JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 217.113.30.149

217.113.30.149 was found in our database!

This IP was reported 51 times. Confidence of Abuse is 37%: ?

37%

ISP	LIR LLC
Usage Type	Fixed Line ISP
ASN	AS42991
Domain Name	lir.am
Country	🇦🇲 Armenia
City	Yerevan, Yerevan

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 217.113.30.149

Whois 217.113.30.149

IP Abuse Reports for 217.113.30.149:

This IP address has been reported a total of 51 times from 27 distinct sources. 217.113.30.149 was first reported on January 21st 2025, and the most recent report was 19 hours ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇲🇾 Rizzy	2026-06-30 15:41:18 (19 hours ago)	Multiple WAF Violations	Brute-Force Web App Attack
🇺🇸 TAY	2026-06-30 14:38:16 (20 hours ago)	217.113.30.149 - - [30/Jun/2026:22:37:55 +0800] "POST /xmlrpc.php HTTP/1.1" 200 5941 "-" "WordPress. ... show more 217.113.30.149 - - [30/Jun/2026:22:37:55 +0800] "POST /xmlrpc.php HTTP/1.1" 200 5941 "-" "WordPress.com; https://wordpress.com" 217.113.30.149 - - [30/Jun/2026:22:38:05 +0800] "POST /xmlrpc.php HTTP/1.1" 200 5941 "-" "Jetpack by WordPress.com (Jetpack 12.0; WordPress 6.4)" 217.113.30.149 - - [30/Jun/2026:22:38:16 +0800] "POST /xmlrpc.php HTTP/1.1" 200 5941 "-" "Jetpack/13.0; WordPress/6.2; http://site77681237.com" ... show less	Brute-Force
🇺🇸 TPI-Abuse	2026-06-30 13:39:08 (21 hours ago)	(mod_security) mod_security (id:240335) triggered by 217.113.30.149 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:240335) triggered by 217.113.30.149 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jun 30 09:39:02.266589 2026] [security2:error] [pid 8022:tid 8022] [client 217.113.30.149:62165] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 217.113.30.149 (+1 hits since last alert)\|directcch.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "directcch.com"] [uri "/xmlrpc.php"] [unique_id "akPG9oo2JGGIh0VHk6cjIAAAAAs"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 integrantservices.com	2026-06-30 13:37:05 (21 hours ago)	(wordpress) Failed wordpress login from 217.113.30.149 (AM/Armenia/-)	Brute-Force
🇺🇸 TPI-Abuse	2026-06-30 12:04:06 (22 hours ago)	(mod_security) mod_security (id:240335) triggered by 217.113.30.149 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:240335) triggered by 217.113.30.149 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jun 30 08:03:58.721853 2026] [security2:error] [pid 21361:tid 21375] [client 217.113.30.149:58225] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 217.113.30.149 (+1 hits since last alert)\|wedgwoodclub.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "wedgwoodclub.com"] [uri "/xmlrpc.php"] [unique_id "akOwrprmTO107fOpC-jEvgAAAMw"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 kosada.com	2026-06-29 09:10:27 (2 days ago)	Web bot: denial-of-service flood	DDoS Attack Bad Web Bot
🇩🇪 filstal.org	2026-04-06 00:27:00 (2 months ago)	Brute-force/Enumeration: Multiple login attempts for non-existent mail accounts (Honeytrap).	Email Spam Brute-Force
🇩🇪 Ad0lar	2025-11-10 00:51:40 (7 months ago)	ports, 23/24H:1/7D:1	Port Scan
🇺🇸 RAP	2025-11-09 22:40:37 (7 months ago)	2025-11-09 22:40:37 UTC Unauthorized activity to TCP port 23. Telnet	Port Scan
🇨🇳 ThreatBook.io	2025-11-09 22:29:00 (7 months ago)	ThreatBook Intelligence: Zombie,Dynamic IP more details on https://threatbook.io/ip/217.113.30.149	SSH
🇺🇸 MPL	2025-11-09 20:05:50 (7 months ago)	tcp/23 (4 or more attempts)	Port Scan
🇺🇸 nodepile	2025-11-09 18:44:20 (7 months ago)	Requests denied due to active blacklist hits (tenant=82 method=GET path=/brands/switchback-turn-sign ... show more Requests denied due to active blacklist hits (tenant=82 method=GET path=/brands/switchback-turn-signal-leds-for-2011-2019-ford-explorer-pair.html ua='Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.122 Safari/537.36') show less	Exploited Host Web App Attack
Anonymous	2025-11-09 17:58:23 (7 months ago)	unsolicited connect TCP dport 23 (sport 11388)	Hacking
🇹🇷 rtbh.com.tr	2025-11-09 08:09:49 (7 months ago)	list.rtbh.com.tr report: tcp/23	Brute-Force
🇩🇪 ps-center	2025-11-09 00:53:46 (7 months ago)	RDM-W: TCP-Scanner. Port: 23	Port Scan

Showing 1 to 15 of 51 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇯🇵 180.39.223.243

🇬🇧 87.106.44.172

🇨🇳 58.59.233.177

🇺🇸 47.146.125.208

🇫🇷 2603:1062:0:350::20

🇰🇷 211.106.137.135

🇧🇷 192.140.12.217

🇺🇸 185.243.5.93

🇺🇸 172.234.199.93

🇩🇪 141.11.107.166

🇺🇸 135.237.125.23

🇫🇷 129.151.253.53

🇺🇸 66.187.9.21

🇸🇬 47.84.140.213

🇬🇧 45.89.63.39

🇬🇹 190.151.130.5

🇺🇸 172.234.218.245

🇩🇪 172.71.148.30

🇮🇳 152.59.162.159

🇰🇷 121.131.220.137