JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 49.12.144.217

49.12.144.217 was found in our database!

This IP was reported 49 times. Confidence of Abuse is 100%: ?

100%

ISP	Hetzner Online GmbH
Usage Type	Data Center/Web Hosting/Transit
ASN	AS24940
Hostname(s)	chb20.wehostwebserver.com
Domain Name	hetzner.com
Country	🇩🇪 Germany
City	Falkenstein, Saxony

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 49.12.144.217

Whois 49.12.144.217

IP Abuse Reports for 49.12.144.217:

This IP address has been reported a total of 49 times from 25 distinct sources. 49.12.144.217 was first reported on June 15th 2026, and the most recent report was 4 hours ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇩🇪 neckaralb-admin.de	2026-07-07 12:13:54 (4 hours ago)	(wordpress) Failed login wp-login.php or xmlrpc.php	Web App Attack
🇲🇽 octageeks.com	2026-07-07 04:10:08 (12 hours ago)	Wordpress malicious attack:[octaxmlrpc]	Web App Attack
🇩🇪 ger-stg-sifi1	2026-07-07 03:21:14 (13 hours ago)	(wordpress) Failed wordpress login using wp-login.php or xmlrpc.php	Web App Attack
🇩🇪 4server	2026-07-07 03:17:22 (13 hours ago)	[TueJul0705:17:15.8486412026][security2:error][pid816831:tid816877][client49.12.144.217:0]ModSecurit ... show more [TueJul0705:17:15.8486412026][security2:error][pid816831:tid816877][client49.12.144.217:0]ModSecurity:Accessdeniedwithcode403\(phase1\).Stringmatch\"/xmlrpc.php\"atREQUEST_URI.[file\"/etc/apache2/conf.d/modsec_custom_rules.conf\"][line\"170\"][id\"960024\"][msg\"XML-RPCdisabled\"][hostname\"ipv6.gmint.ch\"][uri\"/xmlrpc.php\"][unique_id\"akxvu_e6jQAsWQ-f0eO_ZgAAAEk\"] show less	Port Scan Brute-Force Web App Attack
Anonymous	2026-07-07 02:26:25 (13 hours ago)	49.12.144.217 - - [07/Jul/2026:10:26:24 +0800] "POST /xmlrpc.php HTTP/1.1" 200 401 "-" "Mozilla/5.0 ... show more 49.12.144.217 - - [07/Jul/2026:10:26:24 +0800] "POST /xmlrpc.php HTTP/1.1" 200 401 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36" ... show less	Bad Web Bot Web App Attack
🇦🇺 QT	2026-07-06 20:46:40 (19 hours ago)	Unauthorised WordPress admin login attempted at 2026-07-07 06:46:28 +1000	Web App Attack
Anonymous	2026-07-06 09:46:24 (1 day ago)	(wordpress) Failed login wp-login.php or xmlrpc.php	Web App Attack
Anonymous	2026-07-06 02:42:05 (1 day ago)	Bot / scanning and/or hacking attempts: POST /wp-login.php HTTP/2.0	Hacking Web App Attack
🇩🇪 marten_o	2026-07-06 00:44:57 (1 day ago)	49.12.144.217 - - [06/Jul/2026:02:44:57 +0200] "GET /wp-login.php HTTP/2.0" 200 3321 "-" "Mozilla/5. ... show more 49.12.144.217 - - [06/Jul/2026:02:44:57 +0200] "GET /wp-login.php HTTP/2.0" 200 3321 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.3 Safari/605.1.15" 169 3666 ... show less	Bad Web Bot Web App Attack
🇲🇽 octageeks.com	2026-07-05 04:16:11 (2 days ago)	Wordpress malicious attack:[octaflood]	Web App Attack
🇺🇸 TPI-Abuse	2026-07-05 02:07:47 (2 days ago)	(mod_security) mod_security (id:225170) triggered by 49.12.144.217 (chb20.wehostwebserver.com): 1 in ... show more (mod_security) mod_security (id:225170) triggered by 49.12.144.217 (chb20.wehostwebserver.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Jul 04 22:07:43.200354 2026] [security2:error] [pid 25852:tid 25852] [client 49.12.144.217:44542] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)\|\|truthsabouthealthcare.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "truthsabouthealthcare.com"] [uri "/wp-json/wp/v2/users/me"] [unique_id "akm8bzP-A4z536Al0_P2rAAAAAc"] show less	Brute-Force Bad Web Bot Web App Attack
🇫🇷 tecnicorioja	2026-07-04 22:00:54 (2 days ago)	wp-login attack [04/Jul/2026:21:14:31	Brute-Force Web App Attack
🇮🇹 sssrit	2026-07-04 19:03:12 (2 days ago)	49.12.144.217 - - [04/Jul/2026:21:03:11 +0200] "POST /wp-login.php HTTP/2.0" 401 4733 "https://sassa ... show more 49.12.144.217 - - [04/Jul/2026:21:03:11 +0200] "POST /wp-login.php HTTP/2.0" 401 4733 "https://sassarionline.sssr.it/wp-login.php" "Mozilla/5.0 (X11; Linux x86_64; rv:133.0) Gecko/20100101 Firefox/133.0" ... show less	Web App Attack
🇩🇪 Hazzard	2026-07-04 18:28:28 (2 days ago)	(wordpress) Failed wordpress login from 49.12.144.217 (DE/Germany/Saxony/Falkenstein/chb20.wehostweb ... show more (wordpress) Failed wordpress login from 49.12.144.217 (DE/Germany/Saxony/Falkenstein/chb20.wehostwebserver.com/[redacted]): (CF_ENABLE) show less	Brute-Force
🇺🇸 TPI-Abuse	2026-07-04 06:58:23 (3 days ago)	(mod_security) mod_security (id:225170) triggered by 49.12.144.217 (chb20.wehostwebserver.com): 1 in ... show more (mod_security) mod_security (id:225170) triggered by 49.12.144.217 (chb20.wehostwebserver.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Jul 04 02:58:20.468839 2026] [security2:error] [pid 11603:tid 11603] [client 49.12.144.217:55086] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)\|\|thehealthyplaceclayton.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "thehealthyplaceclayton.com"] [uri "/wp-json/wp/v2/users/10"] [unique_id "akivDKBSC2MmGCjmxMOhnAAAAAc"] show less	Brute-Force Bad Web Bot Web App Attack

Showing 1 to 15 of 49 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇹🇼 165.154.227.158

🇩🇪 141.11.107.4

🇳🇱 185.244.149.178

🇫🇷 173.249.8.235

🇺🇸 104.243.46.222

🇻🇳 103.199.16.90

🇸🇬 94.231.206.128

🇩🇪 77.22.211.47

🇺🇸 65.111.3.105

🇲🇽 187.147.86.146

🇭🇰 114.111.54.189

🇨🇳 106.75.185.227

🇺🇸 104.167.25.204

🇫🇷 87.98.220.168

🇺🇸 35.245.24.124

🇬🇧 35.203.211.218

🇸🇬 20.24.13.49

🇧🇷 200.153.86.250

🇸🇬 139.59.244.68

🇺🇸 137.184.228.138