JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 49.146.36.92

49.146.36.92 was found in our database!

This IP was reported 15 times. Confidence of Abuse is 51%: ?

51%

ISP	HOME_DSL
Usage Type	Fixed Line ISP
ASN	AS9299
Hostname(s)	dsl.49.146.36.92.pldt.net
Domain Name	pldthome.com
Country	🇵🇭 Philippines
City	Cagayan de Oro, Northern Mindanao

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 49.146.36.92

Whois 49.146.36.92

IP Abuse Reports for 49.146.36.92:

This IP address has been reported a total of 15 times from 12 distinct sources. 49.146.36.92 was first reported on April 12th 2021, and the most recent report was 1 week ago.

Old Reports: The most recent abuse report for this IP address is from 1 week ago . It is possible that this IP is no longer involved in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇳🇱 ipoac.nl	2026-07-16 08:40:56 (1 week ago)	-:443 49.146.36.92 - - [16/Jul/2026:10:40:55 +0200] - "POST /xmlrpc.php HTTP/1.1" 404 6418 "-" "Mozi ... show more -:443 49.146.36.92 - - [16/Jul/2026:10:40:55 +0200] - "POST /xmlrpc.php HTTP/1.1" 404 6418 "-" "Mozilla/5.0 (Windows NT 10.0; x86) AppleWebKit/537.36 (KHTML, like Gecko) Opera/67.0.0.0 Safari/537.36" show less	Bad Web Bot
🇺🇸 billfor	2026-07-15 13:59:29 (1 week ago)	49.146.36.92 - - [15/Jul/2026:09:59:25 -0400] "POST /xmlrpc.php HTTP/1.1" 404 711 "-" "Mozilla/5.0 ( ... show more 49.146.36.92 - - [15/Jul/2026:09:59:25 -0400] "POST /xmlrpc.php HTTP/1.1" 404 711 "-" "Mozilla/5.0 (Windows NT 6.2; x86) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.0.0 Safari/537.36" show less	Web App Attack
🇩🇪 LRob	2026-07-15 13:35:08 (1 week ago)	CrowdSec: crowdsecurity/http-bf-wordpress_bf_xmlrpc \| req: /xmlrpc.php \| UA: Mozilla/5.0 (Windows NT ... show more CrowdSec: crowdsecurity/http-bf-wordpress_bf_xmlrpc \| req: /xmlrpc.php \| UA: Mozilla/5.0 (Windows NT 6.2; arm64) AppleWebKit/537.36 (KHTML, like Gecko) Edge/84.0.0.0 Safari/537.36 show less	Brute-Force Web App Attack
🇩🇪 LRob	2026-07-15 02:57:44 (1 week ago)	CrowdSec: crowdsecurity/http-bf-wordpress_bf_xmlrpc \| req: /xmlrpc.php \| UA: Mozilla/5.0 (Windows NT ... show more CrowdSec: crowdsecurity/http-bf-wordpress_bf_xmlrpc \| req: /xmlrpc.php \| UA: Mozilla/5.0 (Windows NT 6.2; x86) AppleWebKit/537.36 (KHTML, like Gecko) Safari/11.0.0.0 Safari/537.36 show less	Brute-Force Web App Attack
🇩🇪 LRob	2026-07-14 08:47:00 (1 week ago)	CrowdSec: crowdsecurity/http-bf-wordpress_bf_xmlrpc \| req: /xmlrpc.php \| UA: Mozilla/5.0 (Windows NT ... show more CrowdSec: crowdsecurity/http-bf-wordpress_bf_xmlrpc \| req: /xmlrpc.php \| UA: Mozilla/5.0 (Windows NT 6.2; x86) AppleWebKit/537.36 (KHTML, like Gecko) Edge/98.0.0.0 Safari/537.36 show less	Brute-Force Web App Attack
🇩🇪 AbuseBaer	2026-07-14 01:21:38 (1 week ago)	access attempt detected by IDS script (C)	Web App Attack
🇩🇪 stinpriza	2026-07-14 00:27:48 (1 week ago)	Web App Attack	Web App Attack
🇺🇸 TPI-Abuse	2026-07-13 09:29:39 (1 week ago)	(mod_security) mod_security (id:225170) triggered by 49.146.36.92 (dsl.49.146.36.92.pldt.net): 1 in ... show more (mod_security) mod_security (id:225170) triggered by 49.146.36.92 (dsl.49.146.36.92.pldt.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jul 13 05:29:36.065757 2026] [security2:error] [pid 5823:tid 5823] [client 49.146.36.92:58973] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)\|\|rohanbyles.com.au\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "rohanbyles.com.au"] [uri "/wp-json/wp/v2/users"] [unique_id "alSwAFAPIYPPzOcrIEog2QAAAAY"] show less	Brute-Force Bad Web Bot Web App Attack
