JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 139.28.49.119

139.28.49.119 was found in our database!

This IP was reported 35 times. Confidence of Abuse is 77%: ?

77%

ISP	Telecom SY
Usage Type	Fixed Line ISP
ASN	AS216472
Domain Name	highspeed-sy.com
Country	🇸🇾 Syrian Arab Republic
City	Aleppo, Aleppo

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 139.28.49.119

Whois 139.28.49.119

IP Abuse Reports for 139.28.49.119:

This IP address has been reported a total of 35 times from 20 distinct sources. 139.28.49.119 was first reported on March 10th 2026, and the most recent report was 2 days ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇳🇱 Site.eu	2026-07-29 20:03:18 (2 days ago)	Repeated wp-login/xmlrpc attempts	Brute-Force SSH
Anonymous	2026-07-29 07:00:00 (3 days ago)	Automated Apache web application probing in selected 24h window; attempts=114, unique_paths=1, error ... show more Automated Apache web application probing in selected 24h window; attempts=114, unique_paths=1, error_responses=114; targets include WordPress, .env/.git, phpMyAdmin, autodiscover, wpad.dat and related probe paths. show less	Web App Attack
Anonymous	2026-07-29 07:00:00 (3 days ago)	Apache probe; attempts=114; exact paths: /xmlrpc.php	Web App Attack
🇺🇸 TPI-Abuse	2026-07-28 23:02:29 (3 days ago)	(mod_security) mod_security (id:240335) triggered by 139.28.49.119 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:240335) triggered by 139.28.49.119 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jul 28 19:02:23.417313 2026] [security2:error] [pid 3040712:tid 3040712] [client 139.28.49.119:53584] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 139.28.49.119 (+1 hits since last alert)\|semisysteme.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "semisysteme.com"] [uri "/xmlrpc.php"] [unique_id "amk0_yNFZzr147YPku91SwAAAA4"] show less	Brute-Force Bad Web Bot Web App Attack
Anonymous	2026-07-28 22:47:36 (3 days ago)	(wordpress) Failed wordpress login from 139.28.49.119 (TR/Türkiye/-)	Brute-Force
🇮🇹 CoreTech srl	2026-07-28 22:33:56 (3 days ago)	cloudlinux2 fail2ban: 2026-07-29 00:29:43,061 fail2ban.actions [1917]: NOTICE [plesk-modsecu ... show more cloudlinux2 fail2ban: 2026-07-29 00:29:43,061 fail2ban.actions [1917]: NOTICE [plesk-modsecurity] Unban 142.248.80.152cloudlinux2 fail2ban: 2026-07-29 00:30:09,095 fail2ban.filter [1917]: INFO [plesk-modsecurity] Found 139.28.49.119 - 2026-07-29 00:30:08cloudlinux2 fail2ban: 2026-07-29 00:31:43,622 fail2ban.filter [1917]: INFO [plesk-modsecurity] Found 139.28.49.119 - 2026-07-29 00:31:43cloudlinux2 fail2ban: 2026-07-29 00:32:43,149 fail2ban.filter [1917]: INFO [plesk-modsecurity] Found 142.248.80.152 - 2026-07-29 00:32:43cloudlinux2 fail2ban: 2026-07-29 00:32:43,180 fail2ban.filter [1917]: INFO [plesk-modsecurity] Found 142.248.80.152 - 2026-07-29 00:32:43cloudlinux2 fail2ban: 2026-07-29 00:32:43,301 fail2ban.actions [1917]: NOTICE [plesk-modsecurity] Ban 142.248.80.152cloudlinux2 fail2ban: 2026-07-29 00:32:43,307 fail2ban.filter [1917]: INFO [recidive] Found 142.248.80.152 - 2026-07-29 00:32:43cloudlinux2 fail2ban: 2026-07-29 00:32:43,605 show less	Brute-Force
🇫🇮 YF	2026-07-28 22:30:21 (3 days ago)	xmlrpc.php Potential DDoS or brute force	DDoS Attack Brute-Force
