JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 152.248.48.133

152.248.48.133 was found in our database!

This IP was reported 13 times. Confidence of Abuse is 50%: ?

50%

ISP	TELEFÔNICA BRASIL S.A
Usage Type	Fixed Line ISP
ASN	AS26599
Hostname(s)	152-248-48-133.user.vivozap.com.br
Domain Name	telefonica.com.br
Country	🇧🇷 Brazil
City	Recife, Pernambuco

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 152.248.48.133

Whois 152.248.48.133

IP Abuse Reports for 152.248.48.133:

This IP address has been reported a total of 13 times from 8 distinct sources. 152.248.48.133 was first reported on July 18th 2026, and the most recent report was 1 day ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
Anonymous	2026-07-20 19:42:08 (1 day ago)	(wordpress) Failed login wp-login.php or xmlrpc.php	Web App Attack
🇫🇷 dynamix	2026-07-20 18:09:00 (1 day ago)	WordPress XMLRPC Brute Force Attack	Brute-Force Web App Attack
🇺🇸 IndigoRidge	2026-07-20 14:24:55 (1 day ago)	152.248.48.133 - - [20/Jul/2026:10:23:30 -0400] "POST /xmlrpc.php HTTP/1.0" 403 5564 "-" "WordPress. ... show more 152.248.48.133 - - [20/Jul/2026:10:23:30 -0400] "POST /xmlrpc.php HTTP/1.0" 403 5564 "-" "WordPress.com; https://wordpress.com" 152.248.48.133 - - [20/Jul/2026:10:23:41 -0400] "POST /xmlrpc.php HTTP/1.0" 403 5564 "-" "WordPress.com; https://wordpress.com" 152.248.48.133 - - [20/Jul/2026:10:24:02 -0400] "POST /xmlrpc.php HTTP/1.0" 403 5564 "-" "WordPress.com; https://wordpress.com" 152.248.48.133 - - [20/Jul/2026:10:24:23 -0400] "POST /xmlrpc.php HTTP/1.0" 403 5564 "-" "WordPress.com; https://wordpress.com" 152.248.48.133 - - [20/Jul/2026:10:24:54 -0400] "POST /xmlrpc.php HTTP/1.0" 403 5564 "-" "WordPress.com; https://wordpress.com" ... show less	Web App Attack
🇺🇸 TPI-Abuse	2026-07-20 05:48:39 (2 days ago)	(mod_security) mod_security (id:240335) triggered by 152.248.48.133 (152-248-48-133.user.vivozap.com ... show more (mod_security) mod_security (id:240335) triggered by 152.248.48.133 (152-248-48-133.user.vivozap.com.br): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jul 20 01:48:33.523622 2026] [security2:error] [pid 14158:tid 14158] [client 152.248.48.133:50147] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 152.248.48.133 (+1 hits since last alert)\|aroilcontrolsystem.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "aroilcontrolsystem.com"] [uri "/xmlrpc.php"] [unique_id "al22sY8MZsWxUM3vw2EeOwAAAAk"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-07-20 00:37:38 (2 days ago)	(mod_security) mod_security (id:240335) triggered by 152.248.48.133 (152-248-48-133.user.vivozap.com ... show more (mod_security) mod_security (id:240335) triggered by 152.248.48.133 (152-248-48-133.user.vivozap.com.br): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Jul 19 20:37:34.381424 2026] [security2:error] [pid 10480:tid 10480] [client 152.248.48.133:59043] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 152.248.48.133 (+1 hits since last alert)\|major33.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "major33.com"] [uri "/xmlrpc.php"] [unique_id "al1tzs01nrePsfjykDmjzAAAAAk"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-07-20 00:01:56 (2 days ago)	(mod_security) mod_security (id:240335) triggered by 152.248.48.133 (152-248-48-133.user.vivozap.com ... show more (mod_security) mod_security (id:240335) triggered by 152.248.48.133 (152-248-48-133.user.vivozap.com.br): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Jul 19 20:01:49.060644 2026] [security2:error] [pid 10339:tid 10339] [client 152.248.48.133:59718] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 152.248.48.133 (+1 hits since last alert)\|seagrovesrealty.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "seagrovesrealty.com"] [uri "/xmlrpc.php"] [unique_id "al1lbb1v3eje-W16rJ-F7gAAABI"] show less	Brute-Force Bad Web Bot Web App Attack
