AbuseIPDB » 191.252.219.48

191.252.219.48 was found in our database!

This IP was reported 41 times. Confidence of Abuse is 0%: ?

ISP	Locaweb Servicos de Internet S/A
Usage Type	Data Center/Web Hosting/Transit
Hostname(s)	vps41754.publiccloud.com.br
Domain Name	locaweb.com.br
Country	Brazil
City	Sao Paulo, Sao Paulo

IP info including ISP, Usage Type, and Location provided by IP2Location. Updated monthly.

Report 191.252.219.48

Whois 191.252.219.48

IP Abuse Reports for 191.252.219.48:

This IP address has been reported a total of 41 times from 21 distinct sources. 191.252.219.48 was first reported on October 25th 2022, and the most recent report was 2 months ago.

Old Reports: The most recent abuse report for this IP address is from 2 months ago. It is possible that this IP is no longer involved in abusive activities.

Reporter	IoA Timestamp in UTC	Comment	Categories
HoneyPotEU01	2024-06-30 04:26:00 (2 months ago)	Part of a Layer7 HTTP/HTTPS ddos botnet: 1130 - 22571 rps	DDoS Attack
Malta	2024-06-27 01:10:21 (2 months ago)	191.252.219.48 - - [27/Jun/2024:03:10:21 +0200] "POST /xmlrpc.php HTTP/1.1" "Mozilla/5.0 (Macintosh; ... show more191.252.219.48 - - [27/Jun/2024:03:10:21 +0200] "POST /xmlrpc.php HTTP/1.1" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.6422.60 Safari/537.36" Brute-force password attempt show less	Hacking Brute-Force Web App Attack
Malta	2024-06-25 10:09:22 (2 months ago)	191.252.219.48 - - [25/Jun/2024:12:09:22 +0200] "POST /xmlrpc.php HTTP/1.1" "Mozilla/5.0 (Macintosh; ... show more191.252.219.48 - - [25/Jun/2024:12:09:22 +0200] "POST /xmlrpc.php HTTP/1.1" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.6422.60 Safari/537.36" Brute-force password attempt show less	Hacking Brute-Force Web App Attack
TPI-Abuse	2024-06-25 08:23:39 (2 months ago)	(mod_security) mod_security (id:240335) triggered by 191.252.219.48 (vps41754.publiccloud.com.br): 1 ... show more(mod_security) mod_security (id:240335) triggered by 191.252.219.48 (vps41754.publiccloud.com.br): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jun 25 04:23:34.142377 2024] [security2:error] [pid 8643:tid 46982391420672] [client 191.252.219.48:33098] [client 191.252.219.48] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 191.252.219.48 (+1 hits since last alert)\|www.metropaint.net\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "www.metropaint.net"] [uri "/xmlrpc.php"] [unique_id "Znp-hhrG_nitzZVLzsRnPwAAANM"] show less	Brute-Force Bad Web Bot Web App Attack
Hydra-Shield.fr	2024-06-09 23:14:16 (3 months ago)	Directory Traversal on: /.env	Web App Attack
Marc	2024-06-08 14:09:20 (3 months ago)		Brute-Force
ger-stg-sifi1	2024-06-08 00:57:28 (3 months ago)	(wordpress) Failed wordpress login using wp-login.php or xmlrpc.php	Web App Attack
Swiptly	2024-06-07 04:44:22 (3 months ago)	WordPress xmlrpc spam or enumeration ...	Web Spam Bad Web Bot Web App Attack
lostswordfish.com	2024-06-07 02:10:13 (3 months ago)		Brute-Force SSH
lavnet.net	2024-06-07 00:24:04 (3 months ago)	Jun 7 00:24:03 angela wordpress(thejunkymonkey.com)[862406]: Blocked authentication attempt for adm ... show moreJun 7 00:24:03 angela wordpress(thejunkymonkey.com)[862406]: Blocked authentication attempt for admin from 191.252.219.48 ... show less	Hacking Web App Attack
TPI-Abuse	2024-06-06 05:45:37 (3 months ago)	(mod_security) mod_security (id:240335) triggered by 191.252.219.48 (vps41754.publiccloud.com.br): 1 ... show more(mod_security) mod_security (id:240335) triggered by 191.252.219.48 (vps41754.publiccloud.com.br): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jun 06 01:45:31.480538 2024] [security2:error] [pid 15391] [client 191.252.219.48:36906] [client 191.252.219.48] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 191.252.219.48 (+1 hits since last alert)\|edgecomix.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "edgecomix.com"] [uri "/xmlrpc.php"] [unique_id "ZmFM--3oKgOfBwgdB-kzRwAAABE"] show less	Brute-Force Bad Web Bot Web App Attack
Anonymous	2024-06-06 04:16:21 (3 months ago)	Ports: 80,443; Direction: 0; Trigger: LF_CUSTOMTRIGGER	Brute-Force SSH
Anonymous	2024-06-05 02:12:06 (3 months ago)	Ports: 80,443; Direction: 0; Trigger: LF_CUSTOMTRIGGER	Brute-Force SSH
MAGIC	2024-06-02 15:05:52 (3 months ago)	VM1 Bad user agents ignoring web crawling rules. Draing bandwidth	DDoS Attack Bad Web Bot
Anonymous	2024-06-02 00:05:25 (3 months ago)	Ports: 80,443; Direction: 0; Trigger: LF_CUSTOMTRIGGER	Brute-Force SSH