JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 102.221.220.87

102.221.220.87 was found in our database!

This IP was reported 25 times. Confidence of Abuse is 24%: ?

24%

ISP	Letaba Wireless Internet
Usage Type	Fixed Line ISP
ASN	AS328638
Domain Name	letaba.net
Country	🇿🇦 South Africa
City	Thohoyandou, Limpopo

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 102.221.220.87

Whois 102.221.220.87

IP Abuse Reports for 102.221.220.87:

This IP address has been reported a total of 25 times from 15 distinct sources. 102.221.220.87 was first reported on September 2nd 2021, and the most recent report was 2 days ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇺🇸 TPI-Abuse	2026-09-16 17:17:17 (2 days ago)	(mod_security) mod_security (id:210350) triggered by 102.221.220.87 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210350) triggered by 102.221.220.87 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Sep 16 13:17:13.256656 2026] [security2:error] [pid 32315:tid 32315] [client 102.221.220.87:53606] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close\|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close\|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found\|\|americancryonics.org\|F\|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "americancryonics.org"] [uri "/"] [unique_id "aqrPGczRcVT5adjio2p90wAAAAQ"], referer: https://crinco.org/ show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 gui-ying233	2026-09-07 03:39:25 (1 week ago)	Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Sa ... show more Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36 show less	Bad Web Bot
🇺🇸 gui-ying233	2026-09-03 13:49:52 (2 weeks ago)	Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0. ... show more Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36 show less	Bad Web Bot
🇺🇸 gui-ying233	2026-09-01 00:36:24 (2 weeks ago)	Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0. ... show more Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36 show less	Bad Web Bot
🇺🇸 kosada.com	2026-08-28 02:40:41 (3 weeks ago)	Web bot: denial-of-service flood	DDoS Attack Bad Web Bot
🇺🇸 kosada.com	2026-08-25 09:20:50 (3 weeks ago)	Web bot: denial-of-service flood	DDoS Attack Bad Web Bot
🇺🇸 gui-ying233	2026-08-20 14:44:32 (4 weeks ago)	Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Sa ... show more Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 show less	Bad Web Bot
🇺🇸 kosada.com	2026-08-11 03:36:33 (1 month ago)	Web bot: denial-of-service flood	DDoS Attack Bad Web Bot
🇩🇪 LRob	2026-08-05 06:31:01 (1 month ago)	CrowdSec: Distributed L7 HTTP flood on WordPress 'The Events Calendar' AJAX endpoints (request_forma ... show more CrowdSec: Distributed L7 HTTP flood on WordPress 'The Events Calendar' AJAX endpoints (request_format~json) - DDoS \| req: /calendrier-2/action~agenda/time_limit~1763852400/cat_ids~132,190/tag_ids~471,484,482,677,717,589,454/request_format~json/ \| UA: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36 show less	DDoS Attack Web App Attack
🇺🇸 kosada.com	2026-07-29 03:20:52 (1 month ago)	Web bot: denial-of-service flood	DDoS Attack Bad Web Bot
🇺🇸 gui-ying233	2026-07-25 00:01:26 (1 month ago)	Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0. ... show more Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 show less	Bad Web Bot
🇺🇸 kosada.com	2026-07-06 18:30:55 (2 months ago)	Web bot: denial-of-service flood	DDoS Attack Bad Web Bot
🇺🇸 kosada.com	2026-06-26 19:16:11 (2 months ago)	Web bot: denial-of-service flood	DDoS Attack Bad Web Bot
🇺🇸 matt	2026-03-03 23:08:54 (6 months ago)	DDOS attack with query parameters attempting to overload WordPress site.	DDoS Attack
🇮🇩 hermawan	2026-01-03 07:07:10 (8 months ago)	[Sat Jan 03 14:07:10.453997 2026] [security2:error] [pid 90051:tid 140533940053696] [client 102.221. ... show more [Sat Jan 03 14:07:10.453997 2026] [security2:error] [pid 90051:tid 140533940053696] [client 102.221.220.87:34015] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "image/heif" at REQUEST_HEADERS:Accept. [file "/etc/modsecurity/coreruleset-4.20.0/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "425"] [id "440009"] [msg " Image Heif"] [data " Matched Data ARGS charset: - Matched Data TX.1: found within Content-Type multipart form Matched Data: text/html found within REQUEST_HEADERS:Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/heif,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 request_line = GET /index.php/prakiraan-iklim/agroklimatologi/kalender-tanam/2385-kalender-tanam-katam-terpadu-pulau-sulawesi/kalender-tanam-katam-terpadu-provinsi-gorontalo/kalender-tanam-katam-terpadu-kabupa..."] [hostname "staklim-jatim.bmkg.go.id"] [uri "/index.php/prakiraan-iklim/agroklimatologi/kalender-tanam/2385-kalender-tanam ... show less	Hacking Web App Attack

Showing 1 to 15 of 25 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇸🇪 212.107.150.103

🇳🇱 77.239.124.179

🇺🇸 64.62.197.157

🇰🇷 61.76.112.4

🇱🇻 213.176.24.46

🇧🇷 205.210.31.231

🇺🇸 186.179.35.40

🇺🇸 144.172.93.238

🇳🇱 107.189.27.179

🇳🇱 93.123.109.6

🇫🇷 85.217.140.12

🇫🇷 79.137.76.59

🇧🇬 79.124.59.78

🇺🇸 71.62.97.212

🇺🇸 64.62.197.131

🇩🇪 63.177.105.95

🇳🇱 217.104.71.241

🇺🇸 198.74.56.6

🇧🇷 186.212.236.152

🇺🇸 158.94.187.25