JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 105.224.36.81

105.224.36.81 was found in our database!

This IP was reported 9 times. Confidence of Abuse is 41%: ?

41%

ISP	Telkom Internet Broadband 105 224
Usage Type	Fixed Line ISP
ASN	AS37457
Hostname(s)	36-224-105-81.north.dsl.telkomsa.net
Domain Name	telkom.co.za
Country	🇿🇦 South Africa
City	Pretoria, Gauteng

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 105.224.36.81

Whois 105.224.36.81

IP Abuse Reports for 105.224.36.81:

This IP address has been reported a total of 9 times from 6 distinct sources. 105.224.36.81 was first reported on August 22nd 2026, and the most recent report was 3 days ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇺🇸 IndigoRidge	2026-08-24 15:52:46 (3 days ago)	105.224.36.81 - - [24/Aug/2026:11:51:46 -0400] "POST /xmlrpc.php HTTP/1.0" 200 5072 "-" "Mozilla/5.0 ... show more 105.224.36.81 - - [24/Aug/2026:11:51:46 -0400] "POST /xmlrpc.php HTTP/1.0" 200 5072 "-" "Mozilla/5.0 (Windows NT 6.3; x86) AppleWebKit/537.36 (KHTML, like Gecko) Safari/10.0.0.0 Safari/537.36" 105.224.36.81 - - [24/Aug/2026:11:52:04 -0400] "POST /xmlrpc.php HTTP/1.0" 200 5088 "-" "Mozilla/5.0 (Linux; Android 10; x64) AppleWebKit/537.36 (KHTML, like Gecko) Firefox/80.0.0.0 Safari/537.36" 105.224.36.81 - - [24/Aug/2026:11:52:20 -0400] "POST /xmlrpc.php HTTP/1.0" 200 5056 "-" "Mozilla/5.0 (Windows NT 10.0; arm64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36" 105.224.36.81 - - [24/Aug/2026:11:52:32 -0400] "POST /xmlrpc.php HTTP/1.0" 200 5072 "-" "Mozilla/5.0 (Windows NT 10.0; arm64) AppleWebKit/537.36 (KHTML, like Gecko) Safari/10.0.0.0 Safari/537.36" 105.224.36.81 - - [24/Aug/2026:11:52:45 -0400] "POST /xmlrpc.php HTTP/1.0" 200 5056 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; x86) AppleWebKit/537.36 (KHTML, like Gecko) Safari/14.0.0.0 Safari/537.36" ... show less	Web App Attack
🇺🇸 TPI-Abuse	2026-08-24 10:59:06 (3 days ago)	(mod_security) mod_security (id:225170) triggered by 105.224.36.81 (36-224-105-81.north.dsl.telkomsa ... show more (mod_security) mod_security (id:225170) triggered by 105.224.36.81 (36-224-105-81.north.dsl.telkomsa.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Aug 24 06:59:02.298073 2026] [security2:error] [pid 25634:tid 25722] [client 105.224.36.81:53196] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)\|\|trulyoriginalpurpleoctopus.art\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "trulyoriginalpurpleoctopus.art"] [uri "/wp-json/wp/v2/users"] [unique_id "aowj9lU-TPRaUNuXzBZ55QAAAFA"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 IndigoRidge	2026-08-24 09:06:29 (3 days ago)	105.224.36.81 - - [24/Aug/2026:05:04:20 -0400] "POST /xmlrpc.php HTTP/1.0" 200 5088 "-" "Mozilla/5.0 ... show more 105.224.36.81 - - [24/Aug/2026:05:04:20 -0400] "POST /xmlrpc.php HTTP/1.0" 200 5088 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; arm64) AppleWebKit/537.36 (KHTML, like Gecko) Safari/10.0.0.0 Safari/537.36" 105.224.36.81 - - [24/Aug/2026:05:04:48 -0400] "POST /xmlrpc.php HTTP/1.0" 200 5088 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7; x64) AppleWebKit/537.36 (KHTML, like Gecko) Safari/13.0.0.0 Safari/537.36" 105.224.36.81 - - [24/Aug/2026:05:05:16 -0400] "POST /xmlrpc.php HTTP/1.0" 200 5072 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7; x86) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36" 105.224.36.81 - - [24/Aug/2026:05:05:52 -0400] "POST /xmlrpc.php HTTP/1.0" 200 5056 "-" "Mozilla/5.0 (Windows NT 10.0; arm64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36" 105.224.36.81 - - [24/Aug/2026:05:06:28 -0400] "POST /xmlrpc.php HTTP/1.0" 200 5088 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; x86) AppleWebKit/537.36 (KHTML, like Gecko) ... show less	Web App Attack
