JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 49.145.180.170

49.145.180.170 was found in our database!

This IP was reported 51 times. Confidence of Abuse is 100%: ?

100%

ISP	HOME_DSL
Usage Type	Fixed Line ISP
ASN	AS9299
Hostname(s)	dsl.49.145.180.170.pldt.net
Domain Name	pldthome.com
Country	🇵🇭 Philippines
City	Bacolod City, Western Visayas

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 49.145.180.170

Whois 49.145.180.170

IP Abuse Reports for 49.145.180.170:

This IP address has been reported a total of 51 times from 26 distinct sources. 49.145.180.170 was first reported on June 22nd 2026, and the most recent report was 12 hours ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇩🇪 ghostwarriors	2026-07-23 07:50:35 (12 hours ago)	Webpage scraping	Brute-Force Bad Web Bot Web App Attack
Anonymous	2026-07-23 07:23:03 (12 hours ago)	Fail2Ban: WordPress XML-RPC brute-force attack detected.	Bad Web Bot Web App Attack
🇪🇸 alferez	2026-07-23 03:53:26 (16 hours ago)	xmlrpc.php attack DOS	Hacking Exploited Host Web App Attack
🇺🇸 TPI-Abuse	2026-07-23 00:46:36 (19 hours ago)	(mod_security) mod_security (id:240335) triggered by 49.145.180.170 (dsl.49.145.180.170.pldt.net): 1 ... show more (mod_security) mod_security (id:240335) triggered by 49.145.180.170 (dsl.49.145.180.170.pldt.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jul 22 20:46:31.777027 2026] [security2:error] [pid 1969498:tid 1969498] [client 49.145.180.170:57650] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 49.145.180.170 (+1 hits since last alert)\|johncyphers.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "johncyphers.com"] [uri "/xmlrpc.php"] [unique_id "amFkZwwP4NHJbuJF_J48UQAAABY"] show less	Brute-Force Bad Web Bot Web App Attack
🇪🇸 SweetHoneyPress	2026-07-22 05:48:51 (1 day ago)	WordPress honeypot: POST to /xmlrpc.php \| event_id=1080289 \| UA: Jetpack by WordPress.com	Web App Attack Brute-Force
🇪🇸 SweetHoneyPress	2026-07-22 05:33:48 (1 day ago)	WordPress honeypot: POST to /xmlrpc.php \| event_id=1080200 \| UA: Jetpack by WordPress.com (Jetpack 1 ... show more WordPress honeypot: POST to /xmlrpc.php \| event_id=1080200 \| UA: Jetpack by WordPress.com (Jetpack 12.0; WordPress 6.2) show less	Web App Attack Brute-Force
🇲🇾 Rizzy	2026-07-22 03:11:12 (1 day ago)	Multiple WAF Violations	Brute-Force Web App Attack
🇺🇸 TPI-Abuse	2026-07-22 01:49:27 (1 day ago)	(mod_security) mod_security (id:240335) triggered by 49.145.180.170 (dsl.49.145.180.170.pldt.net): 1 ... show more (mod_security) mod_security (id:240335) triggered by 49.145.180.170 (dsl.49.145.180.170.pldt.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jul 21 21:49:20.496567 2026] [security2:error] [pid 172087:tid 172087] [client 49.145.180.170:61047] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 49.145.180.170 (+1 hits since last alert)\|dalessalesandservice.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "dalessalesandservice.com"] [uri "/xmlrpc.php"] [unique_id "amAhoDn5rG9SRKGzjHivNQAAAAE"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-07-21 07:45:03 (2 days ago)	(mod_security) mod_security (id:240335) triggered by 49.145.180.170 (dsl.49.145.180.170.pldt.net): 1 ... show more (mod_security) mod_security (id:240335) triggered by 49.145.180.170 (dsl.49.145.180.170.pldt.