JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 49.156.37.218

49.156.37.218 was found in our database!

This IP was reported 39 times. Confidence of Abuse is 59%: ?

59%

ISP	WiCAM Corporation Ltd.
Usage Type	Fixed Line ISP
ASN	AS24492
Domain Name	wicam.com.kh
Country	🇰🇭 Cambodia
City	Phnom Penh, Phnom Penh

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 49.156.37.218

Whois 49.156.37.218

IP Abuse Reports for 49.156.37.218:

This IP address has been reported a total of 39 times from 24 distinct sources. 49.156.37.218 was first reported on July 24th 2026, and the most recent report was 2 days ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇩🇪 jbcrn	2026-08-26 10:19:20 (2 days ago)	Blocked by iocaine (nam-shub-of-enki) tarpit. Classified as: Disguised bots, ruleset: faked-browser. ... show more Blocked by iocaine (nam-shub-of-enki) tarpit. Classified as: Disguised bots, ruleset: faked-browser. Requested honeypot path: /. User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:68.0) Gecko/20100101 Firefox/68.0 show less	Bad Web Bot Web App Attack
🇩🇪 jbcrn	2026-08-22 15:36:39 (6 days ago)	Blocked by iocaine (nam-shub-of-enki) tarpit. Classified as: Disguised bots, ruleset: faked-browser. ... show more Blocked by iocaine (nam-shub-of-enki) tarpit. Classified as: Disguised bots, ruleset: faked-browser. Requested honeypot path: /. User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.3 show less	Bad Web Bot Web App Attack
🇩🇪 jbcrn	2026-08-16 14:03:13 (1 week ago)	Blocked by iocaine (nam-shub-of-enki) tarpit. Classified as: Disguised bots, ruleset: faked-browser. ... show more Blocked by iocaine (nam-shub-of-enki) tarpit. Classified as: Disguised bots, ruleset: faked-browser. Requested honeypot path: /. User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36 show less	Bad Web Bot Web App Attack
🇮🇩 Burayot	2026-07-30 21:48:16 (4 weeks ago)	LF_MODSEC: (mod_security) mod_security (id:1000001) triggered by 49.156.37.218 (KH/Cambodia/-): 2 in ... show more LF_MODSEC: (mod_security) mod_security (id:1000001) triggered by 49.156.37.218 (KH/Cambodia/-): 2 in the last 3600 secs show less	Web App Attack
🇮🇩 bps-statistics	2026-07-30 17:35:20 (4 weeks ago)	WP Login Scan Activities: "2026-07-31T00:35:20.429+07:00" "/wp-login.php" "49.156.37.218" "Mozilla/5 ... show more WP Login Scan Activities: "2026-07-31T00:35:20.429+07:00" "/wp-login.php" "49.156.37.218" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" show less	Web App Attack
🇺🇸 TPI-Abuse	2026-07-30 12:21:47 (4 weeks ago)	(mod_security) mod_security (id:225170) triggered by 49.156.37.218 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:225170) triggered by 49.156.37.218 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jul 30 08:21:41.878883 2026] [security2:error] [pid 1188880:tid 1188880] [client 49.156.37.218:50253] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)\|\|www.cosplayculture.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "www.cosplayculture.com"] [uri "/wp-json/wp/v2/users"] [unique_id "amtB1XrgM54nxKs5g1LsxwAAAAk"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 jormaster3k	2026-07-30 05:39:28 (4 weeks ago)	Attack against WordPress	Web App Attack
🇺🇸 Lee Daniel	2026-07-30 04:18:33 (4 weeks ago)	49.156.37.218 - - [30/Jul/2026:00:18:29 -0400] "GET /prevlaravel/sftp-config.json HTTP/1.1" 404 2892 ... show more 49.156.37.218 - - [30/Jul/2026:00:18:29 -0400] "GET /prevlaravel/sftp-config.json HTTP/1.1" 404 28922 "http://consolepassion.co.uk/prevlaravel/sftp-config.json" "Mozila/5.0" 49.156.37.218 - - [30/Jul/2026:00:18:31 -0400] "GET /sftp-config.json HTTP/1.1" 404 28905 "-" "Go-http-client/2.0" 49.156.37.218 - - [30/Jul/2026:00:18:31 -0400] "GET /.vscode/sftp.json HTTP/1.1" 404 28911 "-" "Go-http-client/2.0" 49.156.37.218 - - [30/Jul/2026:00:18:31 -0400] "GET /sftp.json HTTP/1.1" 404 28903 "-" "Go-http-client/2.0" 49.156.37.218 - - [30/Jul/2026:00:18:31 -0400] "GET /prevlaravel/sftp-config.json HTTP/1.1" 404 28922 "-" "Go-http-client/2.0" ... show less	DDoS Attack Web Spam Email Spam Port Scan Brute-Force Bad Web Bot Web App Attack
