JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 39.194.2.47

39.194.2.47 was found in our database!

This IP was reported 9 times. Confidence of Abuse is 34%: ?

34%

ISP	Gd. Wisma Mulia Lt.M-19
Usage Type	Fixed Line ISP
ASN	AS23693
Domain Name	telkomsel.co.id
Country	🇮🇩 Indonesia
City	Martapura, South Kalimantan

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 39.194.2.47

Whois 39.194.2.47

IP Abuse Reports for 39.194.2.47:

This IP address has been reported a total of 9 times from 6 distinct sources. 39.194.2.47 was first reported on May 28th 2026, and the most recent report was 4 days ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇺🇸 TPI-Abuse	2026-07-13 19:03:45 (4 days ago)	(mod_security) mod_security (id:240335) triggered by 39.194.2.47 (-): 1 in the last 300 secs; Ports: ... show more (mod_security) mod_security (id:240335) triggered by 39.194.2.47 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jul 13 15:03:37.627672 2026] [security2:error] [pid 5149:tid 5149] [client 39.194.2.47:16197] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 39.194.2.47 (+1 hits since last alert)\|apuntesdeinversion.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "apuntesdeinversion.com"] [uri "/xmlrpc.php"] [unique_id "alU2ieSzaXVMxba_5tZuQQAAAAE"] show less	Brute-Force Bad Web Bot Web App Attack
🇫🇷 dynamix	2026-07-13 17:17:43 (4 days ago)	WordPress XMLRPC Brute Force Attack	Brute-Force Web App Attack
🇺🇸 TPI-Abuse	2026-07-13 14:18:52 (4 days ago)	(mod_security) mod_security (id:240335) triggered by 39.194.2.47 (-): 1 in the last 300 secs; Ports: ... show more (mod_security) mod_security (id:240335) triggered by 39.194.2.47 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jul 13 10:18:45.868022 2026] [security2:error] [pid 20945:tid 20945] [client 39.194.2.47:21697] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 39.194.2.47 (+1 hits since last alert)\|takeapawsboston.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "takeapawsboston.com"] [uri "/xmlrpc.php"] [unique_id "alTzxey4vgfGQN7bIzhYXAAAAAo"] show less	Brute-Force Bad Web Bot Web App Attack
Anonymous	2026-07-13 11:39:42 (4 days ago)	[redacted] 39.194.2.47 - - [13/Jul/2026:13:38:59 +0200] "POST /xmlrpc.php HTTP/1.1" 405 415 "-" "Jet ... show more [redacted] 39.194.2.47 - - [13/Jul/2026:13:38:59 +0200] "POST /xmlrpc.php HTTP/1.1" 405 415 "-" "Jetpack by WordPress.com (Jetpack 12.1; WordPress 6.2)" [redacted] 39.194.2.47 - - [13/Jul/2026:13:39:09 +0200] "POST /xmlrpc.php HTTP/1.1" 405 415 "-" "Jetpack by WordPress.com (Jetpack 12.0; WordPress 6.4)" [redacted] 39.194.2.47 - - [13/Jul/2026:13:39:20 +0200] "POST /xmlrpc.php HTTP/1.1" 405 415 "-" "WordPress.com; https://wordpress.com" [redacted] 39.194.2.47 - - [13/Jul/2026:13:39:30 +0200] "POST /xmlrpc.php HTTP/1.1" 405 415 "-" "Jetpack by WordPress.com (Jetpack 12.1; WordPress 6.1)" [redacted] 39.194.2.47 - - [13/Jul/2026:13:39:41 +0200] "POST /xmlrpc.php HTTP/1.1" 405 415 "-" "Jetpack by WordPress.com (Jetpack 13.0; WordPress 6.3)" ... show less	Hacking Web App Attack
🇫🇷 applemooz	2026-07-13 11:09:36 (4 days ago)	WordPress XMLRPC Brute Force Attacks ...	Brute-Force Web App Attack
