JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 196.39.28.248

196.39.28.248 was found in our database!

This IP was reported 21 times. Confidence of Abuse is 56%: ?

56%

ISP	Dimension Data
Usage Type	Fixed Line ISP
ASN	AS20011
Domain Name	global.ntt
Country	🇿🇦 South Africa
City	Johannesburg, Gauteng

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 196.39.28.248

Whois 196.39.28.248

IP Abuse Reports for 196.39.28.248:

This IP address has been reported a total of 21 times from 9 distinct sources. 196.39.28.248 was first reported on July 18th 2026, and the most recent report was 2 days ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇫🇷 dynamix	2026-07-23 16:06:47 (2 days ago)	WordPress XMLRPC Brute Force Attack	Brute-Force Web App Attack
🇦🇺 screwlooseit.com.au	2026-07-23 15:34:03 (2 days ago)	Blocked by CSF 13 firewall - Rule: XMLRPC ZA/South Africa/196-39-28-248.ftth.web.africa	Web App Attack
🇺🇸 TPI-Abuse	2026-07-23 11:54:12 (2 days ago)	(mod_security) mod_security (id:240335) triggered by 196.39.28.248 (196-39-28-248.ftth.web.africa): ... show more (mod_security) mod_security (id:240335) triggered by 196.39.28.248 (196-39-28-248.ftth.web.africa): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jul 23 07:54:05.600458 2026] [security2:error] [pid 674868:tid 674868] [client 196.39.28.248:61194] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 196.39.28.248 (+1 hits since last alert)\|thesmithcouple.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "thesmithcouple.com"] [uri "/xmlrpc.php"] [unique_id "amIA3eLCCp_N6Pfp1fAUmQAAABI"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-07-23 11:38:39 (2 days ago)	(mod_security) mod_security (id:240335) triggered by 196.39.28.248 (196-39-28-248.ftth.web.africa): ... show more (mod_security) mod_security (id:240335) triggered by 196.39.28.248 (196-39-28-248.ftth.web.africa): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jul 23 07:38:32.473958 2026] [security2:error] [pid 3196596:tid 3196635] [client 196.39.28.248:64090] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 196.39.28.248 (+1 hits since last alert)\|danelandia.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "danelandia.com"] [uri "/xmlrpc.php"] [unique_id "amH9OKI6cRHRStip_nFfygAAAEQ"] show less	Brute-Force Bad Web Bot Web App Attack
🇫🇷 dynamix	2026-07-22 14:29:25 (3 days ago)	WordPress XMLRPC Brute Force Attack	Brute-Force Web App Attack
🇺🇸 IndigoRidge	2026-07-22 05:08:28 (4 days ago)	196.39.28.248 - - [22/Jul/2026:01:05:59 -0400] "POST /xmlrpc.php HTTP/1.1" 200 5072 "-" "WordPress.c ... show more 196.39.28.248 - - [22/Jul/2026:01:05:59 -0400] "POST /xmlrpc.php HTTP/1.1" 200 5072 "-" "WordPress.com; https://wordpress.com" 196.39.28.248 - - [22/Jul/2026:01:06:30 -0400] "POST /xmlrpc.php HTTP/1.1" 200 5072 "-" "WordPress.com; https://wordpress.com" 196.39.28.248 - - [22/Jul/2026:01:06:52 -0400] "POST /xmlrpc.php HTTP/1.1" 200 5072 "-" "WordPress.com; https://wordpress.com" 196.39.28.248 - - [22/Jul/2026:01:07:45 -0400] "POST /xmlrpc.php HTTP/1.1" 200 5072 "-" "WordPress.com; https://wordpress.com" 196.39.28.248 - - [22/Jul/2026:01:08:27 -0400] "POST /xmlrpc.php HTTP/1.1" 200 5072 "-" "WordPress.com; https://wordpress.com" ... show less	Web App Attack
🇺🇸 TPI-Abuse	2026-07-22 04:58:19 (4 days ago)	(mod_security) mod_security (id:240335) triggered by 196.39.28.248 (196-39-28-248.ftth.web.africa): ... show more (mod_security) mod_security (id:240335) triggered by 196.39.28.248 (196-39-28-248.ftth.web.africa): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jul 22 00:58:12.319916 2026] [security2:error] [pid 328938:tid 328938] [client 196.39.28.248:54136] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 196.39.28.248 (+1 hits since last alert)\|instalatoribucuresti.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "instalatoribucuresti.com"] [uri "/xmlrpc.php"] [unique_id "amBN5Pp0JqaXKkLyGTSCKgAAAAU"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-07-21 21:03:38 (4 days ago)	(mod_security) mod_security (id:240335) triggered by 196.39.28.248 (196-39-28-248.ftth.web.africa): ... show more (mod_security) mod_security (id:240335) triggered by 196.39.28.248 (196-39-28-248.ftth.web.africa): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jul 21 17:03:34.900388 2026] [security2:error] [pid 15161:tid 15161] [client 196.39.28.248:0] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 196.39.28.248 (+1 hits since last alert)\|upskirtcrazy.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "upskirtcrazy.com"] [uri "/xmlrpc.php"] [unique_id "al_epuSGoSFcgwTo0Q44aQAAAAg"] show less	Brute-Force Bad Web Bot Web App Attack
