JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 161.118.220.49

161.118.220.49 was found in our database!

This IP was reported 20 times. Confidence of Abuse is 99%: ?

99%

ISP	500 Oracle Parkway
Usage Type	Data Center/Web Hosting/Transit
ASN	AS31898
Domain Name	oracle.com
Country	🇸🇬 Singapore
City	Kampong Loyang

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 161.118.220.49

Whois 161.118.220.49

IP Abuse Reports for 161.118.220.49:

This IP address has been reported a total of 20 times from 17 distinct sources. 161.118.220.49 was first reported on August 26th 2026, and the most recent report was 7 hours ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇫🇮 tjs	2026-08-27 08:43:00 (7 hours ago)	web attack, shell attempt	Hacking Web App Attack
Anonymous	2026-08-27 06:04:19 (10 hours ago)	IP & Port Scan.	SSH Port Scan Brute-Force
🇺🇸 cwytech	2026-08-27 03:25:32 (12 hours ago)	Fleet-wide ban from the Ghostfleet 👻. Triggered by scenario: crowdsecurity/http-cve-2021-42013.	Bad Web Bot Web App Attack
🇺🇸 yzfdude1	2026-08-27 03:12:21 (13 hours ago)	2026-08-26T21:11:41.266375-06:00 b146-67 sshd[516846]: pam_sss(sshd:auth): authentication failure; l ... show more 2026-08-26T21:11:41.266375-06:00 b146-67 sshd[516846]: pam_sss(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=161.118.220.49 user=admin 2026-08-26T21:11:43.395771-06:00 b146-67 sshd[516846]: Failed password for invalid user admin from 161.118.220.49 port 53632 ssh2 2026-08-26T21:12:20.710908-06:00 b146-67 sshd[516853]: Invalid user user from 161.118.220.49 port 40828 ... show less	Brute-Force SSH
🇫🇷 marine	2026-08-27 02:58:32 (13 hours ago)	SSH brute-force server2 attack from 161.118.220.49, blocked by Fail2Ban.	SSH Brute-Force
🇺🇸 Starburst SysOp Team	2026-08-27 02:45:58 (13 hours ago)	(mod_security-custom) mod_security (id:218420) triggered by 161.118.220.49 (SG/Singapore/-/Singapore ... show more (mod_security-custom) mod_security (id:218420) triggered by 161.118.220.49 (SG/Singapore/-/Singapore (Loyang)/-/[AS31898 ORACLE-BMC-31898]): 1 in the last 3600 secs (0-srv1) show less	Hacking
🇧🇷 diego	2026-08-27 02:43:05 (13 hours ago)	[rede-188] 2026-08-27 02:24:12, Client: 161.118.220.49, Protocol: 6, Unauthorized activity to HTTP: ... show more [rede-188] 2026-08-27 02:24:12, Client: 161.118.220.49, Protocol: 6, Unauthorized activity to HTTP: POST /cgi-bin/../../../../../../../../../../bin/sh show less	Web App Attack
🇺🇸 TPI-Abuse	2026-08-27 02:38:17 (13 hours ago)	(mod_security) mod_security (id:218420) triggered by 161.118.220.49 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:218420) triggered by 161.118.220.49 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Aug 26 22:38:11.940530 2026] [security2:error] [pid 26676:tid 26676] [client 161.118.220.49:48806] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i)php://(std(in\|out\|err)\|(in\|out)put\|fd\|memory\|temp\|filter)" at ARGS_NAMES:\\xadd allow_url_include=1 \\xadd auto_prepend_file=php://input. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/21_PHP_PHPGen.conf"] [line "22"] [id "218420"] [rev "2"] [msg "COMODO WAF: PHP Injection Attack: I/O Stream Found\|\|192.64.150.203:80\|F\|2"] [data "Matched Data: php://input found within ARGS_NAMES:\\x5cxadd allow_url_include=1 \\x5cxadd auto_prepend_file=php://input: \\xadd allow_url_include=1 \\xadd auto_prepend_file=php://input"] [severity "CRITICAL"] [tag "CWAF"] [tag "PHPGen"] [hostname "192.64.150.203"] [uri "/hello.world"] [unique_id "ao-jEz1WepYGs0xUfbmW7QAAABE"] show less	Brute-Force Bad Web Bot Web App Attack
