JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 49.37.35.215

49.37.35.215 was found in our database!

This IP was reported 38 times. Confidence of Abuse is 88%: ?

88%

ISP	Reliance Jio Infocomm Limited
Usage Type	Fixed Line ISP
ASN	AS55836
Domain Name	jio.com
Country	🇮🇳 India
City	Kolkata, West Bengal

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 49.37.35.215

Whois 49.37.35.215

IP Abuse Reports for 49.37.35.215:

This IP address has been reported a total of 38 times from 26 distinct sources. 49.37.35.215 was first reported on August 24th 2021, and the most recent report was 4 hours ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇳🇿 Tripwire	2026-08-21 18:44:11 (4 hours ago)	Probing for Wordpress - /xmlrpc.php	Brute-Force Web App Attack
🇺🇸 TPI-Abuse	2026-08-20 20:27:48 (1 day ago)	(mod_security) mod_security (id:225170) triggered by 49.37.35.215 (-): 1 in the last 300 secs; Ports ... show more (mod_security) mod_security (id:225170) triggered by 49.37.35.215 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Aug 20 16:27:38.033693 2026] [security2:error] [pid 19147:tid 19147] [client 49.37.35.215:58744] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)\|\|cartiologyfilms.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "cartiologyfilms.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aodjOmFFc6drROYYmFui7QAAAAY"] show less	Brute-Force Bad Web Bot Web App Attack
🇩🇪 ghostwarriors	2026-08-20 16:50:30 (1 day ago)	Webpage scraping	Brute-Force Bad Web Bot Web App Attack
Anonymous	2026-08-20 16:33:52 (1 day ago)	Fail2Ban: WordPress XML-RPC brute-force attack detected.	Bad Web Bot Web App Attack
🇫🇷 ELYAZ	2026-08-20 16:23:27 (1 day ago)	(wordpress) Failed wordpress login from 49.37.35.215 (IN/India/-): (CF_ENABLE)	Brute-Force
🇦🇺 FireGuard Server	2026-08-19 19:15:05 (2 days ago)	Blocked by os-abuseipdb; 3 hits, proto=tcp, ports=443	Port Scan Hacking
🇳🇱 tr1n	2026-08-19 18:45:30 (2 days ago)	Triggered Cloudflare WAF (firewallCustom) from IN. Action: MANAGED_CHALLENGE \| ASN: 55836 (Reliance ... show more Triggered Cloudflare WAF (firewallCustom) from IN. Action: MANAGED_CHALLENGE \| ASN: 55836 (Reliance Jio Infocomm Limited) \| Protocol: HTTP/1.1 (POST) \| Endpoint: /xmlrpc.php \| Timestamp: 2026-08-19T18:45:30Z \| UA: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7; x64) AppleWebKit/537.36 (KHTML, like Gecko) Safari/11.0.0.0 Safari/537.36 show less	Bad Web Bot
🇺🇸 TPI-Abuse	2026-08-19 18:00:59 (2 days ago)	(mod_security) mod_security (id:225170) triggered by 49.37.35.215 (-): 1 in the last 300 secs; Ports ... show more (mod_security) mod_security (id:225170) triggered by 49.37.35.215 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Aug 19 14:00:47.142353 2026] [security2:error] [pid 8691:tid 8796] [client 49.37.35.215:55239] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)\|\|sweeneyzone.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "sweeneyzone.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aoXvT4TEUT-tS21PApL7zQAAAZY"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 lostswordfish.com	2026-08-19 07:48:03 (2 days ago)	Wordfence waf block on baystatereentrynetwork	Web App Attack
🇺🇸 WeekendWeb	2026-08-17 12:25:21 (4 days ago)	Wordpress Vunerability attack	Web App Attack
🇺🇸 SX Communications	2026-08-11 22:36:18 (1 week ago)	Web vulnerability scanning / probing from 49.37.35.215: automated requests for CMS admin paths, logi ... show more Web vulnerability scanning / probing from 49.37.35.215: automated requests for CMS admin paths, login endpoints, xmlrpc, and common scanner fingerprints over HTTPS. 1 hits; paths: /xmlrpc.php. show less	Port Scan Hacking Web App Attack