🇮🇹 CoreTech srl	2026-07-21 18:33:58 (4 days ago)	cloudlinux2 fail2ban: 2026-07-21 20:28:57,414 fail2ban.filter [1927]: INFO [plesk-wordpre ... show more cloudlinux2 fail2ban: 2026-07-21 20:28:57,414 fail2ban.filter [1927]: INFO [plesk-wordpress] Found 65.111.26.238 - 2026-07-21 20:28:57cloudlinux2 fail2ban: 2026-07-21 20:28:57,653 fail2ban.filter [1927]: INFO [plesk-wordpress] Found 45.3.44.2 - 2026-07-21 20:28:57cloudlinux2 fail2ban: 2026-07-21 20:29:01,010 fail2ban.filter [1927]: INFO [plesk-wordpress] Found 65.111.26.108 - 2026-07-21 20:29:00cloudlinux2 fail2ban: 2026-07-21 20:29:10,434 fail2ban.filter [1927]: INFO [plesk-wordpress] Found 45.3.44.65 - 2026-07-21 20:29:10cloudlinux2 fail2ban: 2026-07-21 20:29:19,825 fail2ban.filter [1927]: INFO [plesk-wordpress] Found 45.3.44.64 - 2026-07-21 20:29:19cloudlinux2 fail2ban: 2026-07-21 20:29:35,201 fail2ban.filter [1927]: INFO [plesk-wordpress] Found 65.111.26.177 - 2026-07-21 20:29:35cloudlinux2 fail2ban: 2026-07-21 20:29:44,615 fail2ban.filter [1927]: INFO [plesk-wordpress] Found 65.111.26.255 - 2026-07-21 20:29:44cloudlinux2 fail2ba show less	Web App Attack
🇩🇪 neckaralb-admin.de	2026-07-21 18:28:53 (4 days ago)	(wordpress) Failed login wp-login.php or xmlrpc.php	Web App Attack
🇺🇸 TPI-Abuse	2026-07-21 18:10:26 (4 days ago)	(mod_security) mod_security (id:240335) triggered by 196.39.28.248 (196-39-28-248.ftth.web.africa): ... show more (mod_security) mod_security (id:240335) triggered by 196.39.28.248 (196-39-28-248.ftth.web.africa): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jul 21 14:10:19.262938 2026] [security2:error] [pid 25897:tid 25897] [client 196.39.28.248:62176] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 196.39.28.248 (+1 hits since last alert)\|circleinthesquare.org\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "circleinthesquare.org"] [uri "/xmlrpc.php"] [unique_id "al-2C3JD2jDPNgnRndL8kwAAAAQ"] show less	Brute-Force Bad Web Bot Web App Attack
🇩🇪 ghostwarriors	2026-07-21 13:50:11 (4 days ago)	Webpage scraping	Brute-Force Bad Web Bot Web App Attack
Anonymous	2026-07-21 13:20:53 (4 days ago)	Fail2Ban: WordPress XML-RPC brute-force attack detected.	Bad Web Bot Web App Attack
🇫🇷 dynamix	2026-07-21 12:50:27 (4 days ago)	WordPress XMLRPC Brute Force Attack	Brute-Force Web App Attack
🇺🇸 TPI-Abuse	2026-07-21 11:42:39 (4 days ago)	(mod_security) mod_security (id:240335) triggered by 196.39.28.248 (196-39-28-248.ftth.web.africa): ... show more (mod_security) mod_security (id:240335) triggered by 196.39.28.248 (196-39-28-248.ftth.web.africa): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jul 21 07:42:35.971185 2026] [security2:error] [pid 2245:tid 2245] [client 196.39.28.248:59611] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 196.39.28.248 (+1 hits since last alert)\|mchen-arch.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "mchen-arch.com"] [uri "/xmlrpc.php"] [unique_id "al9bK2a8RTw88HTd1MKD8wAAAAI"] show less	Brute-Force Bad Web Bot Web App Attack

Showing 1 to 15 of 21 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇺🇸 185.180.141.9

🇺🇸 162.216.150.107

🇸🇬 103.13.207.88

🇷🇺 91.146.24.164

🇸🇬 172.217.97.27

🇺🇸 170.106.140.110

🇨🇳 123.145.5.139

🇺🇸 107.2.22.2

🇺🇸 100.26.102.117

🇭🇺 89.134.194.9

🇫🇮 80.223.167.240

🇳🇱 77.239.124.250

🇺🇸 35.245.88.20

🇺🇸 20.168.121.119

🇨🇳 14.111.106.124

🇺🇸 4.227.177.11

🇩🇪 4.184.121.217

🇶🇦 2600:1900:4260:40e::129

🇮🇳 182.79.218.101

🇸🇬 172.253.211.94