JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

2.58.149.35

Neutral Activity

Abuse Confidence Score

0% Low Risk

590 reports

183 reporters · latest 2 years ago

ISP: Legaco Networks B.V.
Usage Type: Data Center/Web Hosting/Transit
ASN: AS212238
Domain Name: legaconetworks.nl
Country: 🇺🇸 United States of America
City: Atlanta, Georgia

ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report Whois

No reports in the last 60 days

2.58.149.35 has been reported 590 times. The most recent report is from 2 years ago.

The full history is preserved below and remains searchable. A 0% score reflects the absence of recent activity, but this is not a guarantee that earlier reports were invalid. Abuse confidence score decays, naturally, over time, when the abusive activity stops.

Abuse Reports

Export reports CSV

Total reports

590 from 183 distinct reporters

First reported

December 21st 2021

Most recent report

2 years ago

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇬🇷 JCB	2022-07-06 08:30:19 UTC · (4 years ago)	2.58.149.35 - - [06/Jul/2022:15:28:21 +0300] "GET /wp-content/plugins/dzs-zoomsounds/savepng.php?location=a57bze8931.php HTTP/1.1" 404 196 "-" "Mozlila/5.0 (Linux; Android 7.0; SM-G892A Bulid/NRD90M; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version ... show more 2.58.149.35 - - [06/Jul/2022:15:28:21 +0300] "GET /wp-content/plugins/dzs-zoomsounds/savepng.php?location=a57bze8931.php HTTP/1.1" 404 196 "-" "Mozlila/5.0 (Linux; Android 7.0; SM-G892A Bulid/NRD90M; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/60.0.3112.107 Moblie Safari/537.36" 2.58.149.35 - - [06/Jul/2022:15:28:51 +0300] "GET /wp-content/plugins/ioptimization/IOptimize.php?rchk HTTP/1.1" 404 196 "-" "Mozlila/5.0 (Linux; Android 7.0; SM-G892A Bulid/NRD90M; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/60.0.3112.107 Moblie Safari/537.36" ... show less	Hacking Brute-Force Web App Attack
Anonymous	2022-07-05 22:28:16 UTC · (4 years ago)	Malicious activity detected	Hacking Brute-Force
🇪🇪 Unwasted	2022-07-05 21:22:19 UTC · (4 years ago)	Abusive content scan (abuse_score:>80)	Hacking Brute-Force Web App Attack
Anonymous	2022-07-04 23:12:43 UTC · (4 years ago)	2.58.149.35 - - [05/Jul/2022:04:44:57 +0200] "GET /.well-known/ HTTP/1.1" 404 5913 "www.google.com" "Mozlila/5.0 (Linux; Android 7.0; SM-G892A Bulid/NRD90M; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/60.0.3112.107 Moblie Safari/537 ... show more 2.58.149.35 - - [05/Jul/2022:04:44:57 +0200] "GET /.well-known/ HTTP/1.1" 404 5913 "www.google.com" "Mozlila/5.0 (Linux; Android 7.0; SM-G892A Bulid/NRD90M; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/60.0.3112.107 Moblie Safari/537.36" 2.58.149.35 - - [05/Jul/2022:04:46:56 +0200] "GET /.well-known/ HTTP/1.1" 404 5913 "www.google.com" "Mozlila/5.0 (Linux; Android 7.0; SM-G892A Bulid/NRD90M; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/60.0.3112.107 Moblie Safari/537.36" 2.58.149.35 - - [05/Jul/2022:05:07:49 +0200] "GET /wp-admin/meta/ HTTP/1.1" 404 5913 "www.google.com" "Mozlila/5.0 (Linux; Android 7.0; SM-G892A Bulid/NRD90M; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/60.0.3112.107 Moblie Safari/537.36" 2.58.149.35 - - [05/Jul/2022:05:12:42 +0200] "GET /wp-content/mu-plugins/ HTTP/1.1" 404 5913 "www.google.com" "Mozlila/5.0 (Linux; Android 7.0; SM-G892A Bulid/NRD90M; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/60.0 ... show less	Hacking Bad Web Bot
🇬🇷 Staging	2022-07-04 15:09:15 UTC · (4 years ago)	Wordpress constant abuse, login/register	Hacking Brute-Force Web App Attack