🇩🇪 4server	2026-07-12 19:15:34 (1 week ago)	[SunJul1221:15:30.1423342026][security2:error][pid3590063:tid3590175][client49.146.36.92:0]ModSecuri ... show more [SunJul1221:15:30.1423342026][security2:error][pid3590063:tid3590175][client49.146.36.92:0]ModSecurity:Accessdeniedwithcode403\(phase1\).Stringmatch\"/xmlrpc.php\"atREQUEST_URI.[file\"/etc/apache2/conf.d/modsec_custom_rules.conf\"][line\"170\"][id\"960024\"][msg\"XML-RPCdisabled\"][hostname\"albertiarnaldoluigi.ch\"][uri\"/xmlrpc.php\"][unique_id\"alPn0goDmsKUI7FBjNoBngAAANM\"] show less	Port Scan Brute-Force Web App Attack
🇳🇴 jad-abuse	2026-07-12 00:18:13 (2 weeks ago)	ActiveDefense automated detection: malicious HTTP scanning / exploit attempts. Signatures: xmlrpc. O ... show more ActiveDefense automated detection: malicious HTTP scanning / exploit attempts. Signatures: xmlrpc. Observed by 1 sensor(s); 1 hits. show less	Brute-Force Web App Attack
🇬🇷 setupgr	2026-07-11 02:10:02 (2 weeks ago)	(XMLRPC) WP XMLRPC Attack 49.146.36.92 (PH/Philippines/Soccsksargen/Midsayap/-/[AS9299 IPG-AS-AP Phi ... show more (XMLRPC) WP XMLRPC Attack 49.146.36.92 (PH/Philippines/Soccsksargen/Midsayap/-/[AS9299 IPG-AS-AP Philippine Long Distance Telephone Company]): 1 in the last 86400 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: 49.146.36.92 - - [11/Jul/2026:05:02:57 +0300] "POST /xmlrpc.php HTTP/1.1" 301 303 "-" "Mozilla/5.0 (Linux; Android 10; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.0.0 Safari/537.36" show less	Port Scan
🇦🇺 screwlooseit.com.au	2026-07-05 17:21:33 (2 weeks ago)	Blocked by CSF 13 firewall - Rule: XMLRPC PH/Philippines/dsl.49.146.36.92.pldt.net	Web App Attack
🇫🇷 dynamix	2026-07-05 15:02:52 (2 weeks ago)	WordPress XMLRPC Brute Force Attack	Brute-Force Web App Attack
🇺🇸 TPI-Abuse	2026-07-05 14:00:18 (2 weeks ago)	(mod_security) mod_security (id:225170) triggered by 49.146.36.92 (dsl.49.146.36.92.pldt.net): 1 in ... show more (mod_security) mod_security (id:225170) triggered by 49.146.36.92 (dsl.49.146.36.92.pldt.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Jul 05 10:00:13.412337 2026] [security2:error] [pid 1568:tid 1568] [client 49.146.36.92:60270] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)\|\|reyadecostarica.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "reyadecostarica.com"] [uri "/wp-json/wp/v2/users"] [unique_id "akpjbczl9OFw5W2_jYLcUgAAABk"] show less	Brute-Force Bad Web Bot Web App Attack
🇩🇪 Hiffo	2021-04-12 10:15:25 (5 years ago)	1618236924 - 04/12/2021 16:15:24 Host: 49.146.36.92/49.146.36.92 Port: 445 TCP Blocked	Port Scan

Showing 1 to 15 of 15 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇬🇧 213.166.84.37

🇷🇺 213.156.208.189

🇺🇸 193.3.53.9

🇸🇬 152.42.164.200

🇨🇦 85.217.149.70

🇺🇸 57.141.18.62

🇹🇭 49.0.71.100

🇮🇷 217.218.137.56

🇭🇰 199.45.154.190

🇿🇦 185.132.186.49

🇷🇺 178.157.167.218

🇻🇳 116.111.9.91

🇵🇱 88.156.132.40

🇺🇸 66.132.186.241

🇫🇷 51.178.84.57

🇺🇸 2607:f8b0:4023:100f::127

🇩🇪 172.70.240.109

🇩🇪 172.70.240.108

🇭🇰 156.225.20.213

🇫🇮 147.185.133.19