Total reports
7 from
5 distinct
reporters
First reported
November 12th 2026
Most recent report
3 hours ago
Last 60 days
Top reporter locations
🇮🇩
Indonesia
5
🇸🇬
Singapore
1
🇺🇦
Ukraine
1
Most common categories
Web App Attack
5
Hacking
2
Bad Web Bot
1
Exploited Host
1
Brute-Force
1
Recent reports
We have received reports of abusive activity from this IP address within the last week. It is
potentially still actively engaged in abusive activities.
Reporter
IoA Timestamp (UTC)
Comment
Categories
🇺🇦
URAN Publishing Service
2026-11-15 12:25:04
UTC ·
(3 hours ago)
[15/Nov/2026:14:25:04 +0200] -- 38.9.47.173 Ban reason: Scanner [CMS_GENERIC] | Request: GET /xmlrpc.php HTTP/1.1
Bad Web Bot
Web App Attack
🇮🇩
bps-statistics
2026-11-14 19:06:00
UTC ·
(20 hours ago)
XML RPC Scan Activities: "2026-11-15T02:06:00.336+07:00" "/xmlrpc.php" "38.9.47.173" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36"
Web App Attack
Brute-Force
🇸🇬
fazar
2026-11-14 05:57:54
UTC ·
(1 day ago)
wp-login-scan: 3 attempts from 38.9.47.173 on node: sgp03
Exploited Host
Web App Attack
🇮🇩
hermawan
2026-11-14 03:52:57
UTC ·
(1 day ago)
[Sat Nov 14 10:52:57.575323 2026] [security2:error] [pid 106375:tid 140517438387904] [client 38.9.47.173:0] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/wp" at REQUEST_FILENAME. [file "/etc/modsecurity/coreruleset-4.29.0/rules ...
show more
[Sat Nov 14 10:52:57.575323 2026] [security2:error] [pid 106375:tid 140517438387904] [client 38.9.47.173:0] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/wp" at REQUEST_FILENAME. [file "/etc/modsecurity/coreruleset-4.29.0/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "98"] [id "448101"] [msg "BAD REQUEST FILENAME - Detected and Blocked"] [data "Matched Data: /wp found within REQUEST_FILENAME: /index.php/wp-json/ request_line = GET /index.php/wp-json/ HTTP/1.1"] [severity "NOTICE"] [hostname "staklim-jatim.bmkg.go.id"] [uri "/index.php/wp-json/"] [unique_id "avfbGSmoEzJRWYwFKssJawAAAM8"] [staklim-jatim.bmkg.go.id] [staklim-jatim.bmkg.go.id] top=[106487] [sfLyerQSu+U] [avfbGSmoEzJRWYwFKssJawAAAM8] keep_alive=[0] [2026-11-14 10:52:57.575330] [R:avfbGSmoEzJRWYwFKssJawAAAM8] UA:'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36' Host:'staklim-jatim.bmkg.go.id' COOKIE:'_bmkg_jatimphp=62341461595; fb66d
...
show less
Email Spam
Hacking
🇮🇩
bps-statistics
2026-11-14 01:03:33
UTC ·
(1 day ago)
Frequent Web Application Attacks
Web App Attack
🇮🇩
bps-statistics
2026-11-13 00:59:10
UTC ·
(2 days ago)
Frequent Web Application Attacks
Web App Attack
🇮🇩
aaKenshin
2026-11-12 20:04:56
UTC ·
(2 days ago)
Suspicious activity detected from IP 38.9.47.173 based on web server logs.
Sample logs:
[] 38.9.47.173 - - [13/Nov/2026:01:56:25 +0800] "GET /prestasi-rsudainun/index.php/wp-json HTTP/1.1" 301 162 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Apple ...
show more
Suspicious activity detected from IP 38.9.47.173 based on web server logs.
Sample logs:
[] 38.9.47.173 - - [13/Nov/2026:01:56:25 +0800] "GET /prestasi-rsudainun/index.php/wp-json HTTP/1.1" 301 162 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36"
[] 38.9.47.173 - - [13/Nov/2026:01:56:29 +0800] "GET /old/index.php/wp-json HTTP/1.1" 301 162 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36"
[] 38.9.47.173 - - [13/Nov/2026:01:56:36 +0800] "GET /beranda/index.php/wp-json HTTP/1.1" 301 162 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36"
Reported automatically by fail2ban service.
show less
Hacking