🇷🇴 iulianh	2026-07-30 04:09:52 (4 weeks ago)	*	Brute-Force SSH
🇺🇸 TPI-Abuse	2026-07-30 03:35:18 (4 weeks ago)	(mod_security) mod_security (id:210492) triggered by 49.156.37.218 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:210492) triggered by 49.156.37.218 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jul 29 23:35:13.019641 2026] [security2:error] [pid 9381:tid 9381] [client 49.156.37.218:49754] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cnphilos.com"] [uri "/prevlaravel/sftp-config.json"] [unique_id "amrGcbF14ugs2rtjeM4PawAAABo"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-07-30 02:59:56 (4 weeks ago)	(mod_security) mod_security (id:210492) triggered by 49.156.37.218 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:210492) triggered by 49.156.37.218 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jul 29 22:59:48.626467 2026] [security2:error] [pid 166872:tid 166872] [client 49.156.37.218:62032] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "circleway.org"] [uri "/prevlaravel/sftp-config.json"] [unique_id "amq-JKfp5xwk-LhY-NnouQAAAAE"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-07-30 01:45:25 (4 weeks ago)	(mod_security) mod_security (id:210492) triggered by 49.156.37.218 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:210492) triggered by 49.156.37.218 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jul 29 21:45:21.919458 2026] [security2:error] [pid 4029107:tid 4029107] [client 49.156.37.218:54394] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cchockeyhistory.org"] [uri "/prevlaravel/sftp-config.json"] [unique_id "amqssXpRJvwJ8BYIN3aAHAAAAAQ"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-07-30 01:14:23 (4 weeks ago)	(mod_security) mod_security (id:210492) triggered by 49.156.37.218 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:210492) triggered by 49.156.37.218 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jul 29 21:14:17.488824 2026] [security2:error] [pid 20101:tid 20101] [client 49.156.37.218:50097] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "caquintet.com"] [uri "/prevlaravel/sftp-config.json"] [unique_id "amqlacMklTBZvmvEAzUpbwAAAAs"] show less	Brute-Force Bad Web Bot Web App Attack
🇬🇧 consul.to	2026-07-30 01:00:00 (4 weeks ago)	Web attack/malicious scanning detected	Web App Attack
🇺🇸 TPI-Abuse	2026-07-30 00:58:39 (4 weeks ago)	(mod_security) mod_security (id:210492) triggered by 49.156.37.218 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:210492) triggered by 49.156.37.218 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jul 29 20:58:31.453420 2026] [security2:error] [pid 1022931:tid 1022931] [client 49.156.37.218:62353] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cameronwv.com"] [uri "/prevlaravel/sftp-config.json"] [unique_id "amqht_kvYCM2Lj9CVWfgOAAAAAY"] show less	Brute-Force Bad Web Bot Web App Attack

Showing 1 to 15 of 39 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇺🇦 176.111.51.203

🇮🇩 163.7.6.114

🇮🇳 110.173.190.221

🇱🇹 213.176.26.19

🇵🇾 190.128.208.6

🇺🇿 87.192.253.110

🇫🇷 85.217.140.43

🇳🇱 80.57.195.24

🇫🇷 75.119.155.172

🇱🇹 62.60.130.201

🇳🇱 195.178.110.217

🇳🇱 85.11.167.127

🇺🇸 65.49.1.38

🇭🇰 64.90.11.178

🇰🇷 211.43.100.92

🇳🇱 204.76.203.21

🇮🇩 180.247.56.141

🇩🇪 167.94.145.27

🇳🇱 91.92.47.208

🇺🇸 35.225.66.22