🇬🇷 JCB	2022-07-04 04:26:49 UTC · (4 years ago)	2.58.149.35 - - [04/Jul/2022:04:48:36 +0300] "GET /wp-includes/ HTTP/1.1" 404 196 "-" "Mozlila/5.0 (Linux; Android 7.0; SM-G892A Bulid/NRD90M; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/60.0.3112.107 Moblie Safari/537.36" 2.58.149 ... show more 2.58.149.35 - - [04/Jul/2022:04:48:36 +0300] "GET /wp-includes/ HTTP/1.1" 404 196 "-" "Mozlila/5.0 (Linux; Android 7.0; SM-G892A Bulid/NRD90M; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/60.0.3112.107 Moblie Safari/537.36" 2.58.149.35 - - [04/Jul/2022:04:50:32 +0300] "GET /wp-content/themes/twentytwenty/ HTTP/1.1" 404 196 "-" "Mozlila/5.0 (Linux; Android 7.0; SM-G892A Bulid/NRD90M; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/60.0.3112.107 Moblie Safari/537.36" 2.58.149.35 - - [04/Jul/2022:04:51:12 +0300] "GET /wp-content/themes/twentytwenty/ HTTP/1.1" 404 196 "-" "Mozlila/5.0 (Linux; Android 7.0; SM-G892A Bulid/NRD90M; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/60.0.3112.107 Moblie Safari/537.36" ... show less	Hacking Brute-Force Web App Attack
🇩🇪 expandmade.com	2022-06-30 17:07:21 UTC · (4 years ago)	[bie] - trolling for installation vulnerabilities [30/Jun/2022:21:07:21 "GET /defaul1.php"]	Web App Attack
🇨🇿 plzenskypruvodce.cz	2022-06-30 03:07:00 UTC · (4 years ago)	[Thu Jun 30 09:06:35.949009 2022] [authz_core:error] [pid 3335850:tid 140051853809408] [client 2.58.149.35:57522] AH01630: client denied by server configuration: /var/www/opusarium.cz/www/wp-includes/xl33t.php, referer: www.google.com [Thu Jun 30 09: ... show more [Thu Jun 30 09:06:35.949009 2022] [authz_core:error] [pid 3335850:tid 140051853809408] [client 2.58.149.35:57522] AH01630: client denied by server configuration: /var/www/opusarium.cz/www/wp-includes/xl33t.php, referer: www.google.com [Thu Jun 30 09:06:57.668492 2022] [authz_core:error] [pid 3335850:tid 140051878987520] [client 2.58.149.35:53915] AH01630: client denied by server configuration: /var/www/opusarium.cz/www/wp-includes/xl33t.php, referer: www.google.com ... show less	Web App Attack
🇧🇷 AC - Team	2022-06-29 23:45:18 UTC · (4 years ago)	2.58.149.35 - - [30/Jun/2022:00:45:18 -0300] "GET /xleet.php HTTP/1.1" 301 590 "www.google.com" "Mozlila/5.0 (Linux; Android 7.0; SM-G892A Bulid/NRD90M; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/60.0.3112.107 Moblie Safari/537.36" ... show more 2.58.149.35 - - [30/Jun/2022:00:45:18 -0300] "GET /xleet.php HTTP/1.1" 301 590 "www.google.com" "Mozlila/5.0 (Linux; Android 7.0; SM-G892A Bulid/NRD90M; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/60.0.3112.107 Moblie Safari/537.36" ... show less	Exploited Host Web App Attack
🇩🇪 DAILYKANBAN.COM	2022-06-29 15:57:47 UTC · (4 years ago)	(mod_security) mod_security (id:1000001) triggered by 2.58.149.35 (NL/Netherlands/-): 2 in the last 600 secs (CF_ENABLE); Ports: ; Direction: inout; Trigger: LF_MODSEC; Logs: [Wed Jun 29 19:57:40.874035 2022] [:error] [pid 12763:tid 22553682376448] ... show more (mod_security) mod_security (id:1000001) triggered by 2.58.149.35 (NL/Netherlands/-): 2 in the last 600 secs (CF_ENABLE); Ports: ; Direction: inout; Trigger: LF_MODSEC; Logs: [Wed Jun 29 19:57:40.874035 2022] [:error] [pid 12763:tid 22553682376448] [client 2.58.149.35:0] [client 2.58.149.35] ModSecurity: Access denied with code 403 (phase 2). Matched phrase "/404.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec/modsec2.user.conf"] [line "9"] [id "1000001"] [msg "Restricted File Probe"] [data "Matched Data: /wp-content/themes/sketch/404.php found within REQUEST_URI"] [severity "CRITICAL"] [tag "paranoia-level/2"] [hostname "magicalmysteryplanttour.group"] [uri "/wp-content/themes/sketch/404.php"] [unique_id "YryutF3V6M3xs2hXCAhk1QAAAQA"], referer: www.google.com [Wed Jun 29 19:57:44.059073 2022] [:error] [pid 12763:tid 22553686578944] [client 2.58.149.35:0] [client 2.58.149.35] ModSecurity: Access denied with code 403 (phase 2). Matched phrase "/404.php" at REQUEST_URI. [file "/etc/apache2/conf.d/mo show less	Web App Attack
