JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 149.88.67.49

149.88.67.49 was found in our database!

This IP was reported 30 times. Confidence of Abuse is 100%: ?

100%

ISP	Cogent Communications, LLC
Usage Type	Data Center/Web Hosting/Transit
ASN	AS401696
Domain Name	cogentco.com
Country	🇭🇰 Hong Kong
City	Kwai Chung, Kwai Tsing District

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 149.88.67.49

Whois 149.88.67.49

IP Abuse Reports for 149.88.67.49:

This IP address has been reported a total of 30 times from 29 distinct sources. 149.88.67.49 was first reported on September 11th 2026, and the most recent report was 6 minutes ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
Anonymous	2026-09-11 20:43:25 (6 minutes ago)	Web application attack detected.	Web App Attack
🇺🇸 fx	2026-09-11 20:15:48 (34 minutes ago)	SSH brute-force / unauthorized pre-auth probing against production node Manual-Audit. Filtered & dro ... show more SSH brute-force / unauthorized pre-auth probing against production node Manual-Audit. Filtered & dropped by iptables. Raw audit: Manual audit command trigger show less	Brute-Force SSH
🇵🇾 SecOpsSL	2026-09-11 20:05:09 (45 minutes ago)	2026-09-11T17:04:16.039570webserver sshd[58113]: Invalid user admin from 149.88.67.49 port 38410 202 ... show more 2026-09-11T17:04:16.039570webserver sshd[58113]: Invalid user admin from 149.88.67.49 port 38410 2026-09-11T17:04:18.337674webserver sshd[58113]: Failed password for invalid user admin from 149.88.67.49 port 38410 ssh2 2026-09-11T17:05:08.122314webserver sshd[59758]: Invalid user user from 149.88.67.49 port 52094 ... show less	Brute-Force SSH
🇫🇷 Max la Menace	2026-09-11 19:47:28 (1 hour ago)	2026-09-11T21:46:50.003972+02:00 ns3124905 sshd-session[3107053]: pam_unix(sshd:auth): authenticatio ... show more 2026-09-11T21:46:50.003972+02:00 ns3124905 sshd-session[3107053]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=149.88.67.49 2026-09-11T21:46:51.965342+02:00 ns3124905 sshd-session[3107053]: Failed password for invalid user admin from 149.88.67.49 port 40334 ssh2 2026-09-11T21:47:27.499504+02:00 ns3124905 sshd-session[3107137]: Invalid user user from 149.88.67.49 port 39466 ... show less	Brute-Force SSH
Anonymous	2026-09-11 19:41:07 (1 hour ago)	$f2bV_matches	Brute-Force
🇺🇸 factor1	2026-09-11 19:25:07 (1 hour ago)	CrowdSec at atlas Reports Abuse	Web App Attack
Anonymous	2026-09-11 19:09:40 (1 hour ago)	SSH brute force attempt. User: admin, Pass: [REDACTED]	Brute-Force SSH
Anonymous	2026-09-11 19:03:57 (1 hour ago)	149.88.67.49 - - [11/Sep/2026:16:03:56 -0300] "POST /cgi-bin/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e ... show more 149.88.67.49 - - [11/Sep/2026:16:03:56 -0300] "POST /cgi-bin/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/bin/sh HTTP/1.1" Dest:Port 80 HTTP_Status: 400 ... show less	Web App Attack
🇩🇪 ghostwarriors	2026-09-11 18:50:29 (1 hour ago)	Unauthorized connection attempt detected, SSH Brute-Force	Brute-Force Port Scan SSH
