AbuseIPDB » 170.239.18.138

170.239.18.138 was found in our database!

This IP was reported 38 times. Confidence of Abuse is 100%: ?

100%

ISP	I B T
Usage Type	Fixed Line ISP
Hostname(s)	138-18-239-170.assineibt.com.br
Domain Name	assineibt.com.br
Country	Brazil
City	Salvador, Bahia

Report 170.239.18.138

Whois 170.239.18.138

IP Abuse Reports for 170.239.18.138:

This IP address has been reported a total of 38 times from 30 distinct sources. 170.239.18.138 was first reported on November 22nd 2024, and the most recent report was 6 days ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp in UTC	Comment	Categories
rtbh.com.tr	2024-11-25 20:53:04 (6 days ago)	list.rtbh.com.tr report: tcp/0	Brute-Force
Vegascosmetics	2024-11-25 07:01:44 (1 week ago)	Kingcopy(AI-IDS)Excessive BAD Request Abuse	Bad Web Bot
TPI-Abuse	2024-11-25 00:57:02 (1 week ago)	(mod_security) mod_security (id:225170) triggered by 170.239.18.138 (138-18-239-170.assineibt.com.br ... show more(mod_security) mod_security (id:225170) triggered by 170.239.18.138 (138-18-239-170.assineibt.com.br): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 24 19:56:54.674817 2024] [security2:error] [pid 6597:tid 6597] [client 170.239.18.138:49504] [client 170.239.18.138] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)\|\|celebritybikinigossip.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "celebritybikinigossip.com"] [uri "/wp-json/wp/v2/users/"] [unique_id "Z0PLViMKqZuNtLR3wWIniQAAAAU"] show less	Brute-Force Bad Web Bot Web App Attack
Petros Stefanakis	2024-11-25 00:28:20 (1 week ago)	(wordpress) Failed wordpress login from 170.239.18.138 (BR/Brazil/138-18-239-170.assineibt.com.br)	Brute-Force
weblite	2024-11-25 00:13:42 (1 week ago)	WP_LOGIN_FAIL WP_XMLRPC_ABUSE	Brute-Force Web App Attack
TPI-Abuse	2024-11-24 22:36:33 (1 week ago)	(mod_security) mod_security (id:225170) triggered by 170.239.18.138 (138-18-239-170.assineibt.com.br ... show more(mod_security) mod_security (id:225170) triggered by 170.239.18.138 (138-18-239-170.assineibt.com.br): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 24 17:36:29.933277 2024] [security2:error] [pid 10994:tid 10994] [client 170.239.18.138:51345] [client 170.239.18.138] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)\|\|www.ibeautyexchange.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "www.ibeautyexchange.com"] [uri "/wp-json/wp/v2/users/"] [unique_id "Z0OqbZpddO57XXt77VMFBAAAAAI"] show less	Brute-Force Bad Web Bot Web App Attack
TPI-Abuse	2024-11-24 21:54:21 (1 week ago)	(mod_security) mod_security (id:225170) triggered by 170.239.18.138 (138-18-239-170.assineibt.com.br ... show more(mod_security) mod_security (id:225170) triggered by 170.239.18.138 (138-18-239-170.assineibt.com.br): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 24 16:54:16.024239 2024] [security2:error] [pid 1058383:tid 1058383] [client 170.239.18.138:54537] [client 170.239.18.138] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)\|\|persnicketyinc.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "persnicketyinc.com"] [uri "/wp-json/wp/v2/users/"] [unique_id "Z0OgiFc3p2MkEUm6O7l6dgAAAAI"] show less	Brute-Force Bad Web Bot Web App Attack
Burayot	2024-11-24 21:13:23 (1 week ago)	LF_MODSEC: (mod_security) mod_security (id:1000001) triggered by 170.239.18.138 (BR/Brazil/138-18-23 ... show moreLF_MODSEC: (mod_security) mod_security (id:1000001) triggered by 170.239.18.138 (BR/Brazil/138-18-239-170.assineibt.com.br): 1 in the last 3600 secs show less	Web App Attack
Kenshin869	2024-11-24 19:02:49 (1 week ago)	Wordpress unauthorized access attempt	Brute-Force
Bay13	2024-11-24 15:57:39 (1 week ago)	f2b http-redirect	Hacking Web App Attack
TPI-Abuse	2024-11-24 15:42:07 (1 week ago)	(mod_security) mod_security (id:225170) triggered by 170.239.18.138 (138-18-239-170.assineibt.com.br ... show more(mod_security) mod_security (id:225170) triggered by 170.239.18.138 (138-18-239-170.assineibt.com.br): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 24 10:42:02.213196 2024] [security2:error] [pid 14165:tid 14165] [client 170.239.18.138:52043] [client 170.239.18.138] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)\|\|buanamegah.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "buanamegah.com"] [uri "/wp-json/wp/v2/users/"] [unique_id "Z0NJSnWlR-siYbTtb7CwnAAAAAM"] show less	Brute-Force Bad Web Bot Web App Attack
rdpguard.com	2024-11-24 15:39:56 (1 week ago)	RdpGuard detected brute-force attempt on HTTP	Brute-Force
Dolphi	2024-11-24 13:20:02 (1 week ago)	POST //xmlrpc.php	Brute-Force Web App Attack
Cloudkul Cloudkul	2024-11-24 12:25:06 (1 week ago)	Attempted Brute Force on our application	Brute-Force Web App Attack
ISPLtd	2024-11-24 11:05:32 (1 week ago)	170.239.18.138 - - [24/Nov/2024:04:05:31 -0700] "GET //wp-includes/wlwmanifest.xml 170.239.18. ... show more170.239.18.138 - - [24/Nov/2024:04:05:31 -0700] "GET //wp-includes/wlwmanifest.xml 170.239.18.138 - - [24/Nov/2024:04:05:31 -0700] "GET //xmlrpc.php?rsd 170.239.18.138 - - [24/Nov/2024:04:05:32 -0700] "GET //blog/wp-includes/wlwmanifest.xml ... show less	Hacking Web App Attack