Total reports
9 from
8 distinct
reporters
First reported
January 29th 2025
Most recent report
4 days ago
Last 60 days
Top reporter locations
๐ซ๐ฎ
Finland
1
๐บ๐ธ
United States of America
1
Most common categories
Bad Web Bot
1
DDoS Attack
1
Brute-Force
1
Web App Attack
1
Recent reports
We have received reports of abusive activity from this IP address within the last week. It is
potentially still actively engaged in abusive activities.
Reporter
IoA Timestamp (UTC)
Comment
Categories
๐บ๐ธ
TPI-Abuse
2026-10-24 06:54:57
(4 days ago)
(mod_security) mod_security (id:225170) triggered by 94.249.48.206 (94.249.x.206.go.com.jo): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 24 02:54:50.259681 2026] [security2:error] [pid 14047:tid 14047] [client 9 ...
show more
(mod_security) mod_security (id:225170) triggered by 94.249.48.206 (94.249.x.206.go.com.jo): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 24 02:54:50.259681 2026] [security2:error] [pid 14047:tid 14047] [client 94.249.48.206:10852] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||plazahacienda.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "plazahacienda.com"] [uri "/wp/wp-json/wp/v2/users"] [unique_id "atxWOpUD1Y7YrlUjwseALAAAAAI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
๐ซ๐ฎ
pavel Karpenko
2026-10-18 09:34:22
(1 week ago)
94.249.48.206 - - [18/Oct/2026:09:34:22 +0000] "GET /transfer/?company=Mofet+Institute&company_country=IL&country=IL&lang=de&months=12&scope=ripe_from&share=1dc568865d0c727d&view=company HTTP/1.1" 401 641 "https://ultralir.com" "Mozilla/5.0 (Windows ...
show more
94.249.48.206 - - [18/Oct/2026:09:34:22 +0000] "GET /transfer/?company=Mofet+Institute&company_country=IL&country=IL&lang=de&months=12&scope=ripe_from&share=1dc568865d0c727d&view=company HTTP/1.1" 401 641 "https://ultralir.com" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36" client_port=21477 server_port=443 rt=0.000 urt=- transfer_entry=- server_addr=85.137.24.2 epoch=1792316062.333 visitor_cookie=0
show less
DDoS Attack
๐บ๐ธ
้ฌผๅฝฑ233
2026-08-22 22:55:49
(2 months ago)
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Bad Web Bot
๐ฉ๐ช
pltcldvlpr
2026-06-19 19:39:08
(4 months ago)
Bogus Useragent: 94.249.48.206 - - [19/Jun/2026:21:39:07 +0200] "GET /protocol?id=sh_18_34¶graph=12463925&seq=1434 HTTP/1.1" 444 0 "-" "Opera/8.22.(Windows NT 5.1; hne-IN) Presto/2.9.169 Version/11.00" asn=8376 org="Jordan Data Communications Com ...
show more
Bogus Useragent: 94.249.48.206 - - [19/Jun/2026:21:39:07 +0200] "GET /protocol?id=sh_18_34¶graph=12463925&seq=1434 HTTP/1.1" 444 0 "-" "Opera/8.22.(Windows NT 5.1; hne-IN) Presto/2.9.169 Version/11.00" asn=8376 org="Jordan Data Communications Company LLC" country=JO
...
show less
Bad Web Bot
2025-12-14 22:27:18
(10 months ago)
botnet
DDoS Attack
2025-11-17 21:25:55
(11 months ago)
scanning http requests from known botnet
Web App Attack
๐ฎ๐น
Markus S.
2025-07-30 12:00:00
(1 year ago)
ddos on webshop
DDoS Attack
2025-07-01 15:39:51
(1 year ago)
Unauthorized connection attempt
Port Scan
Hacking
Exploited Host
๐ฒ๐พ
syokadmin
2025-01-29 10:28:12
(1 year ago)
(cpanel) Failed cPanel login from 94.249.48.206 (JO/Jordan/94.249.x.206.go.com.jo): 1 in the last 3600 secs
Brute-Force
Web App Attack
