JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

102.254.0.5

Activity Trending Down

Abuse Confidence Score

26% Elevated

16 reports

14 reporters · latest 3 weeks ago

ISP: Telkom SA Ltd.
Usage Type: Mobile ISP
ASN: AS37457
Domain Name: telkom.co.za
Country: 🇿🇦 South Africa
City: Johannesburg, Gauteng

ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report Whois

Example preview

Account required for the enhanced features Log in Sign up

Abuse Reports

Export reports CSV

Total reports

16 from 14 distinct reporters

First reported

November 17th 2025

Most recent report

3 weeks ago

Last 60 days

Top reporter locations 🇺🇸 United States of America 3 🇩🇪 Germany 2 🇫🇷 France 1

Most common categories Web App Attack 5 Bad Web Bot 4 Brute-Force 3 Port Scan 1 FTP Brute-Force 1

Old reports The most recent abuse report for this IP address is from 3 weeks ago. It is possible that this IP is no longer involved in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
Anonymous	2026-10-23 12:47:01 UTC · (3 weeks ago)	WordPress login / xmlrpc probing across multiple sites	Web App Attack
🇳🇱 maxxsense	2026-10-21 12:12:57 UTC · (3 weeks ago)	(wordpress) Failed wordpress login from 102.254.0.5 (-)	Brute-Force
🇮🇹 CoreTech srl	2026-10-20 06:13:57 UTC · (3 weeks ago)	cloudlinux2 fail2ban: 2026-10-20 08:08:59,529 fail2ban.filter [1957]: INFO [plesk-proftpd] Found 217.60.184.56 - 2026-10-20 08:08:59cloudlinux2 fail2ban: 2026-10-20 08:08:57,450 fail2ban.filter [1957]: INFO [plesk-proftpd] Found ... show more cloudlinux2 fail2ban: 2026-10-20 08:08:59,529 fail2ban.filter [1957]: INFO [plesk-proftpd] Found 217.60.184.56 - 2026-10-20 08:08:59cloudlinux2 fail2ban: 2026-10-20 08:08:57,450 fail2ban.filter [1957]: INFO [plesk-proftpd] Found 146.56.251.231 - 2026-10-20 08:08:57cloudlinux2 fail2ban: 2026-10-20 08:09:38,392 fail2ban.filter [1957]: INFO [plesk-proftpd] Found 185.243.242.252 - 2026-10-20 08:09:38cloudlinux2 fail2ban: 2026-10-20 08:10:05,583 fail2ban.filter [1957]: INFO [plesk-wordpress] Found 195.211.213.202 - 2026-10-20 08:10:04cloudlinux2 fail2ban: 2026-10-20 08:10:17,144 fail2ban.filter [1957]: INFO [plesk-wordpress] Found 117.96.40.124 - 2026-10-20 08:10:16cloudlinux2 fail2ban: 2026-10-20 08:10:29,248 fail2ban.filter [1957]: INFO [plesk-wordpress] Found 89.250.167.5 - 2026-10-20 08:10:29cloudlinux2 fail2ban: 2026-10-20 08:10:24,203 fail2ban.filter [1957]: INFO [plesk-wordpress] Found 201.159.209.103 - 2026-10-20 08:10:23cloudlinu show less	FTP Brute-Force Web App Attack
🇺🇸 TPI-Abuse	2026-09-30 10:31:26 UTC · (1 month ago)	(mod_security) mod_security (id:210350) triggered by 102.254.0.5 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Sep 30 06:31:20.489658 2026] [security2:error] [pid 18503:tid 18512] [client 102.254.0.5:47155] ModSe ... show more (mod_security) mod_security (id:210350) triggered by 102.254.0.5 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Sep 30 06:31:20.489658 2026] [security2:error] [pid 18503:tid 18512] [client 102.254.0.5:47155] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close\|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close\|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found\|\|madtruckerbill.com\|F\|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "madtruckerbill.com"] [uri "/"] [unique_id "arzk-ElJCijGFH_wg7XJwAAAAQY"], referer: https://mybacklinks.website/dir/professional-seo-backlinks-128094 show less	Brute-Force Bad Web Bot Web App Attack
