JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 49.200.231.98

49.200.231.98 was found in our database!

This IP was reported 32 times. Confidence of Abuse is 93%: ?

93%

ISP	Tata Teleservices Limited -GSM Division
Usage Type	Fixed Line ISP
ASN	AS45820
Domain Name	tatatel.co.in
Country	🇮🇳 India
City	Ahmedabad, Gujarat

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 49.200.231.98

Whois 49.200.231.98

IP Abuse Reports for 49.200.231.98:

This IP address has been reported a total of 32 times from 19 distinct sources. 49.200.231.98 was first reported on June 12th 2026, and the most recent report was 6 hours ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇺🇸 TPI-Abuse	2026-07-14 09:59:09 (6 hours ago)	(mod_security) mod_security (id:240335) triggered by 49.200.231.98 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:240335) triggered by 49.200.231.98 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jul 14 05:59:03.787631 2026] [security2:error] [pid 16060:tid 16060] [client 49.200.231.98:0] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 49.200.231.98 (+1 hits since last alert)\|pixacast.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "pixacast.com"] [uri "/xmlrpc.php"] [unique_id "alYIZ4GdBJCI3uMj8JHiVwAAABU"] show less	Brute-Force Bad Web Bot Web App Attack
🇧🇪 cmbplf	2026-07-14 07:11:58 (9 hours ago)	3.567 requests from abuseipdb.com blacklisted IP (9mos2w4d)	Brute-Force Bad Web Bot
🇺🇸 TPI-Abuse	2026-07-13 09:03:49 (1 day ago)	(mod_security) mod_security (id:240335) triggered by 49.200.231.98 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:240335) triggered by 49.200.231.98 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jul 13 05:03:44.550625 2026] [security2:error] [pid 12636:tid 12636] [client 49.200.231.98:61708] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 49.200.231.98 (+1 hits since last alert)\|edmestonfd.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "edmestonfd.com"] [uri "/xmlrpc.php"] [unique_id "alSp8IsTlhM4G8dSZptiQQAAAAo"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 n2nguyenn2nguyen	2026-07-13 07:47:54 (1 day ago)	Blocked by YFC Security on https://fencingforward.com — type: xmlrpc_attempts	Brute-Force Web App Attack
🇺🇸 TPI-Abuse	2026-07-13 06:13:45 (1 day ago)	(mod_security) mod_security (id:240335) triggered by 49.200.231.98 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:240335) triggered by 49.200.231.98 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jul 13 02:13:37.442808 2026] [security2:error] [pid 21417:tid 21417] [client 49.200.231.98:52026] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 49.200.231.98 (+1 hits since last alert)\|konahawaiirealty.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "konahawaiirealty.com"] [uri "/xmlrpc.php"] [unique_id "alSCERmf_7qkWsp1PtwDtwAAABQ"] show less	Brute-Force Bad Web Bot Web App Attack
🇬🇧 Apache	2026-07-12 11:12:35 (2 days ago)	(mod_security) mod_security (id:240335) triggered by 49.200.231.98 (IN/India/-): 5 in the last 300 s ... show more (mod_security) mod_security (id:240335) triggered by 49.200.231.98 (IN/India/-): 5 in the last 300 secs show less	Brute-Force Web App Attack
