JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

49.149.116.74

Activity Trending Down

Abuse Confidence Score

38% Elevated

24 reports

20 reporters · latest 1 month ago

ISP: HOME_DSL
Usage Type: Fixed Line ISP
ASN: AS9299
Domain Name: pldthome.com
Country: 🇵🇭 Philippines
City: Bislig, Caraga

ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report Whois

Example preview

Account required for the enhanced features Log in Sign up

Abuse Reports

Export reports CSV

Total reports

24 from 20 distinct reporters

First reported

September 24th 2026

Most recent report

1 month ago

Last 60 days

Top reporter locations 🇩🇪 Germany 12 🇺🇸 United States of America 3 🇬🇧 United Kingdom of Great Britain and Northern Ireland 2

Most common categories Web App Attack 18 Brute-Force 12 Port Scan 5 Bad Web Bot 4 Hacking 3

Old reports The most recent abuse report for this IP address is from 1 month ago. It is possible that this IP is no longer involved in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇩🇪 Hazzard	2026-10-03 10:15:21 UTC · (1 month ago)	(wordpress) Failed wordpress login from 49.149.116.74 (PH/Philippines/Province of Bukidnon/Malaybalay/-/[redacted]): (CF_ENABLE)	Brute-Force
🇫🇷 masterguru	2026-10-03 05:24:48 UTC · (1 month ago)	(xmlrpc) Apache: Failed xmlrpc access from 49.149.116.74 (PH/Philippines/dsl.49.149.116.74.pldt.net): 10 in the last 3600 secs (0-201)	Hacking
🇫🇮 inlink.ltd	2026-10-02 20:08:45 UTC · (1 month ago)	Known malicious PHP file or CMS probe	Web App Attack
🇩🇪 rh24	2026-10-02 14:52:58 UTC · (1 month ago)	(wordpress) Failed wordpress login from 49.149.116.74 (PH/Philippines/dsl.49.149.116.74.pldt.net): (CF_ENABLE)	Brute-Force
🇩🇪 4server	2026-10-02 11:30:03 UTC · (1 month ago)	[FriOct0213:30:00.1703932026][security2:error][pid2285450:tid2285563][client49.149.116.74:0]ModSecurity:Accessdeniedwithcode403\(phase1\).Stringmatch\"/xmlrpc.php\"atREQUEST_URI.[file\"/etc/apache2/conf.d/modsec_custom_rules.conf\"][line\"170\"][id\" ... show more [FriOct0213:30:00.1703932026][security2:error][pid2285450:tid2285563][client49.149.116.74:0]ModSecurity:Accessdeniedwithcode403\(phase1\).Stringmatch\"/xmlrpc.php\"atREQUEST_URI.[file\"/etc/apache2/conf.d/modsec_custom_rules.conf\"][line\"170\"][id\"960024\"][msg\"XML-RPCdisabled\"][hostname\"vulcanoricambi.ch\"][uri\"/xmlrpc.php\"][unique_id\"ar-VuIOHS7HIlQCShWHPqQAAAMU\"] show less	Port Scan Brute-Force Web App Attack
🇩🇪 4server	2026-09-29 03:59:09 UTC · (1 month ago)	[TueSep2905:59:08.3222032026][security2:error][pid1740848:tid1740959][client49.149.116.74:0]ModSecurity:Accessdeniedwithcode403\(phase1\).Stringmatch\"/xmlrpc.php\"atREQUEST_URI.[file\"/etc/apache2/conf.d/modsec_custom_rules.conf\"][line\"170\"][id\" ... show more [TueSep2905:59:08.3222032026][security2:error][pid1740848:tid1740959][client49.149.116.74:0]ModSecurity:Accessdeniedwithcode403\(phase1\).Stringmatch\"/xmlrpc.php\"atREQUEST_URI.[file\"/etc/apache2/conf.d/modsec_custom_rules.conf\"][line\"170\"][id\"960024\"][msg\"XML-RPCdisabled\"][hostname\"massimilianoparquet.ch\"][uri\"/xmlrpc.php\"][unique_id\"ars3jBnaL0rITst-dnjQPAAAANE\"] show less	Port Scan Brute-Force Web App Attack
🇳🇱 Site.eu	2026-09-28 22:10:04 UTC · (1 month ago)	Repeated wp-login/xmlrpc attempts	Brute-Force SSH
🇺🇸 lostswordfish.com	2026-09-28 19:10:04 UTC · (1 month ago)	Wordfence waf block on registrymatters	Web App Attack
🇩🇪 stinpriza	2026-09-28 15:40:27 UTC · (1 month ago)	Web App Attack	Web App Attack