Anonymous	2026-07-13 10:07:48 (4 days ago)	[redacted] 39.194.2.47 - - [13/Jul/2026:12:07:05 +0200] "POST /xmlrpc.php HTTP/1.1" 405 415 "-" "Jet ... show more [redacted] 39.194.2.47 - - [13/Jul/2026:12:07:05 +0200] "POST /xmlrpc.php HTTP/1.1" 405 415 "-" "Jetpack/12.5; WordPress/6.4; http://site81312281.com" [redacted] 39.194.2.47 - - [13/Jul/2026:12:07:15 +0200] "POST /xmlrpc.php HTTP/1.1" 405 415 "-" "Jetpack by WordPress.com" [redacted] 39.194.2.47 - - [13/Jul/2026:12:07:25 +0200] "POST /xmlrpc.php HTTP/1.1" 405 415 "-" "Jetpack by WordPress.com" [redacted] 39.194.2.47 - - [13/Jul/2026:12:07:36 +0200] "POST /xmlrpc.php HTTP/1.1" 405 415 "-" "WordPress.com; https://wordpress.com" [redacted] 39.194.2.47 - - [13/Jul/2026:12:07:47 +0200] "POST /xmlrpc.php HTTP/1.1" 405 415 "-" "Jetpack by WordPress.com" ... show less	Hacking Web App Attack
🇺🇸 TPI-Abuse	2026-07-13 05:52:20 (4 days ago)	(mod_security) mod_security (id:240335) triggered by 39.194.2.47 (-): 1 in the last 300 secs; Ports: ... show more (mod_security) mod_security (id:240335) triggered by 39.194.2.47 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jul 13 01:52:14.995080 2026] [security2:error] [pid 7368:tid 7368] [client 39.194.2.47:7635] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 39.194.2.47 (+1 hits since last alert)\|christaylorjazzpianist.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "christaylorjazzpianist.com"] [uri "/xmlrpc.php"] [unique_id "alR9Do70-xhFJ8j9qO2YVQAAAA8"] show less	Brute-Force Bad Web Bot Web App Attack
🇮🇩 hermawan	2026-06-05 04:36:53 (1 month ago)	[Fri Jun 05 11:36:49.008754 2026] [security2:error] [pid 734247:tid 140062364788416] [client 39.194. ... show more [Fri Jun 05 11:36:49.008754 2026] [security2:error] [pid 734247:tid 140062364788416] [client 39.194.2.47:7589] ModSecurity: Access denied with code 403 (phase 1). Match of "pm googlebot " against "REQUEST_HEADERS:From" required. [file "/etc/modsecurity/coreruleset-4.26.0/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "117"] [id "448105"] [msg "BAD REQUEST Header From "] [data "Matched Data: host,user-agent,from,accept-language,cache-control,pragma,priority,sec-fetch-site,sec-fetch-mode,upgrade-insecure-requests,accept,accept-encoding found within REQUEST_HEADERS:From: bingbot(at)microsoft.com request_line = GET /index.php/prakiraan-cuaca-transportasi-darat-jawa-jalur-utara-dan-selatan/113-akar/meteorologi/prakiraan-meteorologi HTTP/1.1"] [severity "NOTICE"] [hostname "staklim-jatim.bmkg.go.id"] [uri "/index.php/prakiraan-cuaca-transportasi-darat-jawa-jalur-utara-dan-selatan/113-akar/meteorologi/prakiraan-meteorologi"] [unique_id "aiJSYcp06VWSvMY7wPgVUQAAAJE"] [staklim-jatim.bmkg.g ... show less	Email Spam Hacking
🇮🇹 A000Z	2026-05-28 20:09:56 (1 month ago)	Fail2Ban: 39.194.2.47 was banned for Aggressive Bad Bot detected by Nginx/Fail2Ban. UA: Mozilla/5.0 ... show more Fail2Ban: 39.194.2.47 was banned for Aggressive Bad Bot detected by Nginx/Fail2Ban. UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.0.0 Safari/537.36 show less	Bad Web Bot

Showing 1 to 9 of 9 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇺🇸 216.25.89.65

🇷🇺 109.172.31.144

🇺🇸 45.92.229.21

🇰🇷 8.220.202.165

🇺🇸 3.84.236.251

🇳🇱 2a09:bac5:4e25:c8::14:2be

🇰🇷 220.88.220.59

🇦🇺 203.196.42.114

🇺🇸 172.208.25.111

🇺🇸 161.35.120.4

🇸🇬 148.66.142.9

🇺🇸 147.185.132.199

🇻🇳 113.160.204.242

🇰🇷 221.156.126.1

🇹🇼 198.235.24.46

🇫🇷 141.95.170.136

🇹🇭 103.4.217.13

🇩🇪 88.214.25.136

🇮🇱 85.250.22.137

🇳🇱 45.148.10.152