🇧🇷 AC - Team	2022-06-29 06:30:36 UTC · (4 years ago)	2.58.149.35 - - [29/Jun/2022:07:30:35 -0300] "GET /xleet.php HTTP/1.1" 404 20428 "www.google.com" "Mozlila/5.0 (Linux; Android 7.0; SM-G892A Bulid/NRD90M; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/60.0.3112.107 Moblie Safari/537.3 ... show more 2.58.149.35 - - [29/Jun/2022:07:30:35 -0300] "GET /xleet.php HTTP/1.1" 404 20428 "www.google.com" "Mozlila/5.0 (Linux; Android 7.0; SM-G892A Bulid/NRD90M; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/60.0.3112.107 Moblie Safari/537.36" ... show less	Exploited Host Web App Attack
🇸🇬 Sofibox Cyberwatch	2022-06-28 13:20:34 UTC · (4 years ago)	[bad_ip: 2.58.149.35 [alert_level: High Risk [inbound(1)+outbound(7): 8 [target_port: 57520 [class: Attempted Information Leak [msg: GPL WEB_SERVER 403 Forbidden [csf_block_status: ip-already-blocked [blcheck_ip_score: 94.57% (10/184) [blcheck_domain ... show more [bad_ip: 2.58.149.35 [alert_level: High Risk [inbound(1)+outbound(7): 8 [target_port: 57520 [class: Attempted Information Leak [msg: GPL WEB_SERVER 403 Forbidden [csf_block_status: ip-already-blocked [blcheck_ip_score: 94.57% (10/184) [blcheck_domain: "0spam-n.fusionzero.com,all.spamrats.com,spam.spamrats.com,dunk.dnsbl.tuxad.de,hartkore.dnsbl.tuxad. [blcheck_comment: "blcheck IPv4+IPv6 scanner v0.7.8 @ github.com/sofibox/blcheck" [log_suspicious_score: 5.26% [mod_security_alert: false [has_cidr24_network: true(6) show less	Port Scan
🇸🇬 Sofibox Cyberwatch	2022-06-28 13:03:00 UTC · (4 years ago)	[bad_ip: 2.58.149.35 [alert_level: High Risk [inbound(0)+outbound(3): 3 [target_port: 53215 [class: Attempted Information Leak [msg: GPL WEB_SERVER 403 Forbidden [csf_block_status: ip-already-blocked [blcheck_ip_score: 94.57% (10/184) [blcheck_domain ... show more [bad_ip: 2.58.149.35 [alert_level: High Risk [inbound(0)+outbound(3): 3 [target_port: 53215 [class: Attempted Information Leak [msg: GPL WEB_SERVER 403 Forbidden [csf_block_status: ip-already-blocked [blcheck_ip_score: 94.57% (10/184) [blcheck_domain: "0spam-n.fusionzero.com,all.spamrats.com,spam.spamrats.com,dunk.dnsbl.tuxad.de,hartkore.dnsbl.tuxad. [blcheck_comment: "blcheck IPv4+IPv6 scanner v0.7.8 @ github.com/sofibox/blcheck" [log_suspicious_score: 5.26% [mod_security_alert: false [has_cidr24_network: true(6) show less	Port Scan
🇸🇬 Sofibox Cyberwatch	2022-06-28 12:44:45 UTC · (4 years ago)	[bad_ip: 2.58.149.35 [alert_level: High Risk [inbound(0)+outbound(1): 1 [target_port: 50609 [class: Attempted Information Leak [msg: GPL WEB_SERVER 403 Forbidden [csf_block_status: ip-already-blocked [blcheck_ip_score: 94.57% (10/184) [blcheck_domain ... show more [bad_ip: 2.58.149.35 [alert_level: High Risk [inbound(0)+outbound(1): 1 [target_port: 50609 [class: Attempted Information Leak [msg: GPL WEB_SERVER 403 Forbidden [csf_block_status: ip-already-blocked [blcheck_ip_score: 94.57% (10/184) [blcheck_domain: "0spam-n.fusionzero.com,all.spamrats.com,spam.spamrats.com,dunk.dnsbl.tuxad.de,hartkore.dnsbl.tuxad. [blcheck_comment: "blcheck IPv4+IPv6 scanner v0.7.8 @ github.com/sofibox/blcheck" [log_suspicious_score: 5.26% [mod_security_alert: false [has_cidr24_network: true(6) show less	Port Scan
🇬🇧 openstrike.co.uk	2022-06-28 01:06:02 UTC · (4 years ago)	15 attacks on PHP URLs: 2.58.149.35 - - [18/Jun/2022:12:14:02 +0100] "GET /site/wp-content/themes/sketch/404.php HTTP/1.1" 404 2834	Web App Attack

Showing 46 to 60 of 590 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown

Recently Reported IPs:

🇫🇷 2a02:c207:2300:1911::1

🇰🇷 218.238.5.110

🇧🇪 198.235.24.174

🇹🇼 198.235.24.76

🇵🇱 172.68.159.167

🇭🇰 154.92.2.59

🇺🇸 147.185.132.234

🇨🇳 114.66.37.36

🇳🇱 109.160.32.107

🇺🇸 93.177.118.58

🇳🇱 93.123.109.214

🇭🇺 84.2.148.139

🇧🇬 79.124.58.142

🇺🇸 65.49.20.107

🇳🇱 45.148.10.152

🇧🇪 35.210.112.87

🇧🇪 34.77.173.196

🇺🇸 24.45.235.179

🇸🇬 8.219.147.8

🇨🇳 218.78.46.81