JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 94.249.78.80

94.249.78.80 was found in our database!

This IP was reported 18 times. Confidence of Abuse is 97%: ?

97%

ISP	Jordan Telecom Group (Orange)
Usage Type	Fixed Line ISP
ASN	AS8376
Hostname(s)	94.249.x.80.go.com.jo
Domain Name	go.com.jo
Country	🇯🇴 Jordan
City	Suwaylih, Balqa

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 94.249.78.80

Whois 94.249.78.80

IP Abuse Reports for 94.249.78.80:

This IP address has been reported a total of 18 times from 17 distinct sources. 94.249.78.80 was first reported on July 9th 2026, and the most recent report was 2 hours ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇩🇪 ghostwarriors	2026-07-14 01:50:22 (2 hours ago)	Webpage scraping	Brute-Force Bad Web Bot Web App Attack
Anonymous	2026-07-14 01:40:46 (2 hours ago)	Fail2Ban: WordPress XML-RPC brute-force attack detected.	Bad Web Bot Web App Attack
🇨🇭 zynex	2026-07-13 21:41:01 (6 hours ago)	URL Probing: /xmlrpc.php	Web App Attack
🇩🇪 LRob	2026-07-13 21:30:23 (6 hours ago)	CrowdSec: crowdsecurity/http-bf-wordpress_bf_xmlrpc \| req: /xmlrpc.php \| UA: Mozilla/5.0 (Windows NT ... show more CrowdSec: crowdsecurity/http-bf-wordpress_bf_xmlrpc \| req: /xmlrpc.php \| UA: Mozilla/5.0 (Windows NT 10.0; arm64) AppleWebKit/537.36 (KHTML, like Gecko) Safari/12.0.0.0 Safari/537.36 show less	Brute-Force Web App Attack
🇺🇸 TPI-Abuse	2026-07-13 21:05:30 (7 hours ago)	(mod_security) mod_security (id:225170) triggered by 94.249.78.80 (94.249.x.80.go.com.jo): 1 in the ... show more (mod_security) mod_security (id:225170) triggered by 94.249.78.80 (94.249.x.80.go.com.jo): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jul 13 17:05:25.516781 2026] [security2:error] [pid 25817:tid 25817] [client 94.249.78.80:64740] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)\|\|dandksupply.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "dandksupply.com"] [uri "/wp-json/wp/v2/users"] [unique_id "alVTFVhkVYd9w8CudmgkeAAAACY"] show less	Brute-Force Bad Web Bot Web App Attack
🇦🇺 screwlooseit.com.au	2026-07-13 20:56:23 (7 hours ago)	Blocked by CSF 13 firewall - Rule: XMLRPC JO/Hashemite Kingdom of Jordan/94.249.x.80.go.com.jo	Web App Attack
🇺🇸 TPI-Abuse	2026-07-13 20:39:29 (7 hours ago)	(mod_security) mod_security (id:225170) triggered by 94.249.78.80 (94.249.x.80.go.com.jo): 1 in the ... show more (mod_security) mod_security (id:225170) triggered by 94.249.78.80 (94.249.x.80.go.com.jo): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jul 13 16:39:23.227274 2026] [security2:error] [pid 386:tid 386] [client 94.249.78.80:56540] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)\|\|coolcustomproducts.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "coolcustomproducts.com"] [uri "/wp-json/wp/v2/users"] [unique_id "alVM-2ZoSWOwZN9JXx5ooQAAAAo"] show less	Brute-Force Bad Web Bot Web App Attack
Anonymous	2026-07-13 14:18:28 (14 hours ago)	94.249.78.80 - - [13/Jul/2026:14:18:28 +0000] "POST /xmlrpc.php HTTP/1.1" 404 34513 "-" "Mozilla/5.0 ... show more 94.249.78.80 - - [13/Jul/2026:14:18:28 +0000] "POST /xmlrpc.php HTTP/1.1" 404 34513 "-" "Mozilla/5.0 (Windows NT 10.0; arm64) AppleWebKit/537.36 (KHTML, like Gecko) Edge/86.0.0.0 Safari/537.36" ... show less	Bad Web Bot Web App Attack
🇩🇪 Vegascosmetics	2026-07-13 11:35:10 (16 hours ago)	(Kingcopy.org-AI-IDS-Report):IP automatically blocked after PHP/webshell probe. Vegas Security	Hacking Web App Attack
