JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 105.161.44.101

105.161.44.101 was found in our database!

This IP was reported 15 times. Confidence of Abuse is 41%: ?

41%

ISP	Safaricom Limited
Usage Type	Mobile ISP
ASN	AS33771
Domain Name	safaricom.co.ke
Country	🇰🇪 Kenya
City	Nairobi, Nairobi County

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 105.161.44.101

Whois 105.161.44.101

IP Abuse Reports for 105.161.44.101:

This IP address has been reported a total of 15 times from 6 distinct sources. 105.161.44.101 was first reported on July 9th 2026, and the most recent report was 21 hours ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇩🇪 ghostwarriors	2026-07-16 22:22:53 (21 hours ago)	Webpage scraping	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-07-10 13:06:22 (1 week ago)	(mod_security) mod_security (id:240335) triggered by 105.161.44.101 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:240335) triggered by 105.161.44.101 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jul 10 09:06:17.303649 2026] [security2:error] [pid 6190:tid 6190] [client 105.161.44.101:3993] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 105.161.44.101 (+1 hits since last alert)\|globaldentalservices.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "globaldentalservices.com"] [uri "/xmlrpc.php"] [unique_id "alDuSS4AjmZf7boeWYuZ8gAAAAY"] show less	Brute-Force Bad Web Bot Web App Attack
🇩🇪 ghostwarriors	2026-07-10 12:21:22 (1 week ago)	Webpage scraping	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-07-10 10:58:52 (1 week ago)	(mod_security) mod_security (id:240335) triggered by 105.161.44.101 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:240335) triggered by 105.161.44.101 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jul 10 06:58:48.379557 2026] [security2:error] [pid 22324:tid 22339] [client 105.161.44.101:5073] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 105.161.44.101 (+1 hits since last alert)\|kemalinal.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "kemalinal.com"] [uri "/xmlrpc.php"] [unique_id "alDQaPukIU2-zpGQxIRUFQAAAAw"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-07-10 10:10:48 (1 week ago)	(mod_security) mod_security (id:240335) triggered by 105.161.44.101 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:240335) triggered by 105.161.44.101 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jul 10 06:10:42.109406 2026] [security2:error] [pid 4255:tid 4255] [client 105.161.44.101:1879] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 105.161.44.101 (+1 hits since last alert)\|thebrotherhoodlounge.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "thebrotherhoodlounge.com"] [uri "/xmlrpc.php"] [unique_id "alDFInel2ypUhEcra5Am0QAAAAs"] show less	Brute-Force Bad Web Bot Web App Attack
Anonymous	2026-07-10 10:08:04 (1 week ago)	Bot / scanning and/or hacking attempts: POST /xmlrpc.php HTTP/1.1	Hacking Web App Attack
🇦🇺 screwlooseit.com.au	2026-07-10 08:42:29 (1 week ago)	Blocked by CSF 13 firewall - Rule: XMLRPC KE/Kenya/-	Web App Attack
🇫🇷 LRob	2026-07-10 08:42:21 (1 week ago)	CrowdSec: crowdsecurity/http-bf-wordpress_bf_xmlrpc \| req: ["/xmlrpc.php"] \| UA: ["WordPress.com; ht ... show more CrowdSec: crowdsecurity/http-bf-wordpress_bf_xmlrpc \| req: ["/xmlrpc.php"] \| UA: ["WordPress.com; https://wordpress.com","Jetpack/12.5; WordPress/6.3; http://site29832595.com","Jetpack by WordPress.com (Jetpack 12.1; WordPress 6.1) show less	Brute-Force Web App Attack
Anonymous	2026-07-10 05:27:43 (1 week ago)	[redacted] 105.161.44.101 - - [10/Jul/2026:07:27:00 +0200] "POST /xmlrpc.php HTTP/1.1" 405 428 "-" " ... show more [redacted] 105.161.44.101 - - [10/Jul/2026:07:27:00 +0200] "POST /xmlrpc.php HTTP/1.1" 405 428 "-" "Jetpack by WordPress.com" [redacted] 105.161.44.101 - - [10/Jul/2026:07:27:10 +0200] "POST /xmlrpc.php HTTP/1.1" 405 428 "-" "Jetpack by WordPress.com (Jetpack 12.5; WordPress 6.4)" [redacted] 105.161.44.101 - - [10/Jul/2026:07:27:21 +0200] "POST /xmlrpc.php HTTP/1.1" 405 428 "-" "Jetpack by WordPress.com" [redacted] 105.161.44.101 - - [10/Jul/2026:07:27:31 +0200] "POST /xmlrpc.php HTTP/1.1" 405 428 "-" "Jetpack by WordPress.com" [redacted] 105.161.44.101 - - [10/Jul/2026:07:27:42 +0200] "POST /xmlrpc.php HTTP/1.1" 405 428 "-" "Jetpack by WordPress.com (Jetpack 12.0; WordPress 6.3)" ... show less	Hacking Web App Attack
