JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 102.213.135.116

102.213.135.116 was found in our database!

This IP was reported 16 times. Confidence of Abuse is 18%: ?

18%

ISP	NET99 (PTY) LTD
Usage Type	Fixed Line ISP
ASN	AS328961
Domain Name	net99.co.za
Country	🇿🇦 South Africa
City	Mogale City, Gauteng

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 102.213.135.116

Whois 102.213.135.116

IP Abuse Reports for 102.213.135.116:

This IP address has been reported a total of 16 times from 10 distinct sources. 102.213.135.116 was first reported on January 18th 2025, and the most recent report was 3 days ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇩🇪 LRob	2026-10-13 20:33:18 (3 days ago)	Shop search flood (L7 DDoS) \| path: /111-bons-plan-vtt \| query: order=product.position.asc&q=Mat%C3% ... show more Shop search flood (L7 DDoS) \| path: /111-bons-plan-vtt \| query: order=product.position.asc&q=Mat%C3%A9riau-Aluminium/Taille-XS-M \| src_port: 56664 show less	DDoS Attack Web App Attack
🇺🇸 kosada.com	2026-08-26 20:27:34 (1 month ago)	Web bot: denial-of-service flood	DDoS Attack Bad Web Bot
🇫🇷 Zkillu	2026-08-19 22:29:22 (1 month ago)	UDP flood (DDoS) vs AS215599: 1460 pkts / 2.09 MB to UDP 80/8443 across 395 dst IP(s), 2026-08-19 21 ... show more UDP flood (DDoS) vs AS215599: 1460 pkts / 2.09 MB to UDP 80/8443 across 395 dst IP(s), 2026-08-19 21:46 to 2026-08-20 00:36 CEST. No legitimate service on these UDP ports (7-day baseline 0 GB/day). Carpet-bombing of a /24, likely botnet-compromised host. Evidence: sFlow + hardware ACL counters. show less	DDoS Attack Exploited Host
🇫🇷 dmallet	2026-08-19 22:29:22 (1 month ago)	UDP flood (DDoS) vs AS215599: 1460 pkts / 2.09 MB to UDP 80/8443 across 395 dst IP(s), 2026-08-19 21 ... show more UDP flood (DDoS) vs AS215599: 1460 pkts / 2.09 MB to UDP 80/8443 across 395 dst IP(s), 2026-08-19 21:46 to 2026-08-20 00:36 CEST. No legitimate service on these UDP ports (7-day baseline 0 GB/day). Carpet-bombing of a /24, likely botnet-compromised host. Evidence: sFlow + hardware ACL counters. show less	DDoS Attack Exploited Host
🇺🇸 kosada.com	2026-08-16 17:43:58 (2 months ago)	Web bot: DDoS	DDoS Attack Bad Web Bot
🇩🇪 Vegascosmetics	2026-08-07 02:39:00 (2 months ago)	Kingcopy.org AI-IDS (Vegas Cosmetics shop): auto-blocked after deep/obfuscated attack (encoding nest ... show more Kingcopy.org AI-IDS (Vegas Cosmetics shop): auto-blocked after deep/obfuscated attack (encoding nesting / CPU-drain risk). Evidence: DEEP ATTACK: Recursive currentUrl nesting detected show less	Hacking Exploited Host Web App Attack
🇺🇸 kosada.com	2026-07-24 04:59:43 (2 months ago)	Web bot: denial-of-service flood	DDoS Attack Bad Web Bot
🇺🇸 kosada.com	2026-06-29 11:56:39 (3 months ago)	Web bot: denial-of-service flood	DDoS Attack Bad Web Bot
🇺🇸 TPI-Abuse	2026-04-06 10:14:43 (6 months ago)	(mod_security) mod_security (id:218580) triggered by 102.213.135.116 (-): 1 in the last 300 secs; Po ... show more (mod_security) mod_security (id:218580) triggered by 102.213.135.116 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Apr 06 06:14:34.347675 2026] [security2:error] [pid 18396:tid 18396] [client 102.213.135.116:55582] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:\\\\/\\\\[!+](?:[\\\\w\\\\s=_\\\\-()]+)?\\\\*\\\\/)" at ARGS:id. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/22_SQL_SQLi.conf"] [line "76"] [id "218580"] [rev "1"] [msg "COMODO WAF: MySQL in-line comment detected.\|\|cs-mall.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "SQLi"] [hostname "cs-mall.com"] [uri "/recipe-display.php"] [unique_id "adOHimFIxij71rDTTrbNQwAAAA8"] show less	Brute-Force Bad Web Bot Web App Attack
Anonymous	2026-02-07 00:27:53 (8 months ago)	scanning http requests from known botnet	Web App Attack
🇺🇸 TPI-Abuse	2026-01-31 23:26:32 (8 months ago)	(mod_security) mod_security (id:210730) triggered by 102.213.135.116 (-): 1 in the last 300 secs; Po ... show more (mod_security) mod_security (id:210730) triggered by 102.213.135.116 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Jan 31 18:26:24.789965 2026] [security2:error] [pid 2781116:tid 2781116] [client 102.213.135.116:36887] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy\|\|www.backstore.com\|F\|2"] [data ".losangelesseating.com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.backstore.com"] [uri "/www.losangelesseating.com"] [unique_id "aX6PoM4_zaGKUEZjfulBigAAAAs"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 Xarcotic	2026-01-10 12:16:22 (9 months ago)	SSH login on honeypot.	Brute-Force SSH
🇳🇱 exxos	2025-07-27 23:08:09 (1 year ago)	http-no-verb	Hacking
🇳🇱 exxos	2025-07-27 22:53:17 (1 year ago)	http-no-verb	Hacking
🇳🇱 exxos	2025-07-19 00:43:26 (1 year ago)	http-no-verb	Hacking

Showing 1 to 15 of 16 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇧🇷 177.37.71.173

🇺🇸 104.207.32.168

🇫🇷 91.231.89.65

🇦🇷 200.189.31.50

🇺🇾 179.27.97.205

🇩🇪 178.104.148.87

🇨🇳 120.240.80.44

🇭🇰 119.246.15.94

🇫🇷 91.196.152.95

🇲🇽 189.171.78.141

🇺🇸 135.233.98.30

🇨🇳 110.249.201.168

🇩🇪 93.152.221.50

🇩🇪 64.89.163.146

🇧🇪 198.235.24.136

🇳🇬 102.88.137.80

🇬🇧 86.38.187.202

🇲🇾 47.250.131.49

🇳🇱 45.115.26.149

🇳🇱 193.176.31.235