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jul 21 03:44:56.919906 2026] [security2:error] [pid 11730:tid 11730] [client 49.145.180.170:62358] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 49.145.180.170 (+1 hits since last alert)\|crittergetterpestcontrol.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "crittergetterpestcontrol.com"] [uri "/xmlrpc.php"] [unique_id "al8jeI2s9OIFkVILFTHOYQAAABg"] show less	Brute-Force Bad Web Bot Web App Attack
🇳🇱 Site.eu	2026-07-14 05:54:03 (1 week ago)	Repeated wp-login/xmlrpc attempts	Brute-Force SSH
🇪🇸 masterguru	2026-07-14 02:20:00 (1 week ago)	(xmlrpc) Failed xmlrpc access from 49.145.180.170 (PH/Philippines/dsl.49.145.180.170.pldt.net): 5 in ... show more (xmlrpc) Failed xmlrpc access from 49.145.180.170 (PH/Philippines/dsl.49.145.180.170.pldt.net): 5 in the last 3600 secs (0-122) show less	Hacking
🇫🇷 SpaceHost-Server	2026-07-13 08:35:02 (1 week ago)	49.145.180.170 - - [13/Jul/2026:10:34:40 +0200] "POST /xmlrpc.php HTTP/1.1" 200 6382 "-" "Jetpack by ... show more 49.145.180.170 - - [13/Jul/2026:10:34:40 +0200] "POST /xmlrpc.php HTTP/1.1" 200 6382 "-" "Jetpack by WordPress.com" 49.145.180.170 - - [13/Jul/2026:10:34:50 +0200] "POST /xmlrpc.php HTTP/1.1" 200 6382 "-" "Jetpack/12.1; WordPress/6.2; http://site85262051.com" 49.145.180.170 - - [13/Jul/2026:10:35:01 +0200] "POST /xmlrpc.php HTTP/1.1" 200 6382 "-" "Jetpack by WordPress.com" show less	Hacking Web App Attack
🇫🇷 SpaceHost-Server	2026-07-13 08:19:38 (1 week ago)	49.145.180.170 - - [13/Jul/2026:10:19:18 +0200] "POST /xmlrpc.php HTTP/1.1" 200 6382 "-" "Jetpack by ... show more 49.145.180.170 - - [13/Jul/2026:10:19:18 +0200] "POST /xmlrpc.php HTTP/1.1" 200 6382 "-" "Jetpack by WordPress.com" 49.145.180.170 - - [13/Jul/2026:10:19:27 +0200] "POST /xmlrpc.php HTTP/1.1" 200 6382 "-" "Jetpack by WordPress.com" 49.145.180.170 - - [13/Jul/2026:10:19:37 +0200] "POST /xmlrpc.php HTTP/1.1" 200 6382 "-" "Jetpack/12.5; WordPress/6.2; http://site80062844.com" show less	Hacking Web App Attack
🇳🇱 Site.eu	2026-07-13 05:07:03 (1 week ago)	Repeated wp-login/xmlrpc attempts	Brute-Force SSH
🇬🇧 Apache	2026-07-09 06:40:33 (2 weeks ago)	(mod_security) mod_security (id:240335) triggered by 49.145.180.170 (PH/Philippines/dsl.49.145.180.1 ... show more (mod_security) mod_security (id:240335) triggered by 49.145.180.170 (PH/Philippines/dsl.49.145.180.170.pldt.net): 5 in the last 300 secs show less	Brute-Force Web App Attack

Showing 1 to 15 of 51 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇸🇬 188.166.225.116

🇰🇷 175.200.104.40

🇬🇧 46.43.20.75

🇺🇸 18.116.101.220

🇻🇳 14.248.83.33

🇷🇴 193.32.162.34

🇧🇷 177.8.166.2

🇰🇷 175.118.124.27

🇵🇰 175.107.224.117

🇳🇱 172.94.9.203

🇫🇷 91.196.152.204

🇨🇦 85.217.149.68

🇴🇲 38.253.212.23

🇮🇷 37.32.12.67

🇺🇸 174.138.73.32

🇨🇦 174.7.32.199

🇮🇩 139.228.33.185

🇨🇳 116.179.37.11

🇷🇺 109.173.38.135

🇲🇰 185.193.240.246