JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 105.163.1.109

105.163.1.109 was found in our database!

This IP was reported 37 times. Confidence of Abuse is 45%: ?

45%

ISP	Safaricom Limited
Usage Type	Fixed Line ISP
ASN	AS33771
Domain Name	safaricom.co.ke
Country	🇰🇪 Kenya
City	Nairobi, Nairobi County

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 105.163.1.109

Whois 105.163.1.109

IP Abuse Reports for 105.163.1.109:

This IP address has been reported a total of 37 times from 22 distinct sources. 105.163.1.109 was first reported on November 10th 2023, and the most recent report was 3 weeks ago.

Old Reports: The most recent abuse report for this IP address is from 3 weeks ago . It is possible that this IP is no longer involved in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇺🇸 TPI-Abuse	2026-06-12 19:04:59 (3 weeks ago)	(mod_security) mod_security (id:240335) triggered by 105.163.1.109 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:240335) triggered by 105.163.1.109 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jun 12 15:04:53.517993 2026] [security2:error] [pid 433:tid 433] [client 105.163.1.109:3919] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 105.163.1.109 (+1 hits since last alert)\|technesa.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "technesa.com"] [uri "/xmlrpc.php"] [unique_id "aixYVZK4cufzKYOkhWlIhgAAABQ"] show less	Brute-Force Bad Web Bot Web App Attack
🇦🇺 screwlooseit.com.au	2026-06-12 08:57:28 (3 weeks ago)	Blocked by CSF 13 firewall - Rule: XMLRPC KE/Kenya/-	Web App Attack
🇺🇸 TPI-Abuse	2026-06-12 06:24:47 (3 weeks ago)	(mod_security) mod_security (id:240335) triggered by 105.163.1.109 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:240335) triggered by 105.163.1.109 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jun 12 02:24:41.971361 2026] [security2:error] [pid 21307:tid 21307] [client 105.163.1.109:4546] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5965"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 105.163.1.109 (+1 hits since last alert)\|rockinr.org\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "rockinr.org"] [uri "/xmlrpc.php"] [unique_id "aiumKRVWCXFI_ZiCb4ArLwAAAAE"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-06-12 01:43:04 (3 weeks ago)	(mod_security) mod_security (id:240335) triggered by 105.163.1.109 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:240335) triggered by 105.163.1.109 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jun 11 21:42:58.981808 2026] [security2:error] [pid 22954:tid 22954] [client 105.163.1.109:2888] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 105.163.1.109 (+1 hits since last alert)\|natickvillagerentals.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "natickvillagerentals.com"] [uri "/xmlrpc.php"] [unique_id "aitkIlpNk1iEevup3xoYZQAAAAY"] show less	Brute-Force Bad Web Bot Web App Attack
🇳🇱 Site.eu	2026-06-11 21:37:00 (3 weeks ago)	Repeated wp-login/xmlrpc attempts	Brute-Force SSH
Anonymous	2026-06-11 16:38:25 (4 weeks ago)		Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-06-11 12:22:49 (4 weeks ago)	(mod_security) mod_security (id:240335) triggered by 105.163.1.109 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:240335) triggered by 105.163.1.109 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jun 11 08:22:41.212482 2026] [security2:error] [pid 26076:tid 26076] [client 105.163.1.109:4103] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 105.163.1.109 (+1 hits since last alert)\|desertalfas.org\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "desertalfas.org"] [uri "/xmlrpc.php"] [unique_id "aiqokS78lSkLvICYnGym7QAAAA4"] show less	Brute-Force Bad Web Bot Web App Attack