🇫🇷 LRob	2026-07-10 04:24:08 (1 week ago)	CrowdSec: crowdsecurity/http-bf-wordpress_bf_xmlrpc \| req: ["/xmlrpc.php"] \| UA: ["Jetpack/12.5; Wor ... show more CrowdSec: crowdsecurity/http-bf-wordpress_bf_xmlrpc \| req: ["/xmlrpc.php"] \| UA: ["Jetpack/12.5; WordPress/6.4; http://site30732676.com","Jetpack by WordPress.com (Jetpack 13.0; WordPress 6.1)","Jetpack by WordPress.com","WordPress show less	Brute-Force Web App Attack
🇺🇸 TPI-Abuse	2026-07-09 10:07:44 (1 week ago)	(mod_security) mod_security (id:240335) triggered by 105.161.44.101 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:240335) triggered by 105.161.44.101 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jul 09 06:07:38.872565 2026] [security2:error] [pid 3180:tid 3238] [client 105.161.44.101:4768] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 105.161.44.101 (+1 hits since last alert)\|vancekelly.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "vancekelly.com"] [uri "/xmlrpc.php"] [unique_id "ak9y6jAB4aAzfhTdHsYo2gAAAEA"] show less	Brute-Force Bad Web Bot Web App Attack
Anonymous	2026-07-09 09:04:28 (1 week ago)	[redacted] 105.161.44.101 - - [09/Jul/2026:11:03:44 +0200] "POST /xmlrpc.php HTTP/1.1" 405 415 "-" " ... show more [redacted] 105.161.44.101 - - [09/Jul/2026:11:03:44 +0200] "POST /xmlrpc.php HTTP/1.1" 405 415 "-" "Jetpack/12.1; WordPress/6.2; http://site34410278.com" [redacted] 105.161.44.101 - - [09/Jul/2026:11:03:54 +0200] "POST /xmlrpc.php HTTP/1.1" 405 415 "-" "Jetpack/12.0; WordPress/6.3; http://site36770495.com" [redacted] 105.161.44.101 - - [09/Jul/2026:11:04:05 +0200] "POST /xmlrpc.php HTTP/1.1" 405 415 "-" "Jetpack by WordPress.com" [redacted] 105.161.44.101 - - [09/Jul/2026:11:04:16 +0200] "POST /xmlrpc.php HTTP/1.1" 405 415 "-" "WordPress.com; https://wordpress.com" [redacted] 105.161.44.101 - - [09/Jul/2026:11:04:26 +0200] "POST /xmlrpc.php HTTP/1.1" 405 415 "-" "Jetpack/12.1; WordPress/6.4; http://site31404659.com" ... show less	Hacking Web App Attack
🇺🇸 TPI-Abuse	2026-07-09 09:00:49 (1 week ago)	(mod_security) mod_security (id:240335) triggered by 105.161.44.101 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:240335) triggered by 105.161.44.101 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jul 09 05:00:44.226011 2026] [security2:error] [pid 17554:tid 17554] [client 105.161.44.101:2346] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 105.161.44.101 (+1 hits since last alert)\|arellasoc.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "arellasoc.com"] [uri "/xmlrpc.php"] [unique_id "ak9jPIf8MCBkP9L1IPaI1QAAAAo"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-07-09 07:30:18 (1 week ago)	(mod_security) mod_security (id:240335) triggered by 105.161.44.101 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:240335) triggered by 105.161.44.101 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jul 09 03:30:13.213487 2026] [security2:error] [pid 30149:tid 30149] [client 105.161.44.101:1310] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5965"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 105.161.44.101 (+1 hits since last alert)\|certifiedfarmersmarkets.org\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "certifiedfarmersmarkets.org"] [uri "/xmlrpc.php"] [unique_id "ak9OBU0-XtCj7aOtZai-OgAAAAc"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-07-09 07:05:13 (1 week ago)	(mod_security) mod_security (id:240335) triggered by 105.161.44.101 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:240335) triggered by 105.161.44.101 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jul 09 03:05:08.229392 2026] [security2:error] [pid 23631:tid 23687] [client 105.161.44.101:1057] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 105.161.44.101 (+1 hits since last alert)\|jofdt.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "jofdt.com"] [uri "/xmlrpc.php"] [unique_id "ak9IJNESTkxppYBxT0jO9AAAAJU"] show less	Brute-Force Bad Web Bot Web App Attack

Showing 1 to 15 of 15 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇵🇭 124.6.178.98

🇳🇱 45.156.128.66

🇦🇺 45.38.149.44

🇧🇾 37.214.65.19

🇱🇻 213.232.204.130

🇳🇱 195.178.110.227

🇬🇹 190.14.129.34

🇧🇷 177.130.233.64

🇺🇸 172.252.13.101

🇺🇸 172.56.14.234

🇧🇷 138.185.147.80

🇨🇳 120.224.242.78

🇫🇷 104.28.160.48

🇮🇳 103.179.170.195

🇬🇧 101.36.97.205

🇺🇸 2a09:bac5:a6c4:2773::3ee:65

🇨🇳 218.26.205.154

🇩🇪 213.209.159.236

🇮🇳 182.78.112.174

🇨🇳 180.168.60.146