JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

161.49.166.124

Neutral Activity

Abuse confidence score ?

0% Low Risk

236 reports

93 reporters · latest 1 year ago

ISP	CONVERGE INFORMATION AND COMMUNICATIONS TECHNOLOGY SOLUTIONS, INC
Usage Type	Fixed Line ISP
ASN	AS17639
Hostname(s)	161.49.166.124.convergeict.com
Domain Name	convergeict.com
Country	🇵🇭 Philippines
City	Quezon City, National Capital Region

ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report Whois

No reports in the last 60 days

161.49.166.124 has been reported 236 times. The most recent report is from 1 year ago.

The full history is preserved below and remains searchable. A 0% score reflects the absence of recent activity, but this is not a guarantee that earlier reports were invalid. Abuse confidence score decays, naturally, over time, when the abusive activity stops.

IP Abuse Reports for 161.49.166.124

Export CSV

This IP address has been reported a total of 236 times from 93 distinct sources. 161.49.166.124 was first reported on July 26th 2022, and the most recent report was 1 year ago.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇫🇷 Hippoline	2025-01-30 02:07:59 (1 year ago)	Jan 30 03:07:04 local wp(XXXX-B)[2363]: Authentication attempt for unknown user admin from 161.49.16 ... show more Jan 30 03:07:04 local wp(XXXX-B)[2363]: Authentication attempt for unknown user admin from 161.49.166.124 ... show less	Brute-Force Web App Attack
🇫🇷 Hippoline	2024-07-23 01:54:52 (2 years ago)	Jul 23 03:53:02 local wp(XXXX-B)[32136]: Authentication attempt for unknown user admin from 161.49.1 ... show more Jul 23 03:53:02 local wp(XXXX-B)[32136]: Authentication attempt for unknown user admin from 161.49.166.124 ... show less	Brute-Force Web App Attack
🇬🇧 Steve	2024-03-01 18:19:48 (2 years ago)	Attempts against non-existent wordpress site	Brute-Force Web App Attack
🇪🇸 10dencehispahard SL	2024-03-01 15:00:42 (2 years ago)	Unauthorized login attempts [ wordpress-xmlrpc, wordpress]	Brute-Force Web App Attack
🇺🇦 URAN Publishing Service	2024-02-18 20:56:09 (2 years ago)	161.49.166.124 - - [18/Feb/2024:22:56:07 +0200] "GET /wp-login.php HTTP/1.1" 404 4781 "-" "Mozilla/5 ... show more 161.49.166.124 - - [18/Feb/2024:22:56:07 +0200] "GET /wp-login.php HTTP/1.1" 404 4781 "-" "Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko" 161.49.166.124 - - [18/Feb/2024:22:56:08 +0200] "GET /xmlrpc.php HTTP/1.1" 404 366 "-" "Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko" ... show less	Web App Attack
Anonymous	2024-02-17 20:30:00 (2 years ago)	"Forceful Browsing"	Brute-Force
🇫🇷 Hippoline	2024-02-15 02:16:26 (2 years ago)	Feb 15 03:16:04 local wp(XXXX-B)[24320]: Authentication attempt for unknown user admin from 161.49.1 ... show more Feb 15 03:16:04 local wp(XXXX-B)[24320]: Authentication attempt for unknown user admin from 161.49.166.124 ... show less	Brute-Force Web App Attack
🇬🇧 Bytemark	2024-02-04 08:54:45 (2 years ago)	161.49.166.124 - - [04/Feb/2024:08:54:34 +0000] "GET /wp-login.php HTTP/1.1" 404 27 "-" "Mozilla/5.0 ... show more 161.49.166.124 - - [04/Feb/2024:08:54:34 +0000] "GET /wp-login.php HTTP/1.1" 404 27 "-" "Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko" 161.49.166.124 - - [04/Feb/2024:08:54:34 +0000] "GET /xmlrpc.php HTTP/1.1" 404 27 "-" "Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko" 161.49.166.124 - - [04/Feb/2024:08:54:45 +0000] "GET /wp-login.php HTTP/1.1" 404 27 "-" "Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko" show less	Brute-Force Web App Attack
🇺🇸 TPI-Abuse	2024-02-04 08:22:33 (2 years ago)	(mod_security) mod_security (id:225170) triggered by 161.49.166.124 (161.49.166.124.convergeict.com) ... show more (mod_security) mod_security (id:225170) triggered by 161.49.166.124 (161.49.166.124.convergeict.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Feb 04 03:22:26.221492 2024] [security2:error] [pid 16107] [client 161.49.166.124:11867] [client 161.49.166.124] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)\|\|cosplayculture.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "cosplayculture.com"] [uri "/wp-json/wp/v2/users/1"] [unique_id "Zb9JQp5sgDDJU5ugutc1mAAAAAY"] show less	Brute-Force Bad Web Bot Web App Attack
🇦🇺 weblite	2024-02-03 02:57:38 (2 years ago)	WP_LOGIN_FAIL WP_XMLRPC_ABUSE	Brute-Force Web App Attack
🇫🇷 Sklurk	2024-02-03 02:02:40 (2 years ago)	Web App Attack	Web App Attack
🇺🇸 TPI-Abuse	2024-02-02 22:45:25 (2 years ago)	(mod_security) mod_security (id:225170) triggered by 161.49.166.124 (161.49.166.124.convergeict.com) ... show more (mod_security) mod_security (id:225170) triggered by 161.49.166.124 (161.49.166.124.convergeict.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Feb 02 17:45:21.625441 2024] [security2:error] [pid 10265] [client 161.49.166.124:3671] [client 161.49.166.124] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)\|\|tradersworldmarket.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "tradersworldmarket.com"] [uri "/wp-json/wp/v2/users/1"] [unique_id "Zb1wgQ4fLIvbkyeIbAM-CQAAAA0"] show less	Brute-Force Bad Web Bot Web App Attack
🇩🇪 niceshops.com	2024-01-20 23:31:11 (2 years ago)	Web Attack ([21/Jan/2024:00:31:10.150] GET /wp-login.php)	Web App Attack
Anonymous	2024-01-20 21:04:00 (2 years ago)	"Forceful Browsing"	Brute-Force
🇩🇪 niceshops.com	2024-01-14 20:26:49 (2 years ago)	Web Attack ([14/Jan/2024:21:26:48.618] GET /wp-login.php)	Web App Attack

Showing 1 to 15 of 236 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇮🇶 2400:cb00:474:1000:b8c2:d728:a557:6ed2

🇧🇷 201.139.186.238

🇳🇱 109.160.32.127

🇸🇦 2400:cb00:1001:1000:5c98:efe2:d52b:c21c

🇭🇰 152.32.189.59

🇪🇸 137.101.202.75

🇩🇪 69.5.169.240

🇨🇳 58.220.39.200

🇱🇻 31.56.28.247

🇮🇳 20.198.74.230

🇺🇸 20.168.117.48

🇨🇳 14.116.189.74

🇨🇳 220.196.191.58

🇩🇪 213.209.159.228

🇬🇧 193.32.209.235

🇻🇪 190.207.63.128

🇬🇧 185.216.145.168

🇵🇾 181.94.243.138

🇨🇱 201.186.40.161

🇹🇼 198.235.24.66