🇺🇸 TPI-Abuse	2026-07-28 22:00:16 (3 days ago)	(mod_security) mod_security (id:240335) triggered by 139.28.49.119 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:240335) triggered by 139.28.49.119 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jul 28 18:00:04.910701 2026] [security2:error] [pid 1747796:tid 1747796] [client 139.28.49.119:56606] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 139.28.49.119 (+1 hits since last alert)\|thepercussionworks.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "thepercussionworks.com"] [uri "/xmlrpc.php"] [unique_id "amkmZNLdhGsE6lZ9rabr4QAAABg"] show less	Brute-Force Bad Web Bot Web App Attack
🇩🇪 Admins@FBN	2026-07-26 07:19:08 (5 days ago)	FW-PortScan: Traffic Blocked srcport=39839 dstport=65471	Port Scan
🇦🇺 screwlooseit.com.au	2026-07-23 19:55:03 (1 week ago)	Blocked by CSF 13 firewall - Rule: XMLRPC US/United States/-	Web App Attack
🇩🇪 konseptit	2026-07-21 02:06:10 (1 week ago)	(wordpress) Failed wordpress login from 139.28.49.119 (TR/Türkiye/-)	Brute-Force
🇺🇸 TPI-Abuse	2026-07-21 01:37:50 (1 week ago)	(mod_security) mod_security (id:240335) triggered by 139.28.49.119 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:240335) triggered by 139.28.49.119 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jul 20 21:37:45.894720 2026] [security2:error] [pid 30973:tid 30973] [client 139.28.49.119:0] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 139.28.49.119 (+1 hits since last alert)\|rodrigoaldecoa.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "rodrigoaldecoa.com"] [uri "/xmlrpc.php"] [unique_id "al7NaUhBouZKPaWkpB8NPwAAAA0"] show less	Brute-Force Bad Web Bot Web App Attack
Anonymous	2026-07-18 23:22:04 (1 week ago)	(wordpress) Failed login wp-login.php or xmlrpc.php	Web App Attack
🇫🇷 SpaceHost-Server	2026-07-18 16:30:29 (1 week ago)	139.28.49.119 - - [18/Jul/2026:18:30:08 +0200] "POST /xmlrpc.php HTTP/1.1" 200 6382 "-" "Jetpack by ... show more 139.28.49.119 - - [18/Jul/2026:18:30:08 +0200] "POST /xmlrpc.php HTTP/1.1" 200 6382 "-" "Jetpack by WordPress.com (Jetpack 12.1; WordPress 6.2)" 139.28.49.119 - - [18/Jul/2026:18:30:17 +0200] "POST /xmlrpc.php HTTP/1.1" 200 6382 "-" "WordPress.com; https://wordpress.com" 139.28.49.119 - - [18/Jul/2026:18:30:28 +0200] "POST /xmlrpc.php HTTP/1.1" 200 6382 "-" "WordPress.com; https://wordpress.com" show less	Hacking Web App Attack
🇫🇷 SpaceHost-Server	2026-07-18 16:15:04 (1 week ago)	139.28.49.119 - - [18/Jul/2026:18:14:44 +0200] "POST /xmlrpc.php HTTP/1.1" 200 6382 "-" "Jetpack/12. ... show more 139.28.49.119 - - [18/Jul/2026:18:14:44 +0200] "POST /xmlrpc.php HTTP/1.1" 200 6382 "-" "Jetpack/12.1; WordPress/6.4; http://site40288247.com" 139.28.49.119 - - [18/Jul/2026:18:14:52 +0200] "POST /xmlrpc.php HTTP/1.1" 200 6382 "-" "Jetpack by WordPress.com (Jetpack 12.1; WordPress 6.3)" 139.28.49.119 - - [18/Jul/2026:18:15:03 +0200] "POST /xmlrpc.php HTTP/1.1" 200 6382 "-" "Jetpack/13.0; WordPress/6.3; http://site96352641.com" show less	Hacking Web App Attack

Showing 1 to 15 of 35 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇰🇷 222.109.73.135

🇨🇳 220.202.112.182

🇺🇸 205.210.31.55

🇭🇰 199.45.155.78

🇬🇧 193.32.209.240

🇲🇾 172.197.168.125

🇺🇸 162.216.149.47

🇸🇬 101.32.240.31

🇳🇱 91.92.40.48

🇳🇱 89.21.67.160

🇺🇸 66.132.195.95

🇺🇸 66.132.172.137

🇺🇸 64.62.156.135

🇭🇰 61.244.94.83

🇺🇸 44.208.171.88

🇺🇸 34.228.60.106

🇸🇬 34.142.202.54

🇺🇸 34.133.106.52

🇺🇸 16.147.238.233

🇯🇵 8.216.4.69