JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 165.165.111.213

165.165.111.213 was found in our database!

This IP was reported 29 times. Confidence of Abuse is 76%: ?

76%

ISP	Telkom SA Limited
Usage Type	Mobile ISP
ASN	AS5713
Hostname(s)	north-165-111-213.cgnat.osnet.co.za
Domain Name	telkom.co.za
Country	🇿🇦 South Africa
City	Johannesburg, Gauteng

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 165.165.111.213

Whois 165.165.111.213

IP Abuse Reports for 165.165.111.213:

This IP address has been reported a total of 29 times from 19 distinct sources. 165.165.111.213 was first reported on July 24th 2025, and the most recent report was 2 days ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇺🇸 integrantservices.com	2026-07-24 10:21:19 (2 days ago)	(wordpress) Failed wordpress login from 165.165.111.213 (north-165-111-213.cgnat.osnet.co.za)	Brute-Force
🇺🇸 TPI-Abuse	2026-07-24 09:23:43 (2 days ago)	(mod_security) mod_security (id:240335) triggered by 165.165.111.213 (north-165-111-213.cgnat.osnet. ... show more (mod_security) mod_security (id:240335) triggered by 165.165.111.213 (north-165-111-213.cgnat.osnet.co.za): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jul 24 05:23:36.724706 2026] [security2:error] [pid 128607:tid 128607] [client 165.165.111.213:13142] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 165.165.111.213 (+1 hits since last alert)\|vanmeer.info\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "vanmeer.info"] [uri "/xmlrpc.php"] [unique_id "amMvGMYXrX3izcXUlwTpOQAAABA"] show less	Brute-Force Bad Web Bot Web App Attack
Anonymous	2026-07-24 07:16:17 (2 days ago)	[redacted] 165.165.111.213 - - [24/Jul/2026:09:15:35 +0200] "POST /xmlrpc.php HTTP/1.1" 405 428 "-" ... show more [redacted] 165.165.111.213 - - [24/Jul/2026:09:15:35 +0200] "POST /xmlrpc.php HTTP/1.1" 405 428 "-" "WordPress.com; https://wordpress.com" [redacted] 165.165.111.213 - - [24/Jul/2026:09:15:44 +0200] "POST /xmlrpc.php HTTP/1.1" 405 428 "-" "Jetpack by WordPress.com" [redacted] 165.165.111.213 - - [24/Jul/2026:09:15:55 +0200] "POST /xmlrpc.php HTTP/1.1" 405 428 "-" "Jetpack by WordPress.com (Jetpack 13.0; WordPress 6.3)" [redacted] 165.165.111.213 - - [24/Jul/2026:09:16:06 +0200] "POST /xmlrpc.php HTTP/1.1" 405 428 "-" "Jetpack/12.1; WordPress/6.1; http://site79827623.com" [redacted] 165.165.111.213 - - [24/Jul/2026:09:16:16 +0200] "POST /xmlrpc.php HTTP/1.1" 405 428 "-" "Jetpack/12.5; WordPress/6.4; http://site28369510.com" ... show less	Hacking Web App Attack
🇳🇱 Site.eu	2026-07-24 06:46:20 (2 days ago)	Repeated wp-login/xmlrpc attempts	Brute-Force SSH
🇪🇸 masterguru	2026-07-23 13:22:04 (3 days ago)	(xmlrpc) Failed xmlrpc access from 165.165.111.213 (ZA/South Africa/north-165-111-213.cgnat.osnet.co ... show more (xmlrpc) Failed xmlrpc access from 165.165.111.213 (ZA/South Africa/north-165-111-213.cgnat.osnet.co.za): 5 in the last 3600 secs (0-122) show less	Hacking
🇫🇷 dynamix	2026-07-23 08:14:07 (3 days ago)	WordPress XMLRPC Brute Force Attack	Brute-Force Web App Attack
🇩🇪 rh24	2026-07-22 12:23:07 (4 days ago)	(xmlrpc_405) XMLRPC-Bot 405 165.165.111.213 (north-165-111-213.cgnat.osnet.co.za)	Hacking
🇪🇸 alferez	2026-07-22 12:15:27 (4 days ago)	xmlrpc.php attack DOS	Hacking Exploited Host Web App Attack
Anonymous	2026-07-22 09:07:39 (4 days ago)	Fail2ban filtered ...	Web App Attack
🇺🇸 TPI-Abuse	2026-07-20 12:46:54 (6 days ago)	(mod_security) mod_security (id:240335) triggered by 165.165.111.213 (north-165-111-213.cgnat.osnet. ... show more (mod_security) mod_security (id:240335) triggered by 165.165.111.213 (north-165-111-213.cgnat.osnet.co.za): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jul 20 08:46:49.929667 2026] [security2:error] [pid 1541253:tid 1541253] [client 165.165.111.213:19579] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 165.165.111.213 (+1 hits since last alert)\|suswastima.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "suswastima.com"] [uri "/xmlrpc.php"] [unique_id "al4Yubczm-tpr3zQLYAH8wAAABQ"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 lostswordfish.com	2026-07-20 08:42:04 (6 days ago)	Wordfence waf block on jestrellafoundation	Web App Attack
🇫🇷 dynamix	2026-07-20 07:26:14 (6 days ago)	WordPress XMLRPC Brute Force Attack	Brute-Force Web App Attack
Anonymous	2026-07-15 06:38:35 (1 week ago)	Fail2Ban: WordPress XML-RPC brute-force attack detected.	Bad Web Bot Web App Attack
🇩🇪 ghostwarriors	2026-07-14 22:50:11 (1 week ago)	Webpage scraping	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-07-11 07:24:10 (2 weeks ago)	(mod_security) mod_security (id:240335) triggered by 165.165.111.213 (north-165-111-213.cgnat.osnet. ... show more (mod_security) mod_security (id:240335) triggered by 165.165.111.213 (north-165-111-213.cgnat.osnet.co.za): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Jul 11 03:24:01.892545 2026] [security2:error] [pid 22736:tid 22736] [client 165.165.111.213:60255] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 165.165.111.213 (+1 hits since last alert)\|concentricsteel.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "concentricsteel.com"] [uri "/xmlrpc.php"] [unique_id "alHvkRbx_PcZNZErwbDWhgAAAAs"] show less	Brute-Force Bad Web Bot Web App Attack

Showing 1 to 15 of 29 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇧🇷 173.244.55.103

🇺🇸 162.217.100.41

🇳🇱 195.93.244.97

🇺🇸 152.232.101.100

🇨🇳 122.97.212.115

🇨🇳 120.48.15.138

🇰🇷 112.216.129.27

🇸🇬 185.200.116.67

🇧🇷 170.254.82.15

🇧🇷 168.75.77.111

🇺🇸 152.232.101.99

🇺🇸 69.12.80.254

🇺🇸 54.83.240.58

🇳🇱 46.151.178.13

🇯🇵 20.48.41.224

🇺🇸 216.226.77.10

🇺🇸 205.210.31.88

🇷🇴 193.32.162.42

🇧🇷 191.235.98.185

🇵🇰 182.177.56.142