JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 156.252.139.23

156.252.139.23 was found in our database!

This IP was reported 15 times. Confidence of Abuse is 68%: ?

68%

ISP	Cabo Verde Telecom, S.a
Usage Type	Fixed Line ISP
ASN	AS37517
Domain Name	cvtelecom.cv
Country	🇨🇻 Cape Verde
City	Praia, Praia

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 156.252.139.23

Whois 156.252.139.23

IP Abuse Reports for 156.252.139.23:

This IP address has been reported a total of 15 times from 11 distinct sources. 156.252.139.23 was first reported on July 17th 2026, and the most recent report was 2 hours ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇳🇱 Site.eu	2026-07-20 05:47:47 (2 hours ago)	Repeated wp-login/xmlrpc attempts	Brute-Force SSH
🇩🇪 rh24	2026-07-20 05:44:43 (2 hours ago)	(xmlrpc_405) XMLRPC-Bot 405 156.252.139.23 (CV/Cabo Verde/-)	Hacking
Anonymous	2026-07-19 20:01:35 (12 hours ago)	[redacted] 156.252.139.23 - - [19/Jul/2026:22:00:50 +0200] "POST /xmlrpc.php HTTP/1.1" 405 415 "-" " ... show more [redacted] 156.252.139.23 - - [19/Jul/2026:22:00:50 +0200] "POST /xmlrpc.php HTTP/1.1" 405 415 "-" "Jetpack/12.1; WordPress/6.3; http://site92856282.com" [redacted] 156.252.139.23 - - [19/Jul/2026:22:01:04 +0200] "POST /xmlrpc.php HTTP/1.1" 405 415 "-" "Jetpack/12.5; WordPress/6.1; http://site23520914.com" [redacted] 156.252.139.23 - - [19/Jul/2026:22:01:17 +0200] "POST /xmlrpc.php HTTP/1.1" 405 415 "-" "Jetpack/12.1; WordPress/6.2; http://site15587296.com" [redacted] 156.252.139.23 - - [19/Jul/2026:22:01:24 +0200] "POST /xmlrpc.php HTTP/1.1" 405 415 "-" "WordPress.com; https://wordpress.com" [redacted] 156.252.139.23 - - [19/Jul/2026:22:01:34 +0200] "POST /xmlrpc.php HTTP/1.1" 405 415 "-" "Jetpack/12.0; WordPress/6.1; http://site77884021.com" ... show less	Hacking Web App Attack
🇺🇸 TPI-Abuse	2026-07-19 18:58:23 (13 hours ago)	(mod_security) mod_security (id:240335) triggered by 156.252.139.23 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:240335) triggered by 156.252.139.23 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Jul 19 14:58:19.209979 2026] [security2:error] [pid 1969059:tid 1969059] [client 156.252.139.23:59407] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 156.252.139.23 (+1 hits since last alert)\|iconflgc.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "iconflgc.com"] [uri "/xmlrpc.php"] [unique_id "al0eSyw1hsoiAZuc6BVUkgAAAAY"] show less	Brute-Force Bad Web Bot Web App Attack
🇫🇷 dynamix	2026-07-19 08:29:51 (23 hours ago)	WordPress XMLRPC Brute Force Attack	Brute-Force Web App Attack
🇺🇸 TPI-Abuse	2026-07-19 06:01:11 (1 day ago)	(mod_security) mod_security (id:240335) triggered by 156.252.139.23 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:240335) triggered by 156.252.139.23 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Jul 19 02:01:08.356063 2026] [security2:error] [pid 26973:tid 26973] [client 156.252.139.23:49877] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 156.252.139.23 (+1 hits since last alert)\|market1st.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "market1st.com"] [uri "/xmlrpc.php"] [unique_id "alxoJGlcwh14wYsSNrQAlgAAAAg"] show less	Brute-Force Bad Web Bot Web App Attack
🇦🇺 screwlooseit.com.au	2026-07-19 03:13:43 (1 day ago)	Blocked by CSF 13 firewall - Rule: XMLRPC US/United States/-	Web App Attack
