JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 105.163.1.251

105.163.1.251 was found in our database!

This IP was reported 31 times. Confidence of Abuse is 43%: ?

43%

ISP	Safaricom Limited
Usage Type	Fixed Line ISP
ASN	AS33771
Domain Name	safaricom.co.ke
Country	🇰🇪 Kenya
City	Ruiru, Kiambu County

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 105.163.1.251

Whois 105.163.1.251

IP Abuse Reports for 105.163.1.251:

This IP address has been reported a total of 31 times from 18 distinct sources. 105.163.1.251 was first reported on November 2nd 2022, and the most recent report was 2 hours ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇺🇸 TPI-Abuse	2026-08-01 06:53:00 (2 hours ago)	(mod_security) mod_security (id:240335) triggered by 105.163.1.251 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:240335) triggered by 105.163.1.251 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Aug 01 02:52:55.052681 2026] [security2:error] [pid 1501514:tid 1501514] [client 105.163.1.251:4926] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5965"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 105.163.1.251 (+1 hits since last alert)\|tomartsmedia.org\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "tomartsmedia.org"] [uri "/xmlrpc.php"] [unique_id "am2Xx0taTvdGpZFBRJScIAAAAAg"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-08-01 05:09:45 (4 hours ago)	(mod_security) mod_security (id:240335) triggered by 105.163.1.251 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:240335) triggered by 105.163.1.251 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Aug 01 01:09:38.899288 2026] [security2:error] [pid 594925:tid 594925] [client 105.163.1.251:3855] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 105.163.1.251 (+1 hits since last alert)\|towlesilvapsychotherapy.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "towlesilvapsychotherapy.com"] [uri "/xmlrpc.php"] [unique_id "am1_kg1xkA1HCxzFmE7I1gAAAAw"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-08-01 03:06:14 (6 hours ago)	(mod_security) mod_security (id:240335) triggered by 105.163.1.251 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:240335) triggered by 105.163.1.251 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jul 31 23:06:10.277529 2026] [security2:error] [pid 88660:tid 88660] [client 105.163.1.251:4846] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 105.163.1.251 (+1 hits since last alert)\|brbcash.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "brbcash.com"] [uri "/xmlrpc.php"] [unique_id "am1ionaEDyL3HpF-gHsGLAAAAAg"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-08-01 02:35:18 (7 hours ago)	(mod_security) mod_security (id:240335) triggered by 105.163.1.251 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:240335) triggered by 105.163.1.251 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jul 31 22:35:09.980153 2026] [security2:error] [pid 1695337:tid 1695337] [client 105.163.1.251:3530] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5965"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 105.163.1.251 (+1 hits since last alert)\|waterjetsolutions.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "waterjetsolutions.com"] [uri "/xmlrpc.php"] [unique_id "am1bXYudcjZX0SnLlE4FLwAAAIs"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-08-01 00:29:42 (9 hours ago)	(mod_security) mod_security (id:240335) triggered by 105.163.1.251 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:240335) triggered by 105.163.1.251 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jul 31 20:29:37.537669 2026] [security2:error] [pid 29711:tid 29711] [client 105.163.1.251:3411] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5965"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 105.163.1.251 (+1 hits since last alert)\|stinsonbeachsurfandkayak.