JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 102.211.56.20

102.211.56.20 was found in our database!

This IP was reported 44 times. Confidence of Abuse is 45%: ?

45%

This address is a Tor exit node. Neither the owner nor the provider are directly behind the offending action.

ISP	Maxko for Gaming Development LLC
Usage Type	Data Center/Web Hosting/Transit
ASN	AS329325
Hostname(s)	vps19848.maxko-hosting.net
Domain Name	maxko.org
Country	🇿🇦 South Africa
City	Johannesburg, Gauteng

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 102.211.56.20

Whois 102.211.56.20

IP Abuse Reports for 102.211.56.20:

This IP address has been reported a total of 44 times from 27 distinct sources. 102.211.56.20 was first reported on October 25th 2025, and the most recent report was 2 days ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇮🇩 xveil	2026-07-19 18:18:14 (2 days ago)	2026-07-20T01:18:12.303305 mail-honeypot postfix/submission/smtpd[10910]: warning: vps19848.maxko-ho ... show more 2026-07-20T01:18:12.303305 mail-honeypot postfix/submission/smtpd[10910]: warning: vps19848.maxko-hosting.net[102.211.56.20]: SASL PLAIN authentication failed: authentication failure ... show less	Brute-Force
Anonymous	2026-07-17 19:01:03 (4 days ago)	Bot / scanning and/or hacking attempts: POST /xmlrpc.php HTTP/1.1	Hacking Web App Attack
🇺🇸 convos	2026-07-17 18:25:47 (4 days ago)	Auto-blocked by IT Solutions USA security proxy after malicious web-shell/backdoor scanning and atta ... show more Auto-blocked by IT Solutions USA security proxy after malicious web-shell/backdoor scanning and attack probes. Requests blocked (403). show less	Web App Attack Hacking Bad Web Bot
🇬🇧 OptimusGO	2026-07-03 03:29:09 (2 weeks ago)	Malicious activity detected: web_attack Server: commstackbc (185.127.18.66) Attack: web_attack Time ... show more Malicious activity detected: web_attack Server: commstackbc (185.127.18.66) Attack: web_attack Timestamp: 2026-07-03 04:29:09 UTC Log evidence: 102.211.56.20 - - [03/Jul/2026:04:29:08 +0100] "GET /index.php?s=/index/think%5Capp/invokefunction&function=call_user_func_array&vars[0]=md5&vars[1][]=a3233a3800f8cba9dd419d1997d27412 HTTP/1.1" 404 118 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:151.0) Gecko/20100101 Firefox/151.0" 07/03/2026-04:29:08.145134 [] [1:2400015:4510] ET DROP Spamhaus DROP Listed Traffic Inbound group 16 [] [Classification: Misc Attack] [Priority: 2] {TCP} 102.211.56.20:36328 -> 185.127.18.66:80 07/03/2026-04:29:08.145134 [] [1:2520000:6059] ET TOR Known Tor Exit Node Traffic group 1 [] [Classification: Misc Attack] [Priority: 2] {TCP} 102.211.56.20:36328 -> 185.127.18.66:80 show less	Port Scan Brute-Force
🇺🇸 xmission.com	2026-06-26 20:35:01 (3 weeks ago)	Blocked by UFW (TCP on 49919) Source port: 31614 TTL: 42 Packet length: 60 TOS: 0x08 This report (f ... show more Blocked by UFW (TCP on 49919) Source port: 31614 TTL: 42 Packet length: 60 TOS: 0x08 This report (for 102.211.56.20) was generated by: https://github.com/sefinek/UFW-AbuseIPDB-Reporter show less	Port Scan
🇩🇪 tentwentyfour	2026-06-24 17:59:11 (3 weeks ago)	Blocked for brute-forcing WordPress log-in	Brute-Force Web App Attack