🇺🇸 TPI-Abuse	2026-08-10 19:37:38 (1 week ago)	(mod_security) mod_security (id:225170) triggered by 49.37.35.215 (-): 1 in the last 300 secs; Ports ... show more (mod_security) mod_security (id:225170) triggered by 49.37.35.215 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Aug 10 15:37:25.540769 2026] [security2:error] [pid 2324662:tid 2324662] [client 49.37.35.215:54361] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)\|\|hotpay.co\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "hotpay.co"] [uri "/wp-json/wp/v2/users"] [unique_id "anoodYhKXpbebIfMI0i1GAAAAAg"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-08-10 16:55:30 (1 week ago)	(mod_security) mod_security (id:225170) triggered by 49.37.35.215 (-): 1 in the last 300 secs; Ports ... show more (mod_security) mod_security (id:225170) triggered by 49.37.35.215 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Aug 10 12:55:17.882444 2026] [security2:error] [pid 1167800:tid 1167800] [client 49.37.35.215:63598] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)\|\|fireteam.faith\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "fireteam.faith"] [uri "/wp-json/wp/v2/users"] [unique_id "anoCdRZQPZuFR8tXxRNxZAAAAAs"] show less	Brute-Force Bad Web Bot Web App Attack
🇩🇪 pscriptos	2026-08-10 11:26:59 (1 week ago)	{"ClientAddr":"49.37.35.215:63898","ClientHost":"49.37.35.215","ClientPort":"63898","ClientUsername" ... show more {"ClientAddr":"49.37.35.215:63898","ClientHost":"49.37.35.215","ClientPort":"63898","ClientUsername":"-","DownstreamContentSize":418,"DownstreamStatus":403,"Duration":421711507,"OriginContentSize":418,"OriginDuration":418535136,"OriginStatus":403,"Overhead":3176371,"RequestAddr":"www.cleveradmin.de","RequestContentSize":684,"RequestCount":3389867,"RequestHost":"www.cleveradmin.de","RequestMethod":"POST","RequestPath":"/xmlrpc.php","RequestPort":"-","RequestProtocol":"HTTP/1.1","RequestScheme":"https","RetryAttempts":0,"RouterName":"cleveradmin-www-websecure@file","ServiceAddr":"172.16.80.10:80","ServiceName":"cleveradmin-www@file","ServiceURL":"http://172.16.80.10:80","StartLocal":"2026-08-10T13:26:52.648367142+02:00","StartUTC":"2026-08-10T11:26:52.648367142Z","TLSCipher":"TLS_AES_128_GCM_SHA256","TLSVersion":"1.3","entryPointName":"websecure","level":"info","msg":"","time":"2026-08-10T13:26:53+02:00"} {"ClientAddr":"49.37.35.215:57337","ClientHost":"49.37.35.215","ClientPort":"57337" ... show less	Brute-Force Web App Attack
🇩🇪 pscriptos	2026-08-08 21:05:20 (1 week ago)	{"ClientAddr":"49.37.35.215:62882","ClientHost":"49.37.35.215","ClientPort":"62882","ClientUsername" ... show more {"ClientAddr":"49.37.35.215:62882","ClientHost":"49.37.35.215","ClientPort":"62882","ClientUsername":"-","DownstreamContentSize":418,"DownstreamStatus":403,"Duration":176431500,"OriginContentSize":418,"OriginDuration":171143198,"OriginStatus":403,"Overhead":5288302,"RequestAddr":"www.cleveradmin.de","RequestContentSize":684,"RequestCount":3250892,"RequestHost":"www.cleveradmin.de","RequestMethod":"POST","RequestPath":"/xmlrpc.php","RequestPort":"-","RequestProtocol":"HTTP/1.1","RequestScheme":"https","RetryAttempts":0,"RouterName":"cleveradmin-www-websecure@file","ServiceAddr":"172.16.80.10:80","ServiceName":"cleveradmin-www@file","ServiceURL":"http://172.16.80.10:80","StartLocal":"2026-08-08T23:04:38.046234709+02:00","StartUTC":"2026-08-08T21:04:38.046234709Z","TLSCipher":"TLS_AES_128_GCM_SHA256","TLSVersion":"1.3","entryPointName":"websecure","level":"info","msg":"","time":"2026-08-08T23:04:38+02:00"} {"ClientAddr":"49.37.35.215:62882","ClientHost":"49.37.35.215","ClientPort":"62882" ... show less	Brute-Force Web App Attack

Showing 1 to 15 of 38 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇺🇸 216.180.246.104

🇧🇷 187.8.120.90

🇺🇸 45.194.67.29

🇺🇸 172.253.213.19

🇨🇳 124.222.61.85

🇨🇻 102.213.207.76

🇸🇪 56.228.14.237

🇧🇷 18.230.117.170

🇨🇦 4.204.200.136

🇺🇸 3.15.1.40

🇺🇸 216.180.246.149

🇭🇰 199.45.155.57

🇸🇪 193.189.100.201

🇷🇴 193.46.255.86

🇹🇷 176.235.99.16

🇦🇷 153.67.13.155

🇺🇿 95.130.227.14

🇲🇩 94.176.78.239

🇷🇴 92.118.39.233

🇺🇸 74.114.29.26