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "stinsonbeachsurfandkayak.com"] [uri "/xmlrpc.php"] [unique_id "am098W6BJlWids9HrNiFiwAAAAU"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-07-31 23:28:56 (10 hours ago)	(mod_security) mod_security (id:240335) triggered by 105.163.1.251 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:240335) triggered by 105.163.1.251 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jul 31 19:28:51.704242 2026] [security2:error] [pid 3330684:tid 3330684] [client 105.163.1.251:2552] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 105.163.1.251 (+1 hits since last alert)\|eatcakecup.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "eatcakecup.com"] [uri "/xmlrpc.php"] [unique_id "am0vs1YcrhyQOMQuue6uogAAAAA"] show less	Brute-Force Bad Web Bot Web App Attack
🇧🇪 cmbplf	2026-07-31 21:26:02 (12 hours ago)	6.151 requests with url.path */xmlrpc.php	Brute-Force Bad Web Bot
🇺🇸 LSPCCU	2026-07-31 20:05:47 (13 hours ago)	TSEC Honeypot Network report. Threat score: 70/100. Categories: Hacking. Honeypot: ssh-telnet, cowri ... show more TSEC Honeypot Network report. Threat score: 70/100. Categories: Hacking. Honeypot: ssh-telnet, cowrie. Context: Attacker IP from Nairobi, Kenya. show less	Hacking
🇺🇸 TPI-Abuse	2026-07-31 18:40:46 (15 hours ago)	(mod_security) mod_security (id:240335) triggered by 105.163.1.251 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:240335) triggered by 105.163.1.251 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jul 31 14:40:38.808726 2026] [security2:error] [pid 1715:tid 1715] [client 105.163.1.251:6664] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 105.163.1.251 (+1 hits since last alert)\|learnserve.net\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "learnserve.net"] [uri "/xmlrpc.php"] [unique_id "amzsJu1mXZZ_dXKLjMM-BQAAAAA"] show less	Brute-Force Bad Web Bot Web App Attack
🇫🇷 dynamix	2026-07-31 18:37:41 (15 hours ago)	WordPress XMLRPC Brute Force Attack	Brute-Force Web App Attack
🇩🇪 LRob	2026-07-31 18:07:06 (15 hours ago)	CrowdSec: crowdsecurity/http-bf-wordpress_bf_xmlrpc \| req: /xmlrpc.php \| UA: WordPress.com; https:// ... show more CrowdSec: crowdsecurity/http-bf-wordpress_bf_xmlrpc \| req: /xmlrpc.php \| UA: WordPress.com; https://wordpress.com show less	Brute-Force Web App Attack
🇩🇪 grassau.com	2026-07-31 17:15:48 (16 hours ago)	(wordpress) Failed wordpress login from 105.163.1.251 (KE/Kenya/Nairobi County/Nairobi/-)	Brute-Force
Anonymous	2026-05-05 19:45:07 (2 months ago)	Unauthorized connection attempt on Port 2323	Port Scan Hacking Exploited Host
🇺🇸 xmission.com	2026-05-05 16:02:22 (2 months ago)	Blocked by UFW (TCP on 23) Source port: 6909 TTL: 44 Packet length: 60 TOS: 0x08 This report (for 1 ... show more Blocked by UFW (TCP on 23) Source port: 6909 TTL: 44 Packet length: 60 TOS: 0x08 This report (for 105.163.1.251) was generated by: https://github.com/sefinek/UFW-AbuseIPDB-Reporter show less	Port Scan Hacking Brute-Force
🇩🇪 banankicks	2026-05-03 17:32:53 (2 months ago)	Unauthorized connection attempt detected from IP address 105.163.1.251 to port 23 (banankicks-server ... show more Unauthorized connection attempt detected from IP address 105.163.1.251 to port 23 (banankicks-server) [o] show less	Brute-Force Exploited Host

Showing 1 to 15 of 31 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇵🇪 200.37.103.36

🇲🇽 187.190.184.239

🇵🇱 176.53.159.197

🇺🇸 172.206.225.82

🇨🇳 116.179.37.229

🇨🇳 116.179.37.47

🇱🇹 80.209.237.200

🇰🇷 58.229.253.119

🇷🇺 46.191.163.43

🇳🇱 45.153.34.112

🇳🇱 45.148.10.147

🇧🇩 45.127.244.75

🇳🇴 20.100.186.69

🇺🇸 2a03:2880:f800:9::

🇸🇪 162.158.182.67

🇨🇳 116.179.37.227

🇨🇳 116.179.37.214

🇩🇪 64.89.163.251

🇮🇳 49.204.74.149

🇺🇸 20.228.193.165