JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 139.47.117.20

139.47.117.20 was found in our database!

This IP was reported 24 times. Confidence of Abuse is 90%: ?

90%

ISP	Xtra Telecom S.A.
Usage Type	Fixed Line ISP
ASN	AS15704
Hostname(s)	static.masmovil.com
Domain Name	xtratelecom.es
Country	🇪🇸 Spain
City	Barcelona, Catalonia

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 139.47.117.20

Whois 139.47.117.20

IP Abuse Reports for 139.47.117.20:

This IP address has been reported a total of 24 times from 19 distinct sources. 139.47.117.20 was first reported on July 7th 2026, and the most recent report was 6 days ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇨🇭 4server	2026-07-11 19:25:06 (6 days ago)	[SatJul1121:25:03.7552812026][security2:error][pid2845804:tid2846049][client139.47.117.20:0]ModSecur ... show more [SatJul1121:25:03.7552812026][security2:error][pid2845804:tid2846049][client139.47.117.20:0]ModSecurity:Accessdeniedwithcode403\(phase1\).Stringmatch\"/xmlrpc.php\"atREQUEST_URI.[file\"/etc/apache2/conf.d/modsec_custom_rules.conf\"][line\"368\"][id\"960024\"][msg\"XML-RPCdisabled\"][hostname\"aidconsultancy.ch\"][uri\"/xmlrpc.php\"][unique_id\"alKYj_dWxVyqxAvRHtZdngAAAMo\"] show less	Hacking Web App Attack
🇨🇦 Dunham Support	2026-07-11 16:34:42 (1 week ago)	(wordpress) Failed wordpress login from 139.47.117.20 (ES/Spain/static.masmovil.com)	Brute-Force
🇫🇮 inlink.ltd	2026-07-11 11:54:42 (1 week ago)	Known malicious PHP file or CMS probe	Web App Attack
🇩🇪 4server	2026-07-11 09:54:24 (1 week ago)	[SatJul1111:54:20.7333592026][security2:error][pid2444776:tid2444897][client139.47.117.20:0]ModSecur ... show more [SatJul1111:54:20.7333592026][security2:error][pid2444776:tid2444897][client139.47.117.20:0]ModSecurity:Accessdeniedwithcode403\(phase1\).Stringmatch\"/xmlrpc.php\"atREQUEST_URI.[file\"/etc/apache2/conf.d/modsec_custom_rules.conf\"][line\"170\"][id\"960024\"][msg\"XML-RPCdisabled\"][hostname\"morandi-trasporti.ch\"][uri\"/xmlrpc.php\"][unique_id\"alISzMEgXXOnhPy9SZEUTwAAAM8\"] show less	Port Scan Brute-Force Web App Attack
🇳🇱 Site.eu	2026-07-11 03:34:01 (1 week ago)	Repeated wp-login/xmlrpc attempts	Brute-Force SSH
🇺🇸 TPI-Abuse	2026-07-11 02:58:54 (1 week ago)	(mod_security) mod_security (id:225170) triggered by 139.47.117.20 (static.masmovil.com): 1 in the l ... show more (mod_security) mod_security (id:225170) triggered by 139.47.117.20 (static.masmovil.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jul 10 22:58:47.633254 2026] [security2:error] [pid 8203:tid 8285] [client 139.47.117.20:35518] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)\|\|dontbeajerklikeyourwork.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "dontbeajerklikeyourwork.com"] [uri "/wp-json/wp/v2/users"] [unique_id "alGxZzgc41CEDJUU3chHugAAABY"] show less	Brute-Force Bad Web Bot Web App Attack
🇩🇪 ISPLtd	2026-07-10 17:49:41 (1 week ago)	139.47.117.20 [10/Jul/2026:14:49:39 -0300] victaxes.ca:443 URL:/xmlrpc.php "POST /xmlrpc.php 139.47. ... show more 139.47.117.20 [10/Jul/2026:14:49:39 -0300] victaxes.ca:443 URL:/xmlrpc.php "POST /xmlrpc.php 139.47.117.20 [10/Jul/2026:14:49:40 -0300] victaxes.com:443 URL:/xmlrpc.php "POST /xmlrpc.php ... show less	Hacking Web App Attack
🇩🇪 iNetWorker	2026-07-10 15:15:41 (1 week ago)	trolling for resource vulnerabilities	Web App Attack
🇺🇸 factor1	2026-07-10 09:17:59 (1 week ago)	Fail2ban at apollo Reports Abuse.	Bad Web Bot
🇺🇸 TPI-Abuse	2026-07-10 05:13:32 (1 week ago)	(mod_security) mod_security (id:225170) triggered by 139.47.117.20 (static.masmovil.com): 1 in the l ... show more (mod_security) mod_security (id:225170) triggered by 139.47.117.20 (static.masmovil.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jul 10 01:13:25.702975 2026] [security2:error] [pid 19182:tid 19182] [client 139.47.117.20:34218] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)\|\|alejandrogorsse.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "alejandrogorsse.com"] [uri "/wp-json/wp/v2/users"] [unique_id "alB_dc6brJ5vtf5ijjQUCQAAAAY"] show less	Brute-Force Bad Web Bot Web App Attack
Anonymous	2026-07-09 22:23:17 (1 week ago)	[ns31.kdns.gr] httpd-xmlrpc-post: sites=www.savouras.gr; logs=/var/log/httpd/domains/savouras.gr.log ... show more [ns31.kdns.gr] httpd-xmlrpc-post: sites=www.savouras.gr; logs=/var/log/httpd/domains/savouras.gr.log; samples=/xmlrpc.php show less	Brute-Force Web App Attack
Anonymous	2026-07-09 16:28:50 (1 week ago)	Backdrop CMS module - malicious activity detected	Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-07-09 15:38:56 (1 week ago)	(mod_security) mod_security (id:225170) triggered by 139.47.117.20 (static.masmovil.com): 1 in the l ... show more (mod_security) mod_security (id:225170) triggered by 139.47.117.20 (static.masmovil.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jul 09 11:38:52.291596 2026] [security2:error] [pid 27460:tid 27460] [client 139.47.117.20:34196] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)\|\|josephshv.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "josephshv.com"] [uri "/wp-json/wp/v2/users"] [unique_id "ak_AjKYDNsFixfQDNaOdJAAAAA0"] show less	Brute-Force Bad Web Bot Web App Attack
🇩🇪 stinpriza	2026-07-09 13:08:42 (1 week ago)	Web App Attack	Web App Attack
🇱🇻 garmtech.com	2026-07-09 10:40:35 (1 week ago)	IM360 WAF: Rate limit exceeded for XMLRPC DoS (fault code)	Web App Attack

Showing 1 to 15 of 24 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇬🇧 217.154.45.93

🇨🇱 216.155.93.75

🇷🇴 80.94.92.179

🇺🇸 45.79.181.104

🇬🇧 20.90.164.238

🇩🇪 2.26.48.33

🇨🇳 223.83.114.88

🇧🇷 131.100.176.218

🇸🇬 97.74.87.119

🇬🇧 35.246.80.146

🇺🇸 20.65.193.89

🇰🇷 221.156.126.1

🇪🇹 196.190.41.137

🇳🇱 91.92.40.240

🇹🇷 89.252.153.197

🇺🇸 65.111.5.123

🇷🇺 46.183.130.145

🇪🇬 41.33.236.230

🇻🇳 203.205.37.233

🇪🇸 196.196.150.99