🇫🇷 applemooz	2026-07-19 23:30:51 (2 days ago)	WordPress XMLRPC Brute Force Attacks ...	Brute-Force Web App Attack
🇫🇷 Kenshin869	2026-07-19 16:23:48 (2 days ago)	Wordpress unauthorized access attempt	Brute-Force
🇺🇸 TPI-Abuse	2026-07-19 14:24:42 (2 days ago)	(mod_security) mod_security (id:240335) triggered by 152.248.48.133 (152-248-48-133.user.vivozap.com ... show more (mod_security) mod_security (id:240335) triggered by 152.248.48.133 (152-248-48-133.user.vivozap.com.br): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Jul 19 10:24:36.346610 2026] [security2:error] [pid 3633754:tid 3633754] [client 152.248.48.133:52924] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 152.248.48.133 (+1 hits since last alert)\|dandksupply.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "dandksupply.com"] [uri "/xmlrpc.php"] [unique_id "alzeJHncioCNom-U3AExLwAAABk"] show less	Brute-Force Bad Web Bot Web App Attack
Anonymous	2026-07-19 13:46:20 (2 days ago)	152.248.48.133 - - [19/Jul/2026:15:45:47 +0200] "POST /xmlrpc.php HTTP/1.1" 405 428 152.248.48.133 - ... show more 152.248.48.133 - - [19/Jul/2026:15:45:47 +0200] "POST /xmlrpc.php HTTP/1.1" 405 428 152.248.48.133 - - [19/Jul/2026:15:46:18 +0200] "POST /xmlrpc.php HTTP/1.1" 405 428 ... show less	Brute-Force Bad Web Bot
🇺🇸 n2nguyenn2nguyen	2026-07-19 11:43:56 (2 days ago)	Blocked by YFC Security on https://brixzly.com — type: xmlrpc_attempts	Brute-Force Web App Attack
🇺🇸 TPI-Abuse	2026-07-18 23:49:46 (3 days ago)	(mod_security) mod_security (id:240335) triggered by 152.248.48.133 (152-248-48-133.user.vivozap.com ... show more (mod_security) mod_security (id:240335) triggered by 152.248.48.133 (152-248-48-133.user.vivozap.com.br): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Jul 18 19:49:40.807284 2026] [security2:error] [pid 1455035:tid 1455035] [client 152.248.48.133:56598] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 152.248.48.133 (+1 hits since last alert)\|blindshine.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "blindshine.com"] [uri "/xmlrpc.php"] [unique_id "alwRFLNy2YquvaYEwHMubAAAAAg"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-07-18 15:28:59 (3 days ago)	(mod_security) mod_security (id:240335) triggered by 152.248.48.133 (152-248-48-133.user.vivozap.com ... show more (mod_security) mod_security (id:240335) triggered by 152.248.48.133 (152-248-48-133.user.vivozap.com.br): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Jul 18 11:28:52.319307 2026] [security2:error] [pid 365865:tid 365865] [client 152.248.48.133:64141] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 152.248.48.133 (+1 hits since last alert)\|lenorasflowers.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "lenorasflowers.com"] [uri "/xmlrpc.php"] [unique_id "alubtEwxhLv3KsVOnbQ6eQAAAA4"] show less	Brute-Force Bad Web Bot Web App Attack

Showing 1 to 13 of 13 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇬🇧 212.71.250.213

🇷🇴 193.32.162.83

🇲🇽 177.226.40.60

🇨🇳 112.46.212.145

🇫🇷 91.196.152.37

🇳🇱 45.148.10.157

🇲🇦 41.143.154.1

🇨🇳 36.143.66.19

🇺🇸 166.62.41.13

🇺🇸 162.216.149.22

🇺🇸 72.56.168.19

🇺🇸 68.69.177.112

🇺🇸 57.141.18.105

🇨🇳 43.136.119.41

🇫🇷 212.47.68.32

🇵🇱 176.53.159.198

🇵🇰 175.107.2.162

🇭🇰 165.154.4.92

🇺🇸 143.42.164.182

🇦🇷 138.84.63.73