🇺🇸 xmission.com	2026-06-22 23:31:39 (4 weeks ago)	Blocked by UFW (TCP on 60763) Source port: 56750 TTL: 42 Packet length: 60 TOS: 0x08 This report (f ... show more Blocked by UFW (TCP on 60763) Source port: 56750 TTL: 42 Packet length: 60 TOS: 0x08 This report (for 102.211.56.20) was generated by: https://github.com/sefinek/UFW-AbuseIPDB-Reporter show less	Port Scan
🇺🇸 TPI-Abuse	2026-06-22 15:56:26 (4 weeks ago)	(mod_security) mod_security (id:210492) triggered by 102.211.56.20 (vps19848.maxko-hosting.net): 1 i ... show more (mod_security) mod_security (id:210492) triggered by 102.211.56.20 (vps19848.maxko-hosting.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jun 22 11:56:14.373271 2026] [security2:error] [pid 11666:tid 11666] [client 102.211.56.20:21818] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "autodiscover.juyla.com"] [uri "/.git/config"] [unique_id "ajlbHlSY7I7RIHDtucNCWQAAABk"] show less	Brute-Force Bad Web Bot Web App Attack
🇧🇷 ICS Labs	2026-06-22 15:40:25 (4 weeks ago)	ICS Labs identified 102.211.56.20 as a malicious indicator from threat intelligence.	DDoS Attack Port Scan Hacking Brute-Force Exploited Host
🇪🇸 gnom4ik	2026-06-21 08:16:44 (1 month ago)	ban-reviewer auto report; ip=102.211.56.20; scenario=ssh:bruteforce; scenario_context=ssh:bruteforce ... show more ban-reviewer auto report; ip=102.211.56.20; scenario=ssh:bruteforce; scenario_context=ssh:bruteforce,tor-exit-nodes; verdict=valid_ban; confidence=0.92; categories=18,22; active_decisions=2; lookback_decisions=2; nginx_requests=0; appsec_matches=0; auth_events=0; kernel_events=0; signals=ip_decision_count_high show less	Brute-Force SSH
🇦🇺 MAGIC	2026-06-14 00:30:26 (1 month ago)	VM1 Bad user agents ignoring web crawling rules. Draing bandwidth	DDoS Attack Bad Web Bot
🇺🇸 mnsf	2026-06-10 05:06:16 (1 month ago)	Abuse Detected (1)	Brute-Force Web App Attack
🇺🇸 xmission.com	2026-06-01 04:09:59 (1 month ago)	Blocked by UFW (TCP on 65535) Source port: 34010 TTL: 43 Packet length: 60 TOS: 0x08 This report (f ... show more Blocked by UFW (TCP on 65535) Source port: 34010 TTL: 43 Packet length: 60 TOS: 0x08 This report (for 102.211.56.20) was generated by: https://github.com/sefinek/UFW-AbuseIPDB-Reporter show less	Port Scan
🇳🇱 Kotiacat_one	2026-05-24 03:36:28 (1 month ago)	2026-05-24T06:36:28.281670+03:00 kotiacat.nexus sshd-session[10134]: Invalid user 1 from 102.211.56. ... show more 2026-05-24T06:36:28.281670+03:00 kotiacat.nexus sshd-session[10134]: Invalid user 1 from 102.211.56.20 port 55212 ... show less	Brute-Force SSH
🇬🇧 gbzret4d	2026-05-06 06:03:57 (2 months ago)	Honeypot [uk-production01]: Brute-force attack detected on 22/SSH • Credential used: root:root • Num ... show more Honeypot [uk-production01]: Brute-force attack detected on 22/SSH • Credential used: root:root • Number of login attempts: 1 • 2 command(s) were executed during the session • Client: SSH-2.0-Go show less	SSH Hacking

Showing 1 to 15 of 44 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇧🇷 187.19.254.104

🇺🇸 185.149.26.62

🇺🇸 172.253.9.148

🇺🇸 147.185.132.54

🇨🇳 101.96.192.88

🇺🇸 72.56.166.187

🇧🇷 205.210.31.231

🇺🇸 184.105.139.86

🇧🇷 179.176.210.17

🇺🇸 147.185.132.52

🇺🇸 108.29.196.188

🇺🇸 107.175.21.17

🇺🇸 93.157.28.41

🇩🇪 213.209.159.241

🇪🇹 196.189.116.182

🇺🇸 195.184.76.87

🇺🇸 195.140.178.4

🇵🇸 176.65.19.219

🇺🇸 147.185.132.183

🇺🇸 147.185.132.37