🇺🇸 TPI-Abuse	2026-09-11 18:47:41 (2 hours ago)	(mod_security) mod_security (id:218420) triggered by 149.88.67.49 (-): 1 in the last 300 secs; Ports ... show more (mod_security) mod_security (id:218420) triggered by 149.88.67.49 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Sep 11 14:47:34.559173 2026] [security2:error] [pid 23333:tid 23333] [client 149.88.67.49:39644] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i)php://(std(in\|out\|err)\|(in\|out)put\|fd\|memory\|temp\|filter)" at ARGS_NAMES:\\xadd allow_url_include=1 \\xadd auto_prepend_file=php://input. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/21_PHP_PHPGen.conf"] [line "22"] [id "218420"] [rev "2"] [msg "COMODO WAF: PHP Injection Attack: I/O Stream Found\|\|192.64.150.33:80\|F\|2"] [data "Matched Data: php://input found within ARGS_NAMES:\\x5cxadd allow_url_include=1 \\x5cxadd auto_prepend_file=php://input: \\xadd allow_url_include=1 \\xadd auto_prepend_file=php://input"] [severity "CRITICAL"] [tag "CWAF"] [tag "PHPGen"] [hostname "192.64.150.33"] [uri "/hello.world"] [unique_id "aqRMxr0LahXBC_X32MPpFAAAAA4"] show less	Brute-Force Bad Web Bot Web App Attack
🇩🇪 hotbbqsauce	2026-09-11 18:46:15 (2 hours ago)	2026-09-11T18:44:23.968718+00:00 blocklabs-server sshd[798265]: Invalid user admin from 149.88.67.49 ... show more 2026-09-11T18:44:23.968718+00:00 blocklabs-server sshd[798265]: Invalid user admin from 149.88.67.49 port 35868 2026-09-11T18:45:37.565083+00:00 blocklabs-server sshd[798312]: Invalid user user from 149.88.67.49 port 47760 2026-09-11T18:46:14.924903+00:00 blocklabs-server sshd[798370]: User root from 149.88.67.49 not allowed because not listed in AllowUsers ... show less	Brute-Force SSH
🇵🇱 ntxg	2026-09-11 18:41:03 (2 hours ago)	2026-09-11T20:41:02.212209+02:00 serverftp sshd[37659]: Invalid user admin from 149.88.67.49 port 38 ... show more 2026-09-11T20:41:02.212209+02:00 serverftp sshd[37659]: Invalid user admin from 149.88.67.49 port 38520 ... show less	Brute-Force SSH
🇺🇸 MPL	2026-09-11 18:29:10 (2 hours ago)	tcp/80 (2 or more attempts)	Port Scan
🇫🇷 security.rdmc.fr	2026-09-11 17:52:21 (2 hours ago)	Port Scan Attack proto:TCP src:46369 dst:23	Port Scan
🇺🇸 TPI-Abuse	2026-09-11 17:47:10 (3 hours ago)	(mod_security) mod_security (id:218420) triggered by 149.88.67.49 (-): 1 in the last 300 secs; Ports ... show more (mod_security) mod_security (id:218420) triggered by 149.88.67.49 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Sep 11 13:47:03.328148 2026] [security2:error] [pid 19795:tid 19845] [client 149.88.67.49:48096] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i)php://(std(in\|out\|err)\|(in\|out)put\|fd\|memory\|temp\|filter)" at ARGS_NAMES:\\xadd allow_url_include=1 \\xadd auto_prepend_file=php://input. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/21_PHP_PHPGen.conf"] [line "22"] [id "218420"] [rev "2"] [msg "COMODO WAF: PHP Injection Attack: I/O Stream Found\|\|192.64.150.125:443\|F\|2"] [data "Matched Data: php://input found within ARGS_NAMES:\\x5cxadd allow_url_include=1 \\x5cxadd auto_prepend_file=php://input: \\xadd allow_url_include=1 \\xadd auto_prepend_file=php://input"] [severity "CRITICAL"] [tag "CWAF"] [tag "PHPGen"] [hostname "192.64.150.125"] [uri "/hello.world"] [unique_id "aqQ-l7o4Rn-aZ1O9mRdYMQAAAZE"] show less	Brute-Force Bad Web Bot Web App Attack

Showing 1 to 15 of 30 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇧🇷 138.94.139.134

🇪🇬 156.197.229.30

🇺🇸 143.14.6.15

🇷🇺 81.200.24.99

🇧🇷 45.5.242.110

🇨🇳 8.137.166.131

🇭🇰 152.32.189.121

🇮🇳 115.246.242.2

🇧🇬 109.160.32.70

🇺🇸 103.143.10.140

🇸🇬 74.63.20.236

🇭🇰 45.64.75.227

🇺🇸 20.171.10.214

🇺🇸 195.184.76.193

🇭🇰 152.32.170.55

🇭🇰 152.32.128.149

🇨🇳 101.200.243.197

🇷🇺 83.169.241.21

🇳🇱 20.229.185.186

🇺🇸 162.216.149.231