JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 49.148.49.158

49.148.49.158 was found in our database!

This IP was reported 41 times. Confidence of Abuse is 49%: ?

49%

ISP	HOME_DSL
Usage Type	Fixed Line ISP
ASN	AS9299
Hostname(s)	dsl.49.148.49.158.pldt.net
Domain Name	pldthome.com
Country	🇵🇭 Philippines
City	Cebu City, Central Visayas

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 49.148.49.158

Whois 49.148.49.158

IP Abuse Reports for 49.148.49.158:

This IP address has been reported a total of 41 times from 22 distinct sources. 49.148.49.158 was first reported on February 8th 2026, and the most recent report was 1 day ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇺🇸 TPI-Abuse	2026-08-14 18:29:35 (1 day ago)	(mod_security) mod_security (id:240335) triggered by 49.148.49.158 (dsl.49.148.49.158.pldt.net): 1 i ... show more (mod_security) mod_security (id:240335) triggered by 49.148.49.158 (dsl.49.148.49.158.pldt.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Aug 14 14:29:30.379010 2026] [security2:error] [pid 1105672:tid 1105672] [client 49.148.49.158:57750] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 49.148.49.158 (+1 hits since last alert)\|newmooncafe.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "newmooncafe.com"] [uri "/xmlrpc.php"] [unique_id "an9eipmp_-Oj4Kyl6odaVQAAAAw"] show less	Brute-Force Bad Web Bot Web App Attack
🇩🇪 ghostwarriors	2026-08-14 15:20:20 (1 day ago)	Webpage scraping	Brute-Force Bad Web Bot Web App Attack
Anonymous	2026-08-14 14:58:49 (1 day ago)	Fail2Ban: WordPress XML-RPC brute-force attack detected.	Bad Web Bot Web App Attack
🇺🇸 kosada.com	2026-08-01 13:04:37 (2 weeks ago)	Web bot: denial-of-service flood	DDoS Attack Bad Web Bot
🇫🇷 SpaceHost-Server	2026-07-07 22:34:47 (1 month ago)		Brute-Force Web App Attack
🇫🇷 francoisunix	2026-07-07 21:04:09 (1 month ago)	49.148.49.158 - - [07/Jul/2026:21:03:24 +0000] "POST /xmlrpc.php HTTP/1.0" 401 415 "-" "Jetpack by W ... show more 49.148.49.158 - - [07/Jul/2026:21:03:24 +0000] "POST /xmlrpc.php HTTP/1.0" 401 415 "-" "Jetpack by WordPress.com (Jetpack 12.1; WordPress 6.1)" 49.148.49.158 - - [07/Jul/2026:21:03:34 +0000] "POST /xmlrpc.php HTTP/1.0" 401 415 "-" "Jetpack/13.0; WordPress/6.4; http://site69273888.com" 49.148.49.158 - - [07/Jul/2026:21:03:45 +0000] "POST /xmlrpc.php HTTP/1.0" 401 415 "-" "WordPress.com; https://wordpress.com" 49.148.49.158 - - [07/Jul/2026:21:03:56 +0000] "POST /xmlrpc.php HTTP/1.0" 401 415 "-" "Jetpack by WordPress.com (Jetpack 12.0; WordPress 6.2)" 49.148.49.158 - - [07/Jul/2026:21:04:07 +0000] "POST /xmlrpc.php HTTP/1.0" 401 415 "-" "Jetpack/13.0; WordPress/6.4; http://site26560054.com" ... show less	Web App Attack
🇺🇸 TPI-Abuse	2026-07-07 18:32:29 (1 month ago)	(mod_security) mod_security (id:240335) triggered by 49.148.49.158 (dsl.49.148.49.158.pldt.net): 1 i ... show more (mod_security) mod_security (id:240335) triggered by 49.148.49.158 (dsl.49.148.49.158.pldt.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jul 07 14:32:23.621414 2026] [security2:error] [pid 6560:tid 6560] [client 49.148.49.158:63415] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 49.148.49.158 (+1 hits since last alert)\|lusineweb.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "lusineweb.com"] [uri "/xmlrpc.php"] [unique_id "ak1GN4mLXLrRYnzNfzmnkAAAAA8"] show less	Brute-Force Bad Web Bot Web App Attack
🇫🇷 dynamix	2026-07-07 14:22:39 (1 month ago)	WordPress XMLRPC Brute Force Attack	Brute-Force Web App Attack