🇺🇸 TAY	2026-07-12 08:03:58 (2 days ago)	49.200.231.98 - - [12/Jul/2026:16:03:36 +0800] "POST /xmlrpc.php HTTP/1.1" 200 5935 "-" "Jetpack/13. ... show more 49.200.231.98 - - [12/Jul/2026:16:03:36 +0800] "POST /xmlrpc.php HTTP/1.1" 200 5935 "-" "Jetpack/13.0; WordPress/6.4; http://site16408591.com" 49.200.231.98 - - [12/Jul/2026:16:03:46 +0800] "POST /xmlrpc.php HTTP/1.1" 200 5935 "-" "Jetpack by WordPress.com" 49.200.231.98 - - [12/Jul/2026:16:03:57 +0800] "POST /xmlrpc.php HTTP/1.1" 200 5935 "-" "Jetpack/13.0; WordPress/6.3; http://site10658537.com" ... show less	Brute-Force
🇳🇱 debestelapp	2026-07-11 13:00:04 (3 days ago)		Web App Attack
🇫🇷 dynamix	2026-07-11 09:00:59 (3 days ago)	WordPress XMLRPC Brute Force Attack	Brute-Force Web App Attack
🇩🇪 ger-stg-sifi1	2026-07-11 07:28:00 (3 days ago)	(wordpress) Failed wordpress login using wp-login.php or xmlrpc.php	Web App Attack
🇫🇷 SpaceHost-Server	2026-07-11 07:01:54 (3 days ago)	49.200.231.98 - - [11/Jul/2026:09:01:32 +0200] "POST /xmlrpc.php HTTP/1.1" 200 6382 "-" "WordPress.c ... show more 49.200.231.98 - - [11/Jul/2026:09:01:32 +0200] "POST /xmlrpc.php HTTP/1.1" 200 6382 "-" "WordPress.com; https://wordpress.com" 49.200.231.98 - - [11/Jul/2026:09:01:42 +0200] "POST /xmlrpc.php HTTP/1.1" 200 6382 "-" "Jetpack by WordPress.com (Jetpack 12.0; WordPress 6.1)" 49.200.231.98 - - [11/Jul/2026:09:01:53 +0200] "POST /xmlrpc.php HTTP/1.1" 200 6382 "-" "Jetpack by WordPress.com (Jetpack 12.1; WordPress 6.2)" show less	Hacking Web App Attack
🇫🇷 SpaceHost-Server	2026-07-11 06:46:33 (3 days ago)	49.200.231.98 - - [11/Jul/2026:08:46:11 +0200] "POST /xmlrpc.php HTTP/1.1" 200 6382 "-" "Jetpack by ... show more 49.200.231.98 - - [11/Jul/2026:08:46:11 +0200] "POST /xmlrpc.php HTTP/1.1" 200 6382 "-" "Jetpack by WordPress.com" 49.200.231.98 - - [11/Jul/2026:08:46:21 +0200] "POST /xmlrpc.php HTTP/1.1" 200 6382 "-" "Jetpack by WordPress.com" 49.200.231.98 - - [11/Jul/2026:08:46:32 +0200] "POST /xmlrpc.php HTTP/1.1" 200 6382 "-" "Jetpack by WordPress.com (Jetpack 13.0; WordPress 6.2)" show less	Hacking Web App Attack
🇩🇪 rh24	2026-07-10 12:31:04 (4 days ago)	(wordpress) Failed wordpress login from 49.200.231.98 (IN/India/-): (CF_ENABLE)	Brute-Force
🇩🇪 neckaralb-admin.de	2026-07-10 09:13:27 (4 days ago)	(wordpress) Failed login wp-login.php or xmlrpc.php	Web App Attack
🇱🇻 garmtech.com	2026-07-10 07:27:40 (4 days ago)	IM360 WAF: Rate limit exceeded for XMLRPC DoS (fault code)	Web App Attack

Showing 1 to 15 of 32 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇺🇸 44.232.138.147

🇨🇳 39.105.231.103

🇮🇳 2405:201:a002:786e:ac80:6450:96d:3397

🇬🇧 154.16.44.106

🇨🇭 107.189.8.181

🇺🇸 100.29.192.64

🇺🇸 66.240.223.208

🇺🇸 44.134.176.200

🇬🇧 5.181.124.187

🇺🇸 194.180.233.205

🇺🇸 132.145.208.89

🇮🇪 52.215.222.180

🇺🇸 43.173.70.125

🇻🇳 14.228.89.81

🇷🇴 2.57.121.112

🇯🇵 203.25.124.149

🇩🇪 185.242.3.198

🇧🇩 157.15.23.247

🇫🇷 143.244.57.121

🇮🇩 114.141.59.195