🇫🇷 Thibault Millant	2026-08-27 02:30:45 (13 hours ago)	161.118.220.49 - - [27/Aug/2026:02:30:23 +0000] "GET /admin/vendor/phpunit/phpunit/src/Util/PHP/eval ... show more 161.118.220.49 - - [27/Aug/2026:02:30:23 +0000] "GET /admin/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1" 404 146 "-" "libredtail-http" ... show less	Brute-Force Exploited Host SSH
🇺🇸 TPI-Abuse	2026-08-27 02:09:37 (14 hours ago)	(mod_security) mod_security (id:218420) triggered by 161.118.220.49 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:218420) triggered by 161.118.220.49 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Aug 26 22:09:31.379197 2026] [security2:error] [pid 19071:tid 19071] [client 161.118.220.49:59972] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i)php://(std(in\|out\|err)\|(in\|out)put\|fd\|memory\|temp\|filter)" at ARGS_NAMES:\\xadd allow_url_include=1 \\xadd auto_prepend_file=php://input. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/21_PHP_PHPGen.conf"] [line "22"] [id "218420"] [rev "2"] [msg "COMODO WAF: PHP Injection Attack: I/O Stream Found\|\|192.64.150.167:443\|F\|2"] [data "Matched Data: php://input found within ARGS_NAMES:\\x5cxadd allow_url_include=1 \\x5cxadd auto_prepend_file=php://input: \\xadd allow_url_include=1 \\xadd auto_prepend_file=php://input"] [severity "CRITICAL"] [tag "CWAF"] [tag "PHPGen"] [hostname "192.64.150.167"] [uri "/hello.world"] [unique_id "ao-cW0iRDtxJZqcTAo6TewAAAAY"] show less	Brute-Force Bad Web Bot Web App Attack
Anonymous	2026-08-27 00:12:15 (16 hours ago)	(mod_security) mod_security triggered on hostname [redacted] 161.118.220.49 (SG/Singapore/-)	SQL Injection
🇳🇱 maxxsense	2026-08-27 00:05:22 (16 hours ago)	(apache-scanners) Failed apache-scanners trigger with match [redacted] from 161.118.220.49 (SG/Singa ... show more (apache-scanners) Failed apache-scanners trigger with match [redacted] from 161.118.220.49 (SG/Singapore/-) show less	Port Scan
🇺🇸 cybsecaoccol	2026-08-26 23:57:57 (16 hours ago)	unauthorized connection or malicious port scan attempted on tcp port - corp	Port Scan Hacking
🇳🇱 Savvii	2026-08-26 23:40:50 (16 hours ago)	20 attempts against mh-ssh on tofu	Brute-Force SSH
🇺🇸 oralunal	2026-08-26 22:47:13 (17 hours ago)	IP banned by Fail2Ban in jail sshd auth.log mvfnds ...	SSH

Showing 1 to 15 of 20 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇺🇸 104.23.160.148

🇺🇸 95.181.237.43

🇷🇸 79.101.58.121

🇺🇸 185.223.152.17

🇫🇷 92.222.112.225

🇧🇬 91.191.209.118

🇺🇸 66.132.172.176

🇸🇬 43.172.195.59

🇱🇹 213.176.26.22

🇨🇱 191.113.73.37

🇵🇪 190.232.248.12

🇨🇳 182.119.226.124

🇧🇷 170.0.67.109

🇳🇵 157.119.70.125

🇺🇸 143.198.157.198

🇺🇸 107.173.67.202

🇰🇪 102.203.140.168

🇺🇸 65.49.1.158

🇺🇸 34.44.214.27

🇺🇸 24.156.28.164