JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 102.218.40.17

102.218.40.17 was found in our database!

This IP was reported 63 times. Confidence of Abuse is 90%: ?

90%

ISP	IMVULA ITECHNOLOGIES (PTY) LTD
Usage Type	Fixed Line ISP
ASN	AS328942
Domain Name	imvulaitech.co.za
Country	🇿🇦 South Africa
City	Newcastle, KwaZulu-Natal

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 102.218.40.17

Whois 102.218.40.17

IP Abuse Reports for 102.218.40.17:

This IP address has been reported a total of 63 times from 33 distinct sources. 102.218.40.17 was first reported on March 8th 2026, and the most recent report was 20 hours ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇳🇱 Site.eu	2026-06-18 20:47:32 (20 hours ago)	Repeated wp-login/xmlrpc attempts	Brute-Force SSH
🇺🇸 integrantservices.com	2026-06-18 19:45:57 (21 hours ago)	(wordpress) Failed wordpress login from 102.218.40.17 (-)	Brute-Force
Anonymous	2026-06-18 18:16:54 (22 hours ago)	[server.tmg.gr] httpd-xmlrpc-post: sites=tmg.gr; logs=/var/log/httpd/domains/tmg.gr.log; samples=/xm ... show more [server.tmg.gr] httpd-xmlrpc-post: sites=tmg.gr; logs=/var/log/httpd/domains/tmg.gr.log; samples=/xmlrpc.php show less	Brute-Force Web App Attack
🇺🇸 TPI-Abuse	2026-06-18 16:44:35 (1 day ago)	(mod_security) mod_security (id:240335) triggered by 102.218.40.17 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:240335) triggered by 102.218.40.17 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jun 18 12:44:29.735062 2026] [security2:error] [pid 2029:tid 2029] [client 102.218.40.17:50891] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 102.218.40.17 (+1 hits since last alert)\|roguetechhub.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "roguetechhub.com"] [uri "/xmlrpc.php"] [unique_id "ajQgbUlIN_zT0JgYG9jx2QAAAA0"] show less	Brute-Force Bad Web Bot Web App Attack
🇫🇷 masterguru	2026-06-18 09:59:01 (1 day ago)	xmlrpc request blocked, no referer. Pattern match "xmlrpc.php" at REQUEST_URI. (88010-201)	Hacking
🇺🇸 TPI-Abuse	2026-06-16 23:35:10 (2 days ago)	(mod_security) mod_security (id:240335) triggered by 102.218.40.17 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:240335) triggered by 102.218.40.17 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jun 16 19:35:04.683407 2026] [security2:error] [pid 7549:tid 7575] [client 102.218.40.17:56040] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 102.218.40.17 (+1 hits since last alert)\|lamcohomecare.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "lamcohomecare.com"] [uri "/xmlrpc.php"] [unique_id "ajHdqIpcQmcE6ZcBAJAJdQAAABE"] show less	Brute-Force Bad Web Bot Web App Attack
🇫🇮 YF	2026-06-16 23:00:18 (2 days ago)	xmlrpc.php Potential DDoS or brute force	DDoS Attack Brute-Force
Anonymous	2026-06-16 21:52:30 (2 days ago)	(wordpress) Failed wordpress login from 102.218.40.17 (-)	Brute-Force
🇳🇱 ConsulHosting	2026-06-16 14:36:44 (3 days ago)	Excessive failed CAPTCHA attempts (CAPTCHA DoS)	Web App Attack
🇩🇪 milcraft.nl	2026-06-15 14:00:26 (4 days ago)	Repeated requests targeting login endpoints, indicating potential brute-force or credential-stuffing ... show more Repeated requests targeting login endpoints, indicating potential brute-force or credential-stuffing attempts. Related signal: Requests targeting the XML-RPC endpoint, commonly used in amplification attacks or brute-force login attempts.. Activity... show less	Brute-Force Web App Attack
🇫🇷 masterguru	2026-06-15 12:12:44 (4 days ago)	xmlrpc request blocked, no referer. Pattern match "xmlrpc.php" at REQUEST_URI. (88010-201)	Hacking
🇩🇪 bazter.pro	2026-06-15 09:40:21 (4 days ago)	Fail2Ban: plesk-bot-aggressive - 15 failures	Port Scan Bad Web Bot Web App Attack
🇩🇪 Marc	2026-06-14 15:58:58 (5 days ago)	102.218.40.17 - - [14/Jun/2026:17:57:48 +0200] "POST /xmlrpc.php HTTP/1.1" 403 3719 "-" "WordPress.c ... show more 102.218.40.17 - - [14/Jun/2026:17:57:48 +0200] "POST /xmlrpc.php HTTP/1.1" 403 3719 "-" "WordPress.com; https://wordpress.com" 102.218.40.17 - - [14/Jun/2026:17:58:17 +0200] "POST /xmlrpc.php HTTP/1.1" 403 3720 "-" "Jetpack by WordPress.com" 102.218.40.17 - - [14/Jun/2026:17:58:57 +0200] "POST /xmlrpc.php HTTP/1.1" 403 3718 "-" "WordPress.com; https://wordpress.com" show less	Brute-Force Web App Attack
🇩🇪 milcraft.nl	2026-06-14 13:59:29 (5 days ago)	Requests targeting the XML-RPC endpoint, commonly used in amplification attacks or brute-force login ... show more Requests targeting the XML-RPC endpoint, commonly used in amplification attacks or brute-force login attempts. Activity is consistent with brute-force activity. show less	Brute-Force Web App Attack
Anonymous	2026-06-12 22:59:48 (6 days ago)	[redacted] 102.218.40.17 - - [13/Jun/2026:00:58:38 +0200] "POST /xmlrpc.php HTTP/1.1" 405 428 "-" "W ... show more [redacted] 102.218.40.17 - - [13/Jun/2026:00:58:38 +0200] "POST /xmlrpc.php HTTP/1.1" 405 428 "-" "WordPress.com; https://wordpress.com" [redacted] 102.218.40.17 - - [13/Jun/2026:00:58:54 +0200] "POST /xmlrpc.php HTTP/1.1" 405 428 "-" "Jetpack by WordPress.com" [redacted] 102.218.40.17 - - [13/Jun/2026:00:59:10 +0200] "POST /xmlrpc.php HTTP/1.1" 405 428 "-" "Jetpack by WordPress.com" [redacted] 102.218.40.17 - - [13/Jun/2026:00:59:28 +0200] "POST /xmlrpc.php HTTP/1.1" 405 428 "-" "Jetpack by WordPress.com" [redacted] 102.218.40.17 - - [13/Jun/2026:00:59:46 +0200] "POST /xmlrpc.php HTTP/1.1" 405 428 "-" "Jetpack by WordPress.com (Jetpack 13.0; WordPress 6.3)" ... show less	Hacking Web App Attack

Showing 1 to 15 of 63 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇧🇷 186.225.225.107

🇲🇾 180.74.219.44

🇧🇷 177.44.71.58

🇳🇱 176.65.148.197

🇺🇸 172.239.64.86

🇭🇰 154.89.156.60

🇨🇳 121.56.212.193

🇺🇸 72.167.48.122

🇪🇸 37.14.180.135

🇯🇵 5.104.81.3

🇺🇸 2602:80d:1008::50

🇰🇷 211.226.144.20

🇺🇸 193.3.53.3

🇸🇬 172.253.211.83

🇹🇷 159.146.54.24

🇳🇱 45.198.224.244

🇩🇪 193.36.85.91

🇫🇮 147.185.133.186

🇩🇪 141.95.54.157

🇨🇳 115.190.2.201