This IP address has been reported a total of
8
times from
8 distinct
sources.
38.49.149.244 was first reported on
October 7th 2024 , and the most recent report was
1 day ago Czechia
with 1
report;
France
with 1
report;
Russian Federation
with 1
report.
The most common categories in these recent reports were:
Web App Attack
2
times;
Bad Web Bot
2
times;
Exploited Host
1
time;
Hacking
1
time;
Brute-Force
1
time.
Recent Reports
We have received reports of abusive activity from this IP address within the last week. It is
potentially still actively engaged in abusive activities.
Reporter
IoA Timestamp (UTC)
Comment
Categories
2026-10-04 05:45:05
(1 day ago)
Large-scale coordinated botnet (8M+ IPs). Ordered by Alexander Pen'kov (alexander-pen-kov-7b41aa6a/S ...
show more
Large-scale coordinated botnet (8M+ IPs). Ordered by Alexander Pen'kov (alexander-pen-kov-7b41aa6a/Shursky [yordim|LIS|MOW]): Retaliation after theft; Attacker: Mikhail Smirnov (mikhail-smirnov-79830323/Aidan [MOW]): Employed by Angara Technologies Group | Offpeak: Sessionless Catalog Access Blocked: /wishlist/index/add/product/11343/form_key/PsqUoHMxeW0stUmz/ | UA: Opera/9.69.(X11; Linux x86_64; hr-HR) Presto/2.9.181 Version/11.00 | (Magento Site)
show less
Hacking
Bad Web Bot
Web App Attack
๐จ๐ฟ
unhfree.net
2026-09-17 04:54:33
(2 weeks ago)
Sep 17 06:54:32 canopus postfix/smtpd[1421924]: 0657A7A68DE: reject: RCPT from unknown[38.49.149.244 ...
show more
Sep 17 06:54:32 canopus postfix/smtpd[1421924]: 0657A7A68DE: reject: RCPT from unknown[38.49.149.244]: 554 5.7.1 <[email protected] >: Recipient address rejected: Maximum 20 messages per 60 minutes limit reached; from=<[email protected] > to=<[email protected] > proto=ESMTP helo=<googlemail.com>
Sep 17 06:54:32 canopus postfix/smtpd[1421924]: 0657A7A68DE: reject: RCPT from unknown[38.49.149.244]: 554 5.7.1 <[email protected] >: Recipient address rejected: Maximum 20 messages per 60 minutes limit reached; from=<[email protected] > to=<[email protected] > proto=ESMTP helo=<googlemail.com>
Sep 17 06:54:32 canopus postfix/smtpd[1421924]: 0657A7A68DE: reject: RCPT from unknown[38.49.149.244]: 554 5.7.1 <[email protected] >: Recipient address rejected: Maximum 20 messages per 60 minutes limit reached; from=<[email protected] > to=<[email protected] > proto=ESMTP helo=<googlemail.com>
Sep 17 06:54:33 canopus postfix/smtpd[1421924]: 0657
...
show less
Brute-Force
Exploited Host
๐บ๐ธ
้ฌผๅฝฑ233
2026-08-31 01:22:20
(1 month ago)
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Sa ...
show more
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
show less
Bad Web Bot
๐ซ๐ท
Sklurk
2026-08-08 00:07:19
(1 month ago)
Web App Attack
Web App Attack
๐ซ๐ท
Tilellit.PRO
2026-07-07 05:40:46
(2 months ago)
WooCommerce YITH AJAX Filder product_cat filter flood attempt with taxonomies
DDoS Attack
Bad Web Bot
๐บ๐ธ
TPI-Abuse
2026-01-05 18:53:56
(9 months ago)
(mod_security) mod_security (id:210730) triggered by 38.49.149.244 (38-49-149-244.internet.ientc.mx) ...
show more
(mod_security) mod_security (id:210730) triggered by 38.49.149.244 (38-49-149-244.internet.ientc.mx): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jan 05 13:53:49.164770 2026] [security2:error] [pid 5935:tid 5935] [client 38.49.149.244:2695] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||www.scoutinsignia.com|F|2"] [data ".log"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.scoutinsignia.com"] [uri "/train_files/WS_FTP.LOG"] [unique_id "aVwIvQP7izwZxwKbitQ0_wAAABY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2025-11-20 06:42:29
(10 months ago)
scanning http requests from known botnet
Web App Attack
๐ฆ๐ท
OcampoFer
2024-10-07 05:18:07
(1 year ago)
SPAM - IP blocked by DNSBL for a period of 12 hours.
Email Spam
Showing 1 to
8
of 8 reports