Anonymous	2026-09-27 10:35:25 UTC · (1 month ago)	denied traffic to a honeypot network. destination port 23.	Port Scan Hacking
🇺🇸 鬼影233	2026-09-24 22:12:09 UTC · (1 month ago)	Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36	Bad Web Bot
🇫🇷 SpaceHost-Server	2026-09-22 22:14:08 UTC · (1 month ago)		Brute-Force Web App Attack
🇺🇸 鬼影233	2026-09-22 07:03:27 UTC · (1 month ago)	Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36	Bad Web Bot
🇩🇪 FD-IX	2026-09-22 03:52:34 UTC · (1 month ago)	Fail2Ban: WordPress brute-force attack detected.	Bad Web Bot Web App Attack
🇫🇷 Zkillu	2026-08-19 22:29:29 UTC · (2 months ago)	UDP flood (DDoS) vs AS215599: 10863 pkts / 15.53 MB to UDP 80/8443 across 246 dst IP(s), 2026-08-19 21:46 to 2026-08-20 00:36 CEST. No legitimate service on these UDP ports (7-day baseline 0 GB/day). Carpet-bombing of a /24, likely botnet-compromised ... show more UDP flood (DDoS) vs AS215599: 10863 pkts / 15.53 MB to UDP 80/8443 across 246 dst IP(s), 2026-08-19 21:46 to 2026-08-20 00:36 CEST. No legitimate service on these UDP ports (7-day baseline 0 GB/day). Carpet-bombing of a /24, likely botnet-compromised host. Evidence: sFlow + hardware ACL counters. show less	DDoS Attack Exploited Host
🇫🇷 HaloAgencySAS	2026-08-19 22:29:29 UTC · (2 months ago)	UDP flood (DDoS) vs AS215599: 10863 pkts / 15.53 MB to UDP 80/8443 across 246 dst IP(s), 2026-08-19 21:46 to 2026-08-20 00:36 CEST. No legitimate service on these UDP ports (7-day baseline 0 GB/day). Carpet-bombing of a /24, likely botnet-compromised ... show more UDP flood (DDoS) vs AS215599: 10863 pkts / 15.53 MB to UDP 80/8443 across 246 dst IP(s), 2026-08-19 21:46 to 2026-08-20 00:36 CEST. No legitimate service on these UDP ports (7-day baseline 0 GB/day). Carpet-bombing of a /24, likely botnet-compromised host. Evidence: sFlow + hardware ACL counters. show less	DDoS Attack Exploited Host
🇺🇸 kosada.com	2026-08-19 04:20:39 UTC · (2 months ago)	Web bot: DDoS	DDoS Attack Bad Web Bot
🇩🇪 EGP Abuse Dept	2026-07-30 00:47:17 UTC · (3 months ago)	Scraping webshop URLs (webshop.beeksoogenoor.nl), likely botnet drone	Bad Web Bot Exploited Host
🇮🇹 VHosting	2026-03-26 19:57:40 UTC · (7 months ago)	Detected attack and reported by a human	Brute-Force Web App Attack SSH DDoS Attack Exploited Host Bad Web Bot
Anonymous	2026-01-16 06:21:38 UTC · (9 months ago)	scanning http requests from known botnet	Web App Attack

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown

Recently Reported IPs:

🇺🇸 195.184.76.22

🇹🇭 183.89.250.247

🇨🇦 85.217.149.12

🇨🇳 203.83.231.93

🇨🇳 180.76.243.197

🇨🇳 175.11.171.13

🇹🇼 49.158.37.29

🇩🇪 47.245.137.129

🇺🇸 40.124.179.181

🇷🇴 2.57.121.112

🇰🇷 218.234.186.2

🇺🇸 216.25.90.95

🇨🇳 106.54.62.156

🇺🇸 104.28.166.210

🇺🇸 46.110.204.7

🇺🇸 40.76.114.169

🇩🇪 34.179.205.106

🇮🇷 5.211.167.150

🇺🇸 173.71.105.42

🇺🇸 165.227.111.23