

🇺🇸 172.174.17.234

🇺🇸 162.216.149.37

🇷🇺 93.88.143.37

🇬🇧 87.236.176.167

🇨🇦 66.70.255.14

🇱🇹 45.227.254.159

🇺🇸 45.132.115.64

🇺🇸 40.124.174.149

🇬🇧 35.203.211.69

🇺🇸 23.168.216.43

🇨🇳 220.197.85.2

🇹🇼 198.235.24.20

🇲🇽 187.184.9.107

🇫🇷 185.177.72.17

🇲🇾 182.63.119.141