JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 178.233.52.149

178.233.52.149 was found in our database!

This IP was reported 9 times. Confidence of Abuse is 28%: ?

28%

ISP	Turksat Uydu-Net Internet
Usage Type	Fixed Line ISP
ASN	AS47524
Domain Name	turksat.com.tr
Country	🇹🇷 Turkey
City	Samsun, Samsun

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 178.233.52.149

Whois 178.233.52.149

IP Abuse Reports for 178.233.52.149:

This IP address has been reported a total of 9 times from 5 distinct sources. 178.233.52.149 was first reported on May 5th 2025, and the most recent report was 7 hours ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇺🇸 rsiddall	2026-07-06 17:28:07 (7 hours ago)	178.233.52.149 - - [06/Jul/2026:13:28:02 -0400] "POST /xmlrpc.php HTTP/1.1" 301 242 "-" "Mozilla/5.0 ... show more 178.233.52.149 - - [06/Jul/2026:13:28:02 -0400] "POST /xmlrpc.php HTTP/1.1" 301 242 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/84.0.0.0 Safari/537.36" 178.233.52.149 - - [06/Jul/2026:13:28:06 -0400] "POST /xmlrpc.php HTTP/1.1" 301 242 "-" "Mozilla/5.0 (Linux; Android 10; x64) AppleWebKit/537.36 (KHTML, like Gecko) Opera/74.0.0.0 Safari/537.36" ... show less	Brute-Force
🇬🇷 setupgr	2026-07-06 16:25:07 (8 hours ago)	(XMLRPC) WP XMLRPC Attack 178.233.52.149 (TR/Turkey/Samsun/Ilkadim/-/[AS47524 AS-TURKSAT]): 1 in the ... show more (XMLRPC) WP XMLRPC Attack 178.233.52.149 (TR/Turkey/Samsun/Ilkadim/-/[AS47524 AS-TURKSAT]): 1 in the last 86400 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: 178.233.52.149 - - [06/Jul/2026:19:22:37 +0300] "POST /xmlrpc.php HTTP/1.1" 503 18930 "-" "Mozilla/5.0 (Linux; Android 10; arm64) AppleWebKit/537.36 (KHTML, like Gecko) Opera/74.0.0.0 Safari/537.36" show less	Port Scan
🇺🇸 TPI-Abuse	2026-07-06 15:02:10 (10 hours ago)	(mod_security) mod_security (id:225170) triggered by 178.233.52.149 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:225170) triggered by 178.233.52.149 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jul 06 11:02:06.745643 2026] [security2:error] [pid 14842:tid 14842] [client 178.233.52.149:17251] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)\|\|badgerkelley.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "badgerkelley.com"] [uri "/wp-json/wp/v2/users"] [unique_id "akvDboBzAhqdC_yx8IAiYwAAAAA"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-07-06 11:30:20 (13 hours ago)	(mod_security) mod_security (id:225170) triggered by 178.233.52.149 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:225170) triggered by 178.233.52.149 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jul 06 07:30:01.929427 2026] [security2:error] [pid 12035:tid 12035] [client 178.233.52.149:16709] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)\|\|tcomputerguy.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "tcomputerguy.com"] [uri "/wp-json/wp/v2/users"] [unique_id "akuRuSohB7ausZ1ENJT5eQAAAAk"] show less	Brute-Force Bad Web Bot Web App Attack
🇩🇪 BiancaNL	2026-07-04 13:35:32 (2 days ago)	Fail2Ban: jail=nginx-exploit-probes on <fqdn> (port=<port>)	Hacking
🇺🇸 TPI-Abuse	2026-06-30 07:13:33 (6 days ago)	(mod_security) mod_security (id:225170) triggered by 178.233.52.149 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:225170) triggered by 178.233.52.149 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jun 30 03:13:28.624149 2026] [security2:error] [pid 18317:tid 18317] [client 178.233.52.149:14083] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)\|\|insidemilb.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "insidemilb.com"] [uri "/wp-json/wp/v2/users"] [unique_id "akNsmIUXMNHiw10jYztcXQAAABA"] show less	Brute-Force Bad Web Bot Web App Attack
Anonymous	2025-06-20 08:42:36 (1 year ago)	Unauthorized connection attempt	Port Scan Hacking Exploited Host
Anonymous	2025-05-10 06:49:48 (1 year ago)	Unauthorized connection attempt	Port Scan Hacking Exploited Host
Anonymous	2025-05-05 08:50:16 (1 year ago)	Unauthorized connection attempt	Port Scan Hacking Exploited Host

Showing 1 to 9 of 9 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇩🇪 2a04:4e40:e000:0:621:df9f:bf47:958d

🇦🇪 217.164.23.95

🇺🇸 207.90.244.26

🇺🇸 162.216.150.78

🇺🇸 162.216.150.63

🇺🇸 162.216.150.25

🇬🇧 154.16.44.49

🇸🇬 114.119.137.167

🇹🇼 61.223.65.26

🇺🇸 47.251.63.210

🇦🇺 45.132.224.118

🇺🇸 45.131.155.110

🇸🇬 43.98.175.197

🇸🇳 41.82.50.218

🇶🇦 20.173.116.24

🇬🇧 2a06:4880:6000::8e

🇺🇸 216.180.246.163

🇺🇸 147.185.132.42

🇨🇳 121.29.85.151

🇺🇸 103.143.239.167