JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 189.99.189.28

189.99.189.28 was found in our database!

This IP was reported 5 times. Confidence of Abuse is 36%: ?

36%

ISP	TELEFÔNICA BRASIL S.A
Usage Type	Fixed Line ISP
ASN	AS26599
Hostname(s)	ip-189-99-189-28.user.vivozap.com.br
Domain Name	telefonica.com.br
Country	🇧🇷 Brazil
City	Sao Paulo, Sao Paulo

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 189.99.189.28

Whois 189.99.189.28

IP Abuse Reports for 189.99.189.28:

This IP address has been reported a total of 5 times from 5 distinct sources. 189.99.189.28 was first reported on September 1st 2026, and the most recent report was 9 hours ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇺🇸 lostswordfish.com	2026-09-02 17:08:04 (9 hours ago)	Wordfence waf block on decarcerationnation	Web App Attack
🇺🇸 IndigoRidge	2026-09-02 11:10:36 (15 hours ago)	189.99.189.28 - - [02/Sep/2026:07:09:24 -0400] "POST /xmlrpc.php HTTP/1.0" 200 5089 "-" "Mozilla/5.0 ... show more 189.99.189.28 - - [02/Sep/2026:07:09:24 -0400] "POST /xmlrpc.php HTTP/1.0" 200 5089 "-" "Mozilla/5.0 (Windows NT 6.2; x86) AppleWebKit/537.36 (KHTML, like Gecko) Opera/78.0.0.0 Safari/537.36" 189.99.189.28 - - [02/Sep/2026:07:09:42 -0400] "POST /xmlrpc.php HTTP/1.0" 200 5089 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7; arm64) AppleWebKit/537.36 (KHTML, like Gecko) Firefox/71.0.0.0 Safari/537.36" 189.99.189.28 - - [02/Sep/2026:07:10:00 -0400] "POST /xmlrpc.php HTTP/1.0" 200 5089 "-" "Mozilla/5.0 (Windows NT 10.0; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.0.0 Safari/537.36" 189.99.189.28 - - [02/Sep/2026:07:10:19 -0400] "POST /xmlrpc.php HTTP/1.0" 200 5089 "-" "Mozilla/5.0 (Linux; Android 10; x86) AppleWebKit/537.36 (KHTML, like Gecko) Edge/86.0.0.0 Safari/537.36" 189.99.189.28 - - [02/Sep/2026:07:10:35 -0400] "POST /xmlrpc.php HTTP/1.0" 200 5089 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; x86) AppleWebKit/537.36 (KHTML, like Gecko) Opera/77.0.0.0 Safari/537.36" ... show less	Web App Attack
🇨🇭 4server	2026-09-02 05:25:07 (21 hours ago)	[WedSep0207:25:02.2522402026][security2:error][pid2400188:tid2400385][client189.99.189.28:0]ModSecur ... show more [WedSep0207:25:02.2522402026][security2:error][pid2400188:tid2400385][client189.99.189.28:0]ModSecurity:Accessdeniedwithcode403\(phase1\).Stringmatch\"/xmlrpc.php\"atREQUEST_URI.[file\"/etc/apache2/conf.d/modsec_custom_rules.conf\"][line\"614\"][id\"960024\"][msg\"XML-RPCdisabled\"][hostname\"npdesign360.ch\"][uri\"/xmlrpc.php\"][unique_id\"apezLr6pPi7745Ts_LxLtAAAAIM\"] show less	Hacking Web App Attack
🇬🇧 abivia	2026-09-01 23:48:20 (1 day ago)	Abivia WAF trigger: Rule staticSite: Request PHP file on a static site. uri: /xmlrpc.php	Hacking Web App Attack
🇩🇪 LRob	2026-09-01 21:53:24 (1 day ago)	Malicious web request: probing for secrets, traversal or a known exploit path \| method: GET \| path: ... show more Malicious web request: probing for secrets, traversal or a known exploit path \| method: GET \| path: /wp-json/wp/v2/users \| 2026-09-01 21:53 UTC show less	Hacking Web App Attack

Showing 1 to 5 of 5 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇦🇷 201.180.174.89

🇺🇦 193.176.251.229

🇲🇽 177.249.173.3

🇺🇸 162.216.150.153

🇨🇳 117.177.235.249

🇹🇼 110.25.109.58

🇮🇳 103.83.11.138

🇬🇧 35.234.136.205

🇬🇧 34.39.9.56

🇺🇸 34.16.91.191

🇧🇩 203.145.36.133

🇭🇰 192.197.113.199

🇩🇪 167.94.145.27

🇺🇸 147.185.132.64

🇺🇸 66.132.186.128

🇳🇱 45.148.120.187

🇸🇬 43.119.100.114

🇬🇧 35.203.211.64

🇻🇳 210.245.20.230

🇨🇦 209.127.142.100