JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 102.0.23.220

102.0.23.220 was found in our database!

This IP was reported 64 times. Confidence of Abuse is 40%: ?

40%

ISP	Allocated to Airtel Kenya Mobile Broadband and Fixed internet
Usage Type	Fixed Line ISP
ASN	AS36926
Hostname(s)	220-23-0-102.r.airtelkenya.com
Domain Name	airtel.in
Country	🇰🇪 Kenya
City	Nairobi, Nairobi County

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 102.0.23.220

Whois 102.0.23.220

IP Abuse Reports for 102.0.23.220:

This IP address has been reported a total of 64 times from 45 distinct sources. 102.0.23.220 was first reported on July 31st 2025, and the most recent report was 10 hours ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇺🇸 floreriaexpress	2026-07-23 00:04:53 (10 hours ago)	FakeADS-Anti: country:KE \| https://floreriaexpresschile.cl/catalogo/page/4/?per_page=12&per_row=3&sh ... show more FakeADS-Anti: country:KE \| https://floreriaexpresschile.cl/catalogo/page/4/?per_page=12&per_row=3&shop_view=grid&shortcode=1&wmc-currency=CLP show less	Bad Web Bot
🇩🇪 pltcldvlpr	2026-07-19 16:30:20 (3 days ago)	Bogus Useragent: 102.0.23.220 - - [19/Jul/2026:18:30:19 +0200] "GET /protocol?id=sh_17_61&paragraph= ... show more Bogus Useragent: 102.0.23.220 - - [19/Jul/2026:18:30:19 +0200] "GET /protocol?id=sh_17_61&paragraph=12315430&seq=9 HTTP/1.1" 444 0 "-" "Mozilla/5.0 (compatible; MSIE 8.0; Windows 98; Win 9x 4.90; Trident/5.1)" asn=36926 org="Airtel Networks Kenya Limited" country=KE ... show less	Bad Web Bot
🇺🇸 Hmorrin	2026-07-12 11:15:34 (1 week ago)		Port Scan
🇺🇸 stechusa	2026-07-09 17:14:27 (1 week ago)	[Askari] \| Behavior: Slow-read attack, HTTP/1.1 over TLS, Concurrent page load during attack, Target ... show more [Askari] \| Behavior: Slow-read attack, HTTP/1.1 over TLS, Concurrent page load during attack, Targeting specific pages, URL template abuse show less	Bad Web Bot DDoS Attack
🇺🇸 kosada.com	2026-07-06 16:55:42 (2 weeks ago)	Web bot: denial-of-service flood	DDoS Attack Bad Web Bot
🇺🇸 nodepile	2026-06-30 17:46:39 (3 weeks ago)	Requests denied due to active blacklist hits (tenant=82 method=GET path=/catalogsearch/result/index/ ... show more Requests denied due to active blacklist hits (tenant=82 method=GET path=/catalogsearch/result/index/ ua='Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36') show less	Web App Attack Exploited Host
🇺🇸 kosada.com	2026-06-29 09:05:29 (3 weeks ago)	Web bot: denial-of-service flood	DDoS Attack Bad Web Bot
🇩🇪 Vegascosmetics	2026-06-20 10:29:32 (1 month ago)	(Kingcopy.org-AI-IDS-Report):IP automatically blocked after obfuscated redirect. Vegas Security	DDoS Attack Hacking Exploited Host
🇪🇸 el-brujo	2026-06-12 04:48:28 (1 month ago)	Cloudflare WAF: Request Path: /warzone/hack_web-site/msg2016103/ Request Query: ?PHPSESSID=db4qelk38 ... show more Cloudflare WAF: Request Path: /warzone/hack_web-site/msg2016103/ Request Query: ?PHPSESSID=db4qelk38r4c9728ps3tb3omns Host: forum.elhacker.net userAgent: Mozilla/5.0 (compatible; MSIE 6.0; Windows NT 10.0; Trident/4.1) Action: log Source: firewallManaged ASN Description: Airtel Networks Kenya Limited Country: KE Method: GET Timestamp: 2026-06-12T04:48:28Z ruleId: 017d4edd6754438087991348543c4667. Report generated by Cloudflare-WAF-to-AbuseIPDB (https://github.com/MHG-LAB/Cloudflare-WAF-to-AbuseIPDB). show less	Hacking SQL Injection Web App Attack
🇺🇸 nodepile	2026-06-08 04:37:24 (1 month ago)	Requests denied due to active blacklist hits (tenant=82 method=GET path=/catalogsearch/result/index/ ... show more Requests denied due to active blacklist hits (tenant=82 method=GET path=/catalogsearch/result/index/ ua='Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36') show less	Web App Attack Exploited Host
🇩🇪 SMARTNET	2026-05-27 06:03:53 (1 month ago)	Aisuru(Mirai variant) DDoS \| Incident ID: f9eee327-63b9-4c70-8845-0c5f5dde9bdb	DDoS Attack
🇨🇭 ALPHANET	2026-05-24 15:50:02 (1 month ago)	Botnet or web spider not respecting robots.txt	DDoS Attack Exploited Host
Anonymous	2026-05-22 04:06:00 (2 months ago)	Attack Signature Blocked: /wishlist/index/add/product/12972/form_key/CfOmXQDnwwEG8CSV/img/logo.jpg ( ... show more Attack Signature Blocked: /wishlist/index/add/product/12972/form_key/CfOmXQDnwwEG8CSV/img/logo.jpg (Magento Site) (Botnet activity attributed to: Angara Technologies Group / mikhail-smirnov-79830322) show less	Web App Attack Bad Web Bot
🇺🇸 TPI-Abuse	2026-05-16 08:22:02 (2 months ago)	(mod_security) mod_security (id:210492) triggered by 102.0.23.220 (220-23-0-102.r.airtelkenya.com): ... show more (mod_security) mod_security (id:210492) triggered by 102.0.23.220 (220-23-0-102.r.airtelkenya.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat May 16 04:21:56.433094 2026] [security2:error] [pid 18075:tid 18075] [client 102.0.23.220:37304] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/composer.json" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.et.lobibilisim.com"] [uri "/vendor/phpseclib/phpseclib/composer.json"] [unique_id "aggpJCiJyXDilhKJJ_joGgAAAB0"], referer: https://www.et.lobibilisim.com/ show less	Brute-Force Bad Web Bot Web App Attack
🇩🇪 milcraft.nl	2026-05-14 19:00:04 (2 months ago)	Suspicious WooCommerce query combination detected. Not default available on websites. Matched combi ... show more Suspicious WooCommerce query combination detected. Not default available on websites. Matched combi patterns: filter_, add-to-cart=, orderby=, product_count=. Activity is consistent with high-volume request abuse. show less	DDoS Attack Web App Attack

Showing 1 to 15 of 64 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇧🇷 201.63.223.138

🇺🇸 195.184.76.67

🇨🇳 140.206.236.100

🇻🇳 116.110.149.203

🇺🇸 66.132.195.39

🇧🇪 198.235.24.135

🇺🇸 134.199.211.145

🇹🇼 111.70.49.182

🇲🇦 105.156.230.41

🇪🇸 83.41.84.182

🇺🇸 66.132.186.253

🇺🇸 64.62.156.122

🇺🇸 64.23.147.61

🇸🇬 45.78.201.248

🇬🇧 35.203.211.131

🇺🇸 35.146.155.199

🇨🇦 216.209.41.129

🇺🇸 207.90.244.26

🇬🇧 188.240.59.9

🇺🇸 162.216.150.78