🇺🇸 IndigoRidge	2026-07-18 23:58:58 (1 day ago)	156.252.139.23 - - [18/Jul/2026:19:57:42 -0400] "POST /xmlrpc.php HTTP/1.0" 403 5489 "-" "WordPress. ... show more 156.252.139.23 - - [18/Jul/2026:19:57:42 -0400] "POST /xmlrpc.php HTTP/1.0" 403 5489 "-" "WordPress.com; https://wordpress.com" 156.252.139.23 - - [18/Jul/2026:19:57:52 -0400] "POST /xmlrpc.php HTTP/1.0" 403 5489 "-" "WordPress.com; https://wordpress.com" 156.252.139.23 - - [18/Jul/2026:19:58:25 -0400] "POST /xmlrpc.php HTTP/1.0" 403 5489 "-" "WordPress.com; https://wordpress.com" 156.252.139.23 - - [18/Jul/2026:19:58:48 -0400] "POST /xmlrpc.php HTTP/1.0" 403 5489 "-" "WordPress.com; https://wordpress.com" 156.252.139.23 - - [18/Jul/2026:19:58:58 -0400] "POST /xmlrpc.php HTTP/1.0" 403 5489 "-" "WordPress.com; https://wordpress.com" ... show less	Web App Attack
🇺🇸 TPI-Abuse	2026-07-18 22:42:17 (1 day ago)	(mod_security) mod_security (id:240335) triggered by 156.252.139.23 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:240335) triggered by 156.252.139.23 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Jul 18 18:42:09.297684 2026] [security2:error] [pid 3566427:tid 3566446] [client 156.252.139.23:59826] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 156.252.139.23 (+1 hits since last alert)\|aafm.us\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "aafm.us"] [uri "/xmlrpc.php"] [unique_id "alwBQfIKqEu3C9Io-byzBwAAAI8"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-07-18 21:01:04 (1 day ago)	(mod_security) mod_security (id:240335) triggered by 156.252.139.23 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:240335) triggered by 156.252.139.23 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Jul 18 17:00:59.677369 2026] [security2:error] [pid 3507:tid 3507] [client 156.252.139.23:55011] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 156.252.139.23 (+1 hits since last alert)\|towlesilvapsychotherapy.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "towlesilvapsychotherapy.com"] [uri "/xmlrpc.php"] [unique_id "alvpi1fwBzZ2DuCzYRhm-gAAAAQ"] show less	Brute-Force Bad Web Bot Web App Attack
🇩🇪 konseptit	2026-07-18 05:19:13 (2 days ago)	(wordpress) Failed wordpress login from 156.252.139.23 (CV/Cabo Verde/-)	Brute-Force
🇫🇮 YF	2026-07-18 05:00:27 (2 days ago)	xmlrpc.php Potential DDoS or brute force	DDoS Attack Brute-Force
🇫🇷 dynamix	2026-07-18 02:02:24 (2 days ago)	WordPress XMLRPC Brute Force Attack	Brute-Force Web App Attack
🇬🇧 Apache	2026-07-17 23:35:57 (2 days ago)	(mod_security) mod_security (id:240335) triggered by 156.252.139.23 (CV/Cabo Verde/-): 5 in the last ... show more (mod_security) mod_security (id:240335) triggered by 156.252.139.23 (CV/Cabo Verde/-): 5 in the last 300 secs show less	Brute-Force Web App Attack
🇳🇱 e.fierstra	2026-07-17 22:54:15 (2 days ago)	ModSecurity hits exceeded	Bad Web Bot Web App Attack

Showing 1 to 15 of 15 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇺🇸 195.184.76.218

🇺🇸 192.158.140.144

🇲🇽 189.204.230.91

🇭🇺 188.36.7.196

🇷🇺 185.33.236.141

🇭🇰 165.154.40.97

🇨🇳 112.25.140.211

🇹🇼 111.70.29.132

🇳🇬 102.88.21.215

🇳🇱 88.210.63.69

🇧🇷 45.205.1.223

🇺🇸 20.172.71.160

🇺🇦 178.251.109.237

🇺🇸 162.222.205.12

🇳🇱 160.119.76.64

🇨🇳 101.201.38.226

🇫🇷 84.5.129.68

🇺🇸 81.30.98.87

🇳🇱 77.239.124.244

🇩🇪 69.5.169.190