🇺🇸 IndigoRidge	2026-09-28 15:12:48 UTC · (1 month ago)	49.149.116.74 - - [28/Sep/2026:11:11:28 -0400] "POST /xmlrpc.php HTTP/1.1" 200 5302 "-" "Mozilla/5.0 (Windows NT 6.3; x64) AppleWebKit/537.36 (KHTML, like Gecko) Edge/80.0.0.0 Safari/537.36" 49.149.116.74 - - [28/Sep/2026:11:11:47 -0400] "POST /xmlrp ... show more 49.149.116.74 - - [28/Sep/2026:11:11:28 -0400] "POST /xmlrpc.php HTTP/1.1" 200 5302 "-" "Mozilla/5.0 (Windows NT 6.3; x64) AppleWebKit/537.36 (KHTML, like Gecko) Edge/80.0.0.0 Safari/537.36" 49.149.116.74 - - [28/Sep/2026:11:11:47 -0400] "POST /xmlrpc.php HTTP/1.1" 200 5302 "-" "Mozilla/5.0 (Windows NT 6.3; x86) AppleWebKit/537.36 (KHTML, like Gecko) Safari/14.0.0.0 Safari/537.36" 49.149.116.74 - - [28/Sep/2026:11:12:12 -0400] "POST /xmlrpc.php HTTP/1.1" 200 5302 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; x86) AppleWebKit/537.36 (KHTML, like Gecko) Opera/69.0.0.0 Safari/537.36" 49.149.116.74 - - [28/Sep/2026:11:12:31 -0400] "POST /xmlrpc.php HTTP/1.1" 200 5302 "-" "Mozilla/5.0 (Windows NT 6.2; x64) AppleWebKit/537.36 (KHTML, like Gecko) Edge/82.0.0.0 Safari/537.36" 49.149.116.74 - - [28/Sep/2026:11:12:48 -0400] "POST /xmlrpc.php HTTP/1.1" 200 5302 "-" "Mozilla/5.0 (Windows NT 6.3; arm64) AppleWebKit/537.36 (KHTML, like Gecko) Firefox/84.0.0.0 Safari/537.36" ... show less	Web App Attack
🇬🇧 Bytemark	2026-09-28 09:38:42 UTC · (1 month ago)	49.149.116.74 - - [28/Sep/2026:10:38:35 +0100] "POST /xmlrpc.php HTTP/1.1" 301 6510 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; x86) AppleWebKit/537.36 (KHTML, like Gecko) Firefox/77.0.0.0 Safari/537.36" 49.149.116.74 - - [28/Sep/2026:10:38:40 +0100 ... show more 49.149.116.74 - - [28/Sep/2026:10:38:35 +0100] "POST /xmlrpc.php HTTP/1.1" 301 6510 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; x86) AppleWebKit/537.36 (KHTML, like Gecko) Firefox/77.0.0.0 Safari/537.36" 49.149.116.74 - - [28/Sep/2026:10:38:40 +0100] "GET /xmlrpc.php HTTP/1.1" 301 6653 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; x86) AppleWebKit/537.36 (KHTML, like Gecko) Firefox/77.0.0.0 Safari/537.36" 49.149.116.74 - - [28/Sep/2026:10:38:42 +0100] "GET /xmlrpc.php HTTP/1.1" 404 6414 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; x86) AppleWebKit/537.36 (KHTML, like Gecko) Firefox/77.0.0.0 Safari/537.36" show less	Brute-Force Web App Attack
🇮🇳 dineshskt4all	2026-09-28 04:28:14 UTC · (1 month ago)	[Mon Sep 28 04:28:12.189988 2026] [proxy_fcgi:error] [pid 3859207:tid 125218716645056] [client 49.149.116.74:0] AH01071: Got error 'Primary script unknown' ...	Brute-Force
🇵🇱 Budyn	2026-09-28 00:33:48 UTC · (1 month ago)	Automated threat detected by Budyn Honeypot Sinkhole. Attack type: WP Path Scanning (Recon). Malicious scanner triggered a security trap targeting emulated vulnerabilities. Evidence: HOST: astropot.online \| URI: /xmlrpc.php \| UA: Mozilla/5.0 (Windows ... show more Automated threat detected by Budyn Honeypot Sinkhole. Attack type: WP Path Scanning (Recon). Malicious scanner triggered a security trap targeting emulated vulnerabilities. Evidence: HOST: astropot.online \| URI: /xmlrpc.php \| UA: Mozilla/5.0 (Windows NT 6.3; arm64) AppleWebKit/537.36 (KHTML, like Gecko) Safari/10.0.0.0 Safari/537.36 \| BODY: <?xml version="1.0"?><methodCall><methodName>metaWeblog.newPost</methodName><params><param><value><string>1</string></value></param><param><value><string>62932</string></value></param><param><value><string>62932</string></value></param><param><value><struct><member><name>title</name><value><string>0x1c5f9409</string></value></member><memb show less	Bad Web Bot Web App Attack
🇬🇧 spamverify.com	2026-09-27 22:27:00 UTC · (1 month ago)	Honeypot Hit: xmlrpc.php	Web Spam Blog Spam Bad Web Bot Web App Attack
🇺🇸 OceanTreasure	2026-09-27 20:30:51 UTC · (1 month ago)	tcp/443; WordPress XML-RPC brute force attempt: "POST /xmlrpc.php" @ 2026-09-27T20:30:51Z [proxy]	Web App Attack Brute-Force

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown

Recently Reported IPs:

🇺🇸 147.185.132.96

🇹🇭 119.42.96.90

🇵🇹 103.211.85.131

🇳🇱 85.11.167.7

🇺🇸 52.87.185.15

🇺🇸 43.152.72.244

🇩🇪 195.182.16.23

🇺🇸 172.233.140.132

🇺🇸 172.173.200.62

🇸🇬 45.78.230.231

🇨🇳 14.155.209.145

🇨🇳 140.249.189.35

🇳🇱 77.239.124.45

🇵🇭 49.149.198.35

🇸🇬 47.128.110.70

🇨🇱 190.151.5.26

🇬🇧 90.217.168.159

🇿🇼 41.60.97.197

🇺🇸 207.90.244.22

🇸🇮 102.220.161.208