JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 61.79.249.128

61.79.249.128 was found in our database!

This IP was reported 57 times. Confidence of Abuse is 0%: ?

ISP	Korea Telecom
Usage Type	Fixed Line ISP
ASN	AS4766
Domain Name	kt.com
Country	🇰🇷 Korea (the Republic of)
City	Incheon, Incheon

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 61.79.249.128

Whois 61.79.249.128

IP Abuse Reports for 61.79.249.128:

This IP address has been reported a total of 57 times from 27 distinct sources. 61.79.249.128 was first reported on September 3rd 2025, and the most recent report was 6 months ago.

Old Reports: The most recent abuse report for this IP address is from 6 months ago . It is possible that this IP is no longer involved in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇦🇺 screwlooseit.com.au	2025-11-08 07:14:41 (6 months ago)	Blocked by CSF 13 firewall - Rule: WPLOGIN KR/South Korea/-	Web App Attack
🇺🇸 TPI-Abuse	2025-11-07 21:10:41 (6 months ago)	(mod_security) mod_security (id:225170) triggered by 61.79.249.128 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:225170) triggered by 61.79.249.128 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 07 16:10:35.459513 2025] [security2:error] [pid 9020:tid 9020] [client 61.79.249.128:53005] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)\|\|saadeh.ws\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "saadeh.ws"] [uri "/wp-json/wp/v2/users/"] [unique_id "aQ5gS2DytswTOR7F1ipengAAAA8"], referer: https://saadeh.ws/wp-json/wp/v2/users/ show less	Brute-Force Bad Web Bot Web App Attack
🇳🇱 maxxsense	2025-11-07 20:25:40 (6 months ago)	(wordpress) Failed wordpress login from 61.79.249.128 (KR/South Korea/-)	Brute-Force
🇺🇸 TPI-Abuse	2025-11-07 12:43:58 (6 months ago)	(mod_security) mod_security (id:225170) triggered by 61.79.249.128 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:225170) triggered by 61.79.249.128 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 07 07:43:50.296478 2025] [security2:error] [pid 17864:tid 17864] [client 61.79.249.128:35359] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)\|\|blindshine.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "blindshine.com"] [uri "/wp-json/wp/v2/users/"] [unique_id "aQ3phvt2pN8LwZUFMLFkYgAAAA0"], referer: https://blindshine.com/wp-json/wp/v2/users/ show less	Brute-Force Bad Web Bot Web App Attack
🇲🇾 syokadmin	2025-11-03 10:45:58 (7 months ago)	(PERMBLOCK) 61.79.249.128 (KR/South Korea/-) has had more than 2 temp blocks in the last 86400 secs	Brute-Force
🇺🇸 TPI-Abuse	2025-11-02 23:23:45 (7 months ago)	(mod_security) mod_security (id:225170) triggered by 61.79.249.128 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:225170) triggered by 61.79.249.128 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 02 18:23:38.100088 2025] [security2:error] [pid 28535:tid 28535] [client 61.79.249.128:51811] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)\|\|impressionsinthread.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "impressionsinthread.com"] [uri "/wp-json/wp/v2/users/"] [unique_id "aQfn-sUEbRSKUVvsmogF_QAAAAQ"], referer: https://impressionsinthread.com/wp-json/wp/v2/users/ show less	Brute-Force Bad Web Bot Web App Attack
🇲🇾 syokadmin	2025-11-02 20:40:51 (7 months ago)	61.79.249.128 (KR/South Korea/-), 2 distributed smtpauth attacks on account [[email protected]] in ... show more 61.79.249.128 (KR/South Korea/-), 2 distributed smtpauth attacks on account [[email protected]] in the last 3600 secs show less	Brute-Force
🇲🇾 syokadmin	2025-11-01 13:58:08 (7 months ago)	61.79.249.128 (KR/South Korea/-), 2 distributed smtpauth attacks on account [[email protected]] in ... show more 61.79.249.128 (KR/South Korea/-), 2 distributed smtpauth attacks on account [[email protected]] in the last 3600 secs show less	Brute-Force
🇺🇸 TPI-Abuse	2025-10-30 23:15:33 (7 months ago)	(mod_security) mod_security (id:225170) triggered by 61.79.249.128 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:225170) triggered by 61.79.249.128 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 30 19:15:26.889453 2025] [security2:error] [pid 20809:tid 20845] [client 61.79.249.128:38559] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)\|\|sallykimmel.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "sallykimmel.com"] [uri "/wp-json/wp/v2/users/"] [unique_id "aQPxjlR-Ri1yCmtK3-25PgAAANM"], referer: https://sallykimmel.com/wp-json/wp/v2/users/ show less	Brute-Force Bad Web Bot Web App Attack
🇲🇾 syokadmin	2025-10-30 22:35:03 (7 months ago)	61.79.249.128 (KR/South Korea/-), 3 distributed smtpauth attacks on account [[email protected]] in ... show more 61.79.249.128 (KR/South Korea/-), 3 distributed smtpauth attacks on account [[email protected]] in the last 3600 secs show less	Brute-Force
🇺🇸 TPI-Abuse	2025-10-28 02:42:38 (7 months ago)	(mod_security) mod_security (id:225170) triggered by 61.79.249.128 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:225170) triggered by 61.79.249.128 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Oct 27 22:42:32.131398 2025] [security2:error] [pid 2106:tid 2106] [client 61.79.249.128:45409] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)\|\|staben.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "staben.com"] [uri "/wp-json/wp/v2/users/"] [unique_id "aQAtmCU5t1-k02DZ0zA3vwAAAAs"], referer: https://staben.com/wp-json/wp/v2/users/ show less	Brute-Force Bad Web Bot Web App Attack
🇲🇾 syokadmin	2025-10-27 23:33:07 (7 months ago)	61.79.249.128 (KR/South Korea/-), 2 distributed smtpauth attacks on account [[email protected]] in ... show more 61.79.249.128 (KR/South Korea/-), 2 distributed smtpauth attacks on account [[email protected]] in the last 3600 secs show less	Brute-Force
🇲🇾 syokadmin	2025-10-21 03:11:09 (7 months ago)	61.79.249.128 (KR/South Korea/-), 5 distributed SMTP Logins on account [[email protected]] in the ... show more 61.79.249.128 (KR/South Korea/-), 5 distributed SMTP Logins on account [[email protected]] in the last 300 secs show less	Brute-Force
🇩🇪 F242	2025-10-18 18:41:40 (7 months ago)	Wordpress Login or XMLRPC abuse	Web App Attack
🇲🇾 syokadmin	2025-10-16 09:46:16 (7 months ago)	61.79.249.128 (KR/South Korea/-), 2 distributed smtpauth attacks on account [[email protected]] in ... show more 61.79.249.128 (KR/South Korea/-), 2 distributed smtpauth attacks on account [[email protected]] in the last 3600 secs show less	Brute-Force

Showing 1 to 15 of 57 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇨🇴 167.0.112.66

🇭🇰 152.32.254.89

🇵🇰 111.68.107.91

🇷🇺 85.93.49.154

🇺🇸 45.156.129.77

🇮🇩 39.194.2.115

🇺🇸 20.169.107.169

🇲🇽 201.103.252.95

🇦🇷 190.221.50.123

🇨🇳 124.174.86.183

🇮🇩 103.125.103.201

🇯🇵 60.95.227.25

🇮🇳 49.248.223.6

🇲🇾 47.250.123.22

🇨🇳 14.103.102.130

🇳🇱 4.210.177.128

🇳🇱 185.226.197.15

🇮🇳 103.133.30.93

🇻🇳 45.251.114.164

🇺🇸 18.225.109.243