🇦🇺 Bay13	2026-08-24 08:01:32 (3 days ago)	CrowdSec:custom/http-sensitive-files	Web App Attack
🇫🇷 SpaceHost-Server	2026-08-23 20:34:48 (4 days ago)	105.224.36.81 - - [23/Aug/2026:22:33:20 +0200] "POST /xmlrpc.php HTTP/1.1" 200 6396 "-" "Mozilla/5.0 ... show more 105.224.36.81 - - [23/Aug/2026:22:33:20 +0200] "POST /xmlrpc.php HTTP/1.1" 200 6396 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7; x64) AppleWebKit/537.36 (KHTML, like Gecko) Firefox/75.0.0.0 Safari/537.36" 105.224.36.81 - - [23/Aug/2026:22:34:16 +0200] "POST /xmlrpc.php HTTP/1.1" 200 6396 "-" "Mozilla/5.0 (Windows NT 6.2; arm64) AppleWebKit/537.36 (KHTML, like Gecko) Opera/79.0.0.0 Safari/537.36" 105.224.36.81 - - [23/Aug/2026:22:34:46 +0200] "POST /xmlrpc.php HTTP/1.1" 200 6396 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7; arm64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/84.0.0.0 Safari/537.36" show less	Hacking Web App Attack
🇫🇷 SpaceHost-Server	2026-08-23 19:49:26 (4 days ago)	105.224.36.81 - - [23/Aug/2026:21:48:22 +0200] "POST /xmlrpc.php HTTP/1.1" 200 6396 "-" "Mozilla/5.0 ... show more 105.224.36.81 - - [23/Aug/2026:21:48:22 +0200] "POST /xmlrpc.php HTTP/1.1" 200 6396 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; arm64) AppleWebKit/537.36 (KHTML, like Gecko) Firefox/94.0.0.0 Safari/537.36" 105.224.36.81 - - [23/Aug/2026:21:48:55 +0200] "POST /xmlrpc.php HTTP/1.1" 200 6396 "-" "Mozilla/5.0 (Windows NT 6.3; x64) AppleWebKit/537.36 (KHTML, like Gecko) Safari/14.0.0.0 Safari/537.36" 105.224.36.81 - - [23/Aug/2026:21:49:25 +0200] "POST /xmlrpc.php HTTP/1.1" 200 6396 "-" "Mozilla/5.0 (Windows NT 10.0; arm64) AppleWebKit/537.36 (KHTML, like Gecko) Firefox/77.0.0.0 Safari/537.36" show less	Hacking Web App Attack
🇺🇸 TPI-Abuse	2026-08-22 20:26:09 (5 days ago)	(mod_security) mod_security (id:225170) triggered by 105.224.36.81 (36-224-105-81.north.dsl.telkomsa ... show more (mod_security) mod_security (id:225170) triggered by 105.224.36.81 (36-224-105-81.north.dsl.telkomsa.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Aug 22 16:26:03.363727 2026] [security2:error] [pid 9318:tid 9318] [client 105.224.36.81:58590] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)\|\|fatcaverecords.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "fatcaverecords.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aooF2_TRd8zPkAskwEAfdwAAAA8"] show less	Brute-Force Bad Web Bot Web App Attack
🇮🇩 Burayot	2026-08-22 16:26:15 (5 days ago)	LF_MODSEC: (mod_security) mod_security (id:1000001) triggered by 105.224.36.81 (36-224-105-81.north. ... show more LF_MODSEC: (mod_security) mod_security (id:1000001) triggered by 105.224.36.81 (36-224-105-81.north.dsl.telkomsa.net): 1 in the last 3600 secs show less	Web App Attack
🇩🇪 inlink.ltd	2026-08-22 16:03:13 (5 days ago)	Known malicious PHP file or CMS probe	Web App Attack

Showing 1 to 9 of 9 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇸🇬 212.73.148.34

🇵🇱 176.53.159.198

🇷🇺 91.202.233.61

🇺🇸 20.169.16.7

🇺🇸 20.106.39.30

🇨🇴 186.121.139.226

🇺🇸 172.68.174.96

🇺🇸 147.185.132.250

🇷🇴 92.118.39.50

🇺🇸 66.249.75.97

🇻🇳 1.52.150.15

🇦🇷 181.93.166.56

🇨🇱 167.249.31.124

🇫🇷 85.204.70.88

🇨🇳 58.47.137.190

🇨🇱 45.180.27.138

🇳🇱 45.148.10.157

🇸🇬 34.21.217.246

🇮🇳 27.123.113.30

🇨🇦 20.104.50.220