Anonymous	2026-07-13 08:46:27 (19 hours ago)	[server.tmg.gr] httpd-xmlrpc-post: sites=www.physio-kinisi.gr; logs=/var/log/httpd/domains/physio-ki ... show more [server.tmg.gr] httpd-xmlrpc-post: sites=www.physio-kinisi.gr; logs=/var/log/httpd/domains/physio-kinisi.gr.log; samples=/xmlrpc.php show less	Brute-Force Web App Attack
Anonymous	2026-07-12 00:00:47 (2 days ago)	[redacted] 94.249.78.80 - - [12/Jul/2026:01:59:57 +0200] "POST /xmlrpc.php HTTP/1.1" 200 418 "-" "Mo ... show more [redacted] 94.249.78.80 - - [12/Jul/2026:01:59:57 +0200] "POST /xmlrpc.php HTTP/1.1" 200 418 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7; x64) AppleWebKit/537.36 (KHTML, like Gecko) Opera/78.0.0.0 Safari/537.36" [redacted] 94.249.78.80 - - [12/Jul/2026:02:00:00 +0200] "POST /xmlrpc.php HTTP/1.1" 200 418 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Safari/537.36" [redacted] 94.249.78.80 - - [12/Jul/2026:02:00:16 +0200] "POST /xmlrpc.php HTTP/1.1" 200 418 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; arm64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36" [redacted] 94.249.78.80 - - [12/Jul/2026:02:00:28 +0200] "POST /xmlrpc.php HTTP/1.1" 200 418 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7; x86) AppleWebKit/537.36 (KHTML, like Gecko) Firefox/73.0.0.0 Safari/537.36" [redacted] 94.249.78.80 - - [12/Jul/2026:02:00:31 +0200] "POST /xmlrpc.php HTTP/1.1" 200 418 "-" "Mozilla/5.0 (Linux; Android 10; ... show less	Hacking Web App Attack
Anonymous	2026-07-11 23:26:24 (2 days ago)	Fail2Ban Log Report 94.249.78.80 - [12/Jul/2026:01:26:20 +0200] "POST /xmlrpc.php HTTP/2.0" 301 162 ... show more Fail2Ban Log Report 94.249.78.80 - [12/Jul/2026:01:26:20 +0200] "POST /xmlrpc.php HTTP/2.0" 301 162 "-" "Mozilla/5.0 (Windows NT 6.3; x64) AppleWebKit/537.36 (KHTML, like Gecko) Edge/99.0.0.0 Safari/537.36" "-" "94.249.78.80" 94.249.78.80 - [12/Jul/2026:01:26:20 +0200] "GET /xmlrpc.php HTTP/2.0" 403 1813 "-" "Mozilla/5.0 (Windows NT 6.3; x64) AppleWebKit/537.36 (KHTML, like Gecko) Edge/99.0.0.0 Safari/537.36" "2.51" "94.249.78.80" ... show less	Port Scan Hacking Web App Attack
🇩🇪 4server	2026-07-11 19:23:51 (2 days ago)	[SatJul1121:23:49.1336792026][security2:error][pid2955433:tid2955542][client94.249.78.80:0]ModSecuri ... show more [SatJul1121:23:49.1336792026][security2:error][pid2955433:tid2955542][client94.249.78.80:0]ModSecurity:Accessdeniedwithcode403\(phase1\).Stringmatch\"/xmlrpc.php\"atREQUEST_URI.[file\"/etc/apache2/conf.d/modsec_custom_rules.conf\"][line\"170\"][id\"960024\"][msg\"XML-RPCdisabled\"][hostname\"acquaallaspina.ch\"][uri\"/xmlrpc.php\"][unique_id\"alKYRaskYq_GSTRWhT0eRgAAANA\"] show less	Port Scan Brute-Force Web App Attack
🇳🇱 ipoac.nl	2026-07-11 11:02:26 (2 days ago)	-:443 94.249.78.80 - - [11/Jul/2026:13:02:24 +0200] - "POST /xmlrpc.php HTTP/1.1" 404 6423 "-" "Mozi ... show more -:443 94.249.78.80 - - [11/Jul/2026:13:02:24 +0200] - "POST /xmlrpc.php HTTP/1.1" 404 6423 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7; x86) AppleWebKit/537.36 (KHTML, like Gecko) Edge/84.0.0.0 Safari/537.36" show less	Bad Web Bot
🇩🇪 big-cloud.nl	2026-07-11 11:00:27 (2 days ago)	Try to access /xmlrpc.php	Web App Attack

Showing 1 to 15 of 18 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇳🇱 45.148.10.25

🇶🇦 2600:1900:4260:40e::165

🇮🇳 2406:7400:ff03:8a6:8f0:1e6f:30:b945

🇮🇳 2401:4900:c117:26a4:8115:738d:a2db:927f

🇺🇸 152.32.205.184

🇨🇳 106.63.26.27

🇮🇳 103.120.189.74

🇫🇷 91.231.89.201

🇮🇳 64.227.190.95

🇨🇳 60.182.229.129

🇨🇳 60.179.87.43

🇬🇧 35.203.211.9

🇧🇪 34.14.122.221

🇬🇧 31.14.254.91

🇺🇸 20.168.6.85

🇺🇸 2604:a880:2:d1:0:1:51e3:3001

🇺🇸 2600:3c03::2000:15ff:fe4c:8fd2

🇷🇺 172.68.10.197

🇭🇰 150.5.128.66

🇨🇳 60.177.3.244