🇺🇸 TPI-Abuse	2026-07-06 20:40:59 (1 month ago)	(mod_security) mod_security (id:240335) triggered by 49.148.49.158 (dsl.49.148.49.158.pldt.net): 1 i ... show more (mod_security) mod_security (id:240335) triggered by 49.148.49.158 (dsl.49.148.49.158.pldt.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jul 06 16:40:51.809342 2026] [security2:error] [pid 4883:tid 4897] [client 49.148.49.158:52042] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 49.148.49.158 (+1 hits since last alert)\|georgementz.org\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "georgementz.org"] [uri "/xmlrpc.php"] [unique_id "akwS0xpK1bKXeb3NmouwRwAAAAw"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-07-06 20:12:17 (1 month ago)	(mod_security) mod_security (id:240335) triggered by 49.148.49.158 (dsl.49.148.49.158.pldt.net): 1 i ... show more (mod_security) mod_security (id:240335) triggered by 49.148.49.158 (dsl.49.148.49.158.pldt.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jul 06 16:12:11.927962 2026] [security2:error] [pid 13327:tid 13327] [client 49.148.49.158:54500] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 49.148.49.158 (+1 hits since last alert)\|opticasprisma.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "opticasprisma.com"] [uri "/xmlrpc.php"] [unique_id "akwMG53r4dxfjVYWjGJnEQAAAAE"] show less	Brute-Force Bad Web Bot Web App Attack
🇦🇺 screwlooseit.com.au	2026-07-03 17:01:38 (1 month ago)	Blocked by CSF 13 firewall - Rule: XMLRPC PH/Philippines/dsl.49.148.49.158.pldt.net	Web App Attack
🇲🇾 Rizzy	2026-07-02 19:57:03 (1 month ago)	Multiple WAF Violations	Brute-Force Web App Attack
🇺🇸 TPI-Abuse	2026-07-02 19:00:49 (1 month ago)	(mod_security) mod_security (id:240335) triggered by 49.148.49.158 (dsl.49.148.49.158.pldt.net): 1 i ... show more (mod_security) mod_security (id:240335) triggered by 49.148.49.158 (dsl.49.148.49.158.pldt.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jul 02 15:00:41.849257 2026] [security2:error] [pid 32573:tid 32573] [client 49.148.49.158:61571] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 49.148.49.158 (+1 hits since last alert)\|yanlidesign.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "yanlidesign.com"] [uri "/xmlrpc.php"] [unique_id "aka1WY5QQ71Y7x4dI9fajQAAAAc"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-07-02 17:56:56 (1 month ago)	(mod_security) mod_security (id:240335) triggered by 49.148.49.158 (dsl.49.148.49.158.pldt.net): 1 i ... show more (mod_security) mod_security (id:240335) triggered by 49.148.49.158 (dsl.49.148.49.158.pldt.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jul 02 13:56:49.913603 2026] [security2:error] [pid 28461:tid 28475] [client 49.148.49.158:35173] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 49.148.49.158 (+1 hits since last alert)\|northtexaslive.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "northtexaslive.com"] [uri "/xmlrpc.php"] [unique_id "akamYegeXwvP-kOwcQ--5wAAAQw"] show less	Brute-Force Bad Web Bot Web App Attack
🇳🇱 Site.eu	2026-07-01 17:16:22 (1 month ago)	Repeated wp-login/xmlrpc attempts	Brute-Force SSH

Showing 1 to 15 of 41 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇺🇸 205.210.31.60

🇹🇼 198.235.24.127

🇩🇪 167.94.145.21

🇮🇳 43.254.215.33

🇺🇸 172.69.22.76

🇩🇪 130.12.180.107

🇰🇷 121.140.163.62

🇨🇳 118.249.81.194

🇵🇭 112.201.163.83

🇯🇵 103.147.14.125

🇺🇸 66.132.172.243

🇨🇳 59.51.148.223

🇬🇧 35.203.210.153

🇨🇭 20.203.138.185

🇨🇴 201.184.50.251

🇨🇦 178.128.236.207

🇺🇸 165.154.134.203

🇫🇮 147.185.133.227

🇮🇩 103.125.103.201

🇺🇸 64.62.197.221