🇫🇷 Kenshin869	2026-06-11 12:20:44 (4 weeks ago)	Wordpress unauthorized access attempt	Brute-Force
🇺🇸 TPI-Abuse	2026-06-11 09:50:27 (4 weeks ago)	(mod_security) mod_security (id:240335) triggered by 105.163.1.109 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:240335) triggered by 105.163.1.109 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jun 11 05:50:22.523443 2026] [security2:error] [pid 31703:tid 31703] [client 105.163.1.109:4583] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 105.163.1.109 (+1 hits since last alert)\|capitalswisscorp.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "capitalswisscorp.com"] [uri "/xmlrpc.php"] [unique_id "aiqE3vLFO3bwQIeIDZ8DeAAAAAA"] show less	Brute-Force Bad Web Bot Web App Attack
Anonymous	2026-06-11 08:35:16 (4 weeks ago)	[redacted] 105.163.1.109 - - [11/Jun/2026:10:34:24 +0200] "POST /xmlrpc.php HTTP/1.1" 200 418 "-" "J ... show more [redacted] 105.163.1.109 - - [11/Jun/2026:10:34:24 +0200] "POST /xmlrpc.php HTTP/1.1" 200 418 "-" "Jetpack by WordPress.com" [redacted] 105.163.1.109 - - [11/Jun/2026:10:34:33 +0200] "POST /xmlrpc.php HTTP/1.1" 200 418 "-" "Jetpack by WordPress.com (Jetpack 12.5; WordPress 6.1)" [redacted] 105.163.1.109 - - [11/Jun/2026:10:34:34 +0200] "POST /xmlrpc.php HTTP/1.1" 200 418 "-" "Jetpack by WordPress.com (Jetpack 12.0; WordPress 6.2)" [redacted] 105.163.1.109 - - [11/Jun/2026:10:34:43 +0200] "POST /xmlrpc.php HTTP/1.1" 200 418 "-" "WordPress.com; https://wordpress.com" [redacted] 105.163.1.109 - - [11/Jun/2026:10:34:45 +0200] "POST /xmlrpc.php HTTP/1.1" 200 418 "-" "WordPress.com; https://wordpress.com" [redacted] 105.163.1.109 - - [11/Jun/2026:10:34:53 +0200] "POST /xmlrpc.php HTTP/1.1" 200 418 "-" "Jetpack by WordPress.com (Jetpack 12.5; WordPress 6.4)" [redacted] 105.163.1.109 - - [11/Jun/2026:10:34:55 +0200] "POST /xmlrpc.php HTTP/1.1" 200 418 "-" "WordPress.com; https://wordpress.com" ... show less	Hacking Web App Attack
🇦🇺 screwlooseit.com.au	2026-06-11 04:33:21 (4 weeks ago)	Blocked by CSF 13 firewall - Rule: XMLRPC KE/Kenya/-	Web App Attack
🇺🇸 TPI-Abuse	2026-06-11 03:21:02 (4 weeks ago)	(mod_security) mod_security (id:240335) triggered by 105.163.1.109 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:240335) triggered by 105.163.1.109 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jun 10 23:20:55.835827 2026] [security2:error] [pid 3935:tid 3935] [client 105.163.1.109:1049] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 105.163.1.109 (+1 hits since last alert)\|meganmurph.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "meganmurph.com"] [uri "/xmlrpc.php"] [unique_id "aiopl8Nxvslrvod2RBy2mAAAABY"] show less	Brute-Force Bad Web Bot Web App Attack
Anonymous	2026-06-11 02:18:10 (4 weeks ago)	Attac	Brute-Force
🇫🇷 applemooz	2026-06-10 07:17:17 (4 weeks ago)	WordPress XMLRPC Brute Force Attacks ...	Brute-Force Web App Attack
Anonymous	2026-06-10 06:15:27 (4 weeks ago)	Fail2ban filtered ...	Web App Attack

Showing 1 to 15 of 37 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇺🇸 161.129.211.63

🇺🇸 85.239.151.34

🇳🇱 45.148.10.157

🇺🇸 2607:ff10:c8:594::d

🇬🇹 181.209.186.98

🇮🇳 171.49.149.251

🇨🇦 165.22.231.142

🇹🇼 111.70.23.245

🇨🇳 106.12.75.58

🇮🇩 103.253.245.232

🇨🇳 47.99.146.188

🇬🇧 5.226.140.91

🇨🇳 218.26.205.154

🇷🇴 193.46.255.86

🇺🇸 192.101.68.88

🇵🇱 176.53.159.197

🇧🇷 170.81.183.250

🇧🇷 170.78.29.184

🇩🇪 167.94.145.23